# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
# cluster:     fastpass
# managed by:  talhelper on city-hall (10.1.71.38)
# repo:        talos/talhelper/ in rblundon/homelab on mad-tea-party
#
# Quickref:
#   talhelper genconfig                              # regenerate clusterconfig/
#   talhelper gencommand apply --extra-flags="--insecure" | bash
#   talhelper gencommand bootstrap | bash
# ─────────────────────────────────────────────────────────────────────────────

clusterName: fastpass
talosVersion: v1.13.2
kubernetesVersion: v1.32.3

# VIP floats across control plane nodes — all kubectl/talosctl traffic lands here
endpoint: https://10.1.71.65:6443

# ─── Cluster-wide patches ────────────────────────────────────────────────────
patches:
  - |-
    cluster:
      # CRITICAL: enforce:privileged is required for Cilium.
      # The default (enforce:baseline) blocks the capabilities Cilium needs
      # (NET_ADMIN, NET_RAW, SYS_ADMIN). This was the root cause of the
      # broken cluster. Do not change this back to baseline.
      apiServer:
        admissionControl:
          - name: PodSecurity
            configuration:
              apiVersion: pod-security.admission.config.k8s.io/v1alpha1
              kind: PodSecurityConfiguration
              defaults:
                enforce: "privileged"
                enforce-version: "latest"
                audit: "restricted"
                audit-version: "latest"
                warn: "restricted"
                warn-version: "latest"
              exemptions:
                usernames: []
                runtimeClasses: []
                namespaces:
                  - argocd
                  - cert-manager
                  - ingress-nginx
                  - external-secrets

  - |-
    machine:
      time:
        servers:
          - 10.1.71.21   # sundial — local NTP

      # Sysctls required for Cilium eBPF on Talos
      # bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs
      # unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers
      # perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability
      sysctls:
        net.core.bpf_jit_harden: "0"
        kernel.unprivileged_bpf_disabled: "0"
        kernel.perf_event_paranoid: "1"

      # DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud
      # to monorail and handles external resolution via DoH
      network:
        nameservers:
          - 10.1.71.1
        extraHostEntries: []

      # Talos manages kubelet — these flags are additive
      kubelet:
        extraArgs:
          rotate-server-certificates: true

      # Feature gates — enable Gateway API support for Cilium's secondary ingress
      features:
        kubePrism:
          enabled: true
          port: 7445

# ─── Control plane patches ───────────────────────────────────────────────────
controlPlane:
  patches:
    - |-
      cluster:
        etcd:
          advertisedSubnets:
            - 10.1.71.0/24
        # Allow control plane nodes to schedule workloads (3-node CP on small cluster)
        scheduler:
          config:
            apiVersion: kubescheduler.config.k8s.io/v1
            kind: KubeSchedulerConfiguration
            profiles:
              - schedulerName: default-scheduler

    - |-
      machine:
        network:
          # VIP — floats across all three control plane nodes
          # Talos handles VIP natively; no keepalived needed
          interfaces:
            - interface: ens18
              vip:
                ip: 10.1.71.65

# ─── Nodes ───────────────────────────────────────────────────────────────────
nodes:
  # ── Control plane ──────────────────────────────────────────────────────────
  - hostname: space-mountain
    ipAddress: 10.1.71.66
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.66/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  - hostname: big-thunder-mountain
    ipAddress: 10.1.71.67
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.67/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  - hostname: splash-mountain
    ipAddress: 10.1.71.68
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.68/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  # ── Workers ────────────────────────────────────────────────────────────────
  - hostname: jungle-cruise
    ipAddress: 10.1.71.69
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.69/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false

  - hostname: haunted-mansion
    ipAddress: 10.1.71.70
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.70/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false

  - hostname: peter-pans-flight
    ipAddress: 10.1.71.71
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.71/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false