274 lines
8.9 KiB
YAML
274 lines
8.9 KiB
YAML
# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
|
|
# cluster: fastpass
|
|
# managed by: talhelper on city-hall (10.1.71.38)
|
|
# repo: talos/talhelper/ in rblundon/homelab on mad-tea-party
|
|
#
|
|
# Quickref:
|
|
# talhelper genconfig # regenerate clusterconfig/
|
|
# talhelper gencommand apply --extra-flags="--insecure" | bash
|
|
# talhelper gencommand bootstrap | bash
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
clusterName: fastpass
|
|
talosVersion: v1.13.2
|
|
kubernetesVersion: v1.32.3
|
|
|
|
# VIP floats across control plane nodes — all kubectl/talosctl traffic lands here
|
|
endpoint: https://10.1.71.65:6443
|
|
|
|
# ─── Cluster-wide patches ────────────────────────────────────────────────────
|
|
patches:
|
|
- |-
|
|
cluster:
|
|
# CRITICAL: enforce:privileged is required for Cilium.
|
|
# The default (enforce:baseline) blocks the capabilities Cilium needs
|
|
# (NET_ADMIN, NET_RAW, SYS_ADMIN). This was the root cause of the
|
|
# broken cluster. Do not change this back to baseline.
|
|
apiServer:
|
|
admissionControl:
|
|
- name: PodSecurity
|
|
configuration:
|
|
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
|
|
kind: PodSecurityConfiguration
|
|
defaults:
|
|
enforce: "privileged"
|
|
enforce-version: "latest"
|
|
audit: "restricted"
|
|
audit-version: "latest"
|
|
warn: "restricted"
|
|
warn-version: "latest"
|
|
exemptions:
|
|
usernames: []
|
|
runtimeClasses: []
|
|
namespaces:
|
|
- argocd
|
|
- cert-manager
|
|
- ingress-nginx
|
|
- external-secrets
|
|
|
|
- |-
|
|
machine:
|
|
time:
|
|
servers:
|
|
- 10.1.71.21 # sundial — local NTP
|
|
|
|
# Sysctls required for Cilium eBPF on Talos
|
|
# bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs
|
|
# unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers
|
|
# perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability
|
|
sysctls:
|
|
net.core.bpf_jit_harden: "0"
|
|
kernel.unprivileged_bpf_disabled: "0"
|
|
kernel.perf_event_paranoid: "1"
|
|
|
|
# DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud
|
|
# to monorail and handles external resolution via DoH
|
|
network:
|
|
nameservers:
|
|
- 10.1.71.1
|
|
extraHostEntries: []
|
|
|
|
# Talos manages kubelet — these flags are additive
|
|
kubelet:
|
|
extraArgs:
|
|
rotate-server-certificates: true
|
|
|
|
# Feature gates — enable Gateway API support for Cilium's secondary ingress
|
|
features:
|
|
kubePrism:
|
|
enabled: true
|
|
port: 7445
|
|
|
|
# ─── Control plane patches ───────────────────────────────────────────────────
|
|
controlPlane:
|
|
schematic:
|
|
customization:
|
|
systemExtensions:
|
|
officialExtensions:
|
|
- siderolabs/qemu-guest-agent
|
|
|
|
patches:
|
|
- |-
|
|
cluster:
|
|
etcd:
|
|
advertisedSubnets:
|
|
- 10.1.71.0/24
|
|
# Allow control plane nodes to schedule workloads (3-node CP on small cluster)
|
|
scheduler:
|
|
config:
|
|
apiVersion: kubescheduler.config.k8s.io/v1
|
|
kind: KubeSchedulerConfiguration
|
|
profiles:
|
|
- schedulerName: default-scheduler
|
|
|
|
- |-
|
|
machine:
|
|
network:
|
|
# VIP — floats across all three control plane nodes
|
|
# Talos handles VIP natively; no keepalived needed
|
|
interfaces:
|
|
- interface: ens18
|
|
vip:
|
|
ip: 10.1.71.65
|
|
|
|
# ─── Worker patches ──────────────────────────────────────────────────────────
|
|
worker:
|
|
schematic:
|
|
customization:
|
|
systemExtensions:
|
|
officialExtensions:
|
|
- siderolabs/qemu-guest-agent
|
|
- siderolabs/util-linux-tools
|
|
- siderolabs/iscsi-tools
|
|
|
|
patches:
|
|
- |-
|
|
machine:
|
|
# Load required kernel modules for iSCSI and multipath
|
|
kernel:
|
|
modules:
|
|
- name: iscsi_tcp
|
|
- name: dm_multipath
|
|
- name: dm_round_robin
|
|
|
|
# CRITICAL: Explicitly set nodeIP to primary network to avoid dual-NIC issues
|
|
# Workers have ens18 (10.1.71.x) for K8s traffic and ens19 (10.1.75.x) for iSCSI
|
|
kubelet:
|
|
nodeIP:
|
|
validSubnets:
|
|
- 10.1.71.0/24
|
|
|
|
extraMounts:
|
|
# Only mount /var/lib/iscsi (NOT /etc/iscsi)
|
|
# The iscsi-tools extension manages /etc/iscsi automatically
|
|
# /var/lib/iscsi contains iSCSI session and node data that must persist
|
|
- destination: /var/lib/iscsi
|
|
type: bind
|
|
source: /var/lib/iscsi
|
|
options:
|
|
- bind
|
|
- rshared
|
|
- rw
|
|
|
|
# ARP tuning for dual-NIC setup
|
|
sysctls:
|
|
net.ipv4.conf.all.arp_announce: "2"
|
|
net.ipv4.conf.all.arp_ignore: "1"
|
|
|
|
- |-
|
|
apiVersion: v1alpha1
|
|
kind: ExtensionServiceConfig
|
|
name: multipath-tools
|
|
configFiles:
|
|
- content: |
|
|
# Your multipath.conf content here
|
|
defaults {
|
|
user_friendly_names yes
|
|
}
|
|
mountPath: /etc/multipath.conf
|
|
environment:
|
|
- ARGS=-f /etc/multipath.conf
|
|
# Note: ExtensionServices run with host access by design,
|
|
# effectively privileged for system tasks.
|
|
|
|
|
|
# ─── Nodes ───────────────────────────────────────────────────────────────────
|
|
nodes:
|
|
# ── Control plane ──────────────────────────────────────────────────────────
|
|
- hostname: space-mountain
|
|
ipAddress: 10.1.71.66
|
|
controlPlane: true
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.66/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
vip:
|
|
ip: 10.1.71.65
|
|
|
|
- hostname: big-thunder-mountain
|
|
ipAddress: 10.1.71.67
|
|
controlPlane: true
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.67/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
vip:
|
|
ip: 10.1.71.65
|
|
|
|
- hostname: splash-mountain
|
|
ipAddress: 10.1.71.68
|
|
controlPlane: true
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.68/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
vip:
|
|
ip: 10.1.71.65
|
|
|
|
# ── Workers ────────────────────────────────────────────────────────────────
|
|
- hostname: jungle-cruise
|
|
ipAddress: 10.1.71.69
|
|
controlPlane: false
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.69/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
- interface: ens19 # iSCSI storage network
|
|
addresses:
|
|
- 10.1.75.69/24
|
|
dhcp: false
|
|
|
|
- hostname: haunted-mansion
|
|
ipAddress: 10.1.71.70
|
|
controlPlane: false
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.70/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
- interface: ens19 # iSCSI storage network
|
|
addresses:
|
|
- 10.1.75.70/24
|
|
dhcp: false
|
|
|
|
- hostname: peter-pans-flight
|
|
ipAddress: 10.1.71.71
|
|
controlPlane: false
|
|
installDisk: /dev/sda
|
|
networkInterfaces:
|
|
- interface: ens18
|
|
addresses:
|
|
- 10.1.71.71/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: 10.1.71.1
|
|
dhcp: false
|
|
- interface: ens19 # iSCSI storage network
|
|
addresses:
|
|
- 10.1.75.71/24
|
|
dhcp: false
|