version: v1alpha1
debug: false
persist: true
machine:
  type: worker
  token: i1qaz0.1elrf4bh8hyvo09e
  ca:
    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBcFV2UmZVSVJVTWVoSTN2elNGTXIyakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qWXdOVEUzTWpBd05qRXpXaGNOTXpZd05URTBNakF3TmpFeldqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQVBzeXFTVUpnSUhvQjMxZWd1OXpGVStPcnpvb1NJOC9FNkkzCmJvOG1GaVIrbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkEvUm02ZHdwaGpCS3gxUQoraitrb1h1ZU9NbStNQVVHQXl0bGNBTkJBQTRwZmtaU0VlQkFpN0ZseDg1a1lDb2Q4aUpScEFBUi9RZkNDZ2hCCjBGMmtPOU5wZVhRb3BRL3V0VnJCdlkrNzJKRFFLRWdGTTc5MncwVkFaQzVmb2drPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    key: ""
  certSANs: []
  kubelet:
    image: ghcr.io/siderolabs/kubelet:v1.32.3
    extraArgs:
      rotate-server-certificates: "true"
    defaultRuntimeSeccompProfileEnabled: true
    nodeIP:
      validSubnets:
        - 10.1.71.0/24
    disableManifestsDirectory: true
  network:
    nameservers:
      - 10.1.71.1
  install:
    disk: /dev/sda
    image: factory.talos.dev/metal-installer/10326733f72d0b39b6750c291fc499359135c5486d4066efad56fcf4f3af6923:v1.13.5
    wipe: false
    grubUseUKICmdline: true
  time:
    servers:
      - 10.1.71.21
  sysctls:
    kernel.perf_event_paranoid: "1"
    kernel.unprivileged_bpf_disabled: "0"
    net.core.bpf_jit_harden: "0"
    net.ipv4.conf.all.arp_announce: "2"
    net.ipv4.conf.all.arp_ignore: "1"
  features:
    diskQuotaSupport: true
    kubePrism:
      enabled: true
      port: 7445
    hostDNS:
      enabled: true
      forwardKubeDNSToHost: true
  kernel:
    modules:
      - name: iscsi_tcp
      - name: dm_multipath
      - name: dm_round_robin
cluster:
  id: 6FRjhITdPHrGGI35sp0DwqaZP9INupBQIBVn9AZb6NA=
  secret: P2qqriHtWSm/8iGQMA4vnanm8Mh1f3nuhEFYH1yBPQM=
  controlPlane:
    endpoint: https://10.1.71.65:6443
  clusterName: fastpass
  network:
    dnsDomain: cluster.local
    podSubnets:
      - 10.244.0.0/16
    serviceSubnets:
      - 10.96.0.0/12
  token: 9w22i0.383cxk2u6ybraufx
  ca:
    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRWGZvbjBrR2hZUHNTRXcrOUo3VjdCakFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTJNRFV4TnpJd01EWXhNbG9YRFRNMk1EVXhOREl3TURZeApNbG93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCT1g5aDA5eFFDMGFVY3JRRDVGT2lVVzlHOG5abUhCcWc2dHRCVjhNdXBKSjNNMjdreFBGR2VEM05MQkYKVEFVbnBFRE1Jc2RLY09TZFNudWk0ZjJNY0hDallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVtbXp5UGV4Qk1VRWk2V3Y3MXBwK3V6SjRUWDR3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQVBpelUyM1EKMDVMV0xNSG5lMWo0SWF5dVRrU1pjeXRiZThBN2Y3VDlkb3J4QWlFQWwzSTJhTDhpSHczd2JSVjREQ3NPczZ3WAo5akxLa0prN09pWnhMNlJLR2RNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    key: ""
  apiServer:
    admissionControl:
      - name: PodSecurity
        configuration:
          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
          defaults:
            audit: restricted
            audit-version: latest
            enforce: privileged
            enforce-version: latest
            warn: restricted
            warn-version: latest
          exemptions:
            namespaces:
              - argocd
              - cert-manager
              - ingress-nginx
              - external-secrets
            runtimeClasses: []
            usernames: []
          kind: PodSecurityConfiguration
  discovery:
    enabled: true
    registries:
      kubernetes:
        disabled: true
      service: {}
---
apiVersion: v1alpha1
kind: HostnameConfig
auto: "off"
hostname: jungle-cruise
---
apiVersion: v1alpha1
kind: LinkConfig
name: ens18
addresses:
  - address: 10.1.71.69/24
routes:
  - gateway: 10.1.71.1
---
apiVersion: v1alpha1
kind: LinkConfig
name: ens19
addresses:
  - address: 10.1.75.69/24
---
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
configFiles:
  - content: |-
      # Pure Storage FlashArray multipath configuration
      # Configured via ExtensionServiceConfig for multipathd system service
      defaults {
          polling_interval 10
          path_selector "round-robin 0"
          path_grouping_policy group_by_prio
          path_checker tur
          prio alua
          failback immediate
          user_friendly_names no
          find_multipaths yes
          fast_io_fail_tmo 10
          dev_loss_tmo 600
          no_path_retry 0
      }

      devices {
          device {
              vendor "PURE"
              product "FlashArray"
              path_selector "round-robin 0"
              path_grouping_policy group_by_prio
              prio alua
              path_checker tur
              fast_io_fail_tmo 10
              user_friendly_names no
              no_path_retry 0
              hardware_handler "1 alua"
              dev_loss_tmo 600
              failback immediate
          }
      }

      blacklist {
          # Exclude Portworx PXD devices from multipathing
          devnode "^pxd[0-9]*"
          devnode "^pxd.*"
      }
    mountPath: /etc/multipath.conf