homelab/talos/talhelper/talconfig.yaml

# ─── fastpass Talos Cluster Configuration ────────────────────────────────────
# cluster:     fastpass
# managed by:  talhelper on city-hall (10.1.71.38)
# repo:        talos/talhelper/ in rblundon/homelab on mad-tea-party
#
# Quickref:
#   talhelper genconfig                              # regenerate clusterconfig/
#   talhelper gencommand apply --extra-flags="--insecure" | bash
#   talhelper gencommand bootstrap | bash
# ─────────────────────────────────────────────────────────────────────────────

clusterName: fastpass
talosVersion: v1.13.2
kubernetesVersion: v1.32.3

# VIP floats across control plane nodes — all kubectl/talosctl traffic lands here
endpoint: https://10.1.71.65:6443

# ─── Cluster-wide patches ────────────────────────────────────────────────────
patches:
  - |-
    cluster:
      # CRITICAL: enforce:privileged is required for Cilium.
      # The default (enforce:baseline) blocks the capabilities Cilium needs
      # (NET_ADMIN, NET_RAW, SYS_ADMIN). This was the root cause of the
      # broken cluster. Do not change this back to baseline.
      apiServer:
        admissionControl:
          - name: PodSecurity
            configuration:
              apiVersion: pod-security.admission.config.k8s.io/v1alpha1
              kind: PodSecurityConfiguration
              defaults:
                enforce: "privileged"
                enforce-version: "latest"
                audit: "restricted"
                audit-version: "latest"
                warn: "restricted"
                warn-version: "latest"
              exemptions:
                usernames: []
                runtimeClasses: []
                namespaces:
                  - argocd
                  - cert-manager
                  - ingress-nginx
                  - external-secrets

  - |-
    machine:
      time:
        servers:
          - 10.1.71.21   # sundial — local NTP

      # Sysctls required for Cilium eBPF on Talos
      # bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs
      # unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers
      # perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability
      sysctls:
        net.core.bpf_jit_harden: "0"
        kernel.unprivileged_bpf_disabled: "0"
        kernel.perf_event_paranoid: "1"

      # DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud
      # to monorail and handles external resolution via DoH
      network:
        nameservers:
          - 10.1.71.1
        extraHostEntries: []

      # Talos manages kubelet — these flags are additive
      kubelet:
        extraArgs:
          rotate-server-certificates: true

      # Feature gates — enable Gateway API support for Cilium's secondary ingress
      features:
        kubePrism:
          enabled: true
          port: 7445

# ─── Control plane patches ───────────────────────────────────────────────────
controlPlane:
  schematic:
    customization:
      systemExtensions:
        officialExtensions:
          - siderolabs/qemu-guest-agent

  patches:
    - |-
      cluster:
        etcd:
          advertisedSubnets:
            - 10.1.71.0/24
        # Allow control plane nodes to schedule workloads (3-node CP on small cluster)
        scheduler:
          config:
            apiVersion: kubescheduler.config.k8s.io/v1
            kind: KubeSchedulerConfiguration
            profiles:
              - schedulerName: default-scheduler

    - |-
      machine:
        network:
          # VIP — floats across all three control plane nodes
          # Talos handles VIP natively; no keepalived needed
          interfaces:
            - interface: ens18
              vip:
                ip: 10.1.71.65

# ─── Worker patches ──────────────────────────────────────────────────────────
worker:
  schematic:
    customization:
      systemExtensions:
        officialExtensions:
          - siderolabs/qemu-guest-agent
          - siderolabs/util-linux-tools
          - siderolabs/iscsi-tools

  patches:
    - |-
      machine:
        kernel:
          modules:
            - name: iscsi_tcp
            - name: dm_multipath
            - name: dm_round_robin

        kubelet:
          extraMounts:
            # iSCSI initiator data directory
            - destination: /etc/iscsi
              type: bind
              source: /etc/iscsi
              options:
                - bind
                - rshared
            - destination: /var/lib/iscsi
              type: bind
              source: /var/lib/iscsi
              options:
                - bind
                - rshared

        sysctls:
          net.ipv4.conf.all.arp_announce: "2"
          net.ipv4.conf.all.arp_ignore: "1"
        
        files:
          - content: |
              defaults {
                  polling_interval 10
              }
              devices {
                  device {
                      vendor "PURE"
                      product "FlashArray"
                      path_selector "queue-length 0"
                      path_grouping_policy group_by_prio
                      prio alua
                      path_checker tur
                      fast_io_fail_tmo 10
                      user_friendly_names no
                      no_path_retry 0
                      hardware_handler "1 alua"
                      dev_loss_tmo 600
                      failback immediate
                  }
              }
            path: /etc/multipath.conf
            op: create

# ─── Nodes ───────────────────────────────────────────────────────────────────
nodes:
  # ── Control plane ──────────────────────────────────────────────────────────
  - hostname: space-mountain
    ipAddress: 10.1.71.66
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.66/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  - hostname: big-thunder-mountain
    ipAddress: 10.1.71.67
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.67/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  - hostname: splash-mountain
    ipAddress: 10.1.71.68
    controlPlane: true
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.68/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
        vip:
          ip: 10.1.71.65

  # ── Workers ────────────────────────────────────────────────────────────────
  - hostname: jungle-cruise
    ipAddress: 10.1.71.69
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.69/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
      - interface: ens19    # iSCSI storage network
        addresses:
          - 10.1.75.69/24
        dhcp: false

  - hostname: haunted-mansion
    ipAddress: 10.1.71.70
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.70/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
      - interface: ens19    # iSCSI storage network
        addresses:
          - 10.1.75.70/24
        dhcp: false

  - hostname: peter-pans-flight
    ipAddress: 10.1.71.71
    controlPlane: false
    installDisk: /dev/sda
    networkInterfaces:
      - interface: ens18
        addresses:
          - 10.1.71.71/24
        routes:
          - network: 0.0.0.0/0
            gateway: 10.1.71.1
        dhcp: false
      - interface: ens19    # iSCSI storage network
        addresses:
          - 10.1.75.71/24
        dhcp: false