theshire/kubernetes/bootstrap/talos/talconfig.yaml

---
# yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json
clusterName: theshire

talosVersion: v1.7.6
kubernetesVersion: 1.30.2
endpoint: "https://10.1.1.57:6444"

additionalApiServerCertSans:
  - 10.1.1.57

additionalMachineCertSans:
  - 10.1.1.57

nodes:
  - hostname: bilbo
    disableSearchDomain: true
    ipAddress: 10.1.1.62
    controlPlane: true
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"

  - hostname: frodo
    disableSearchDomain: true
    ipAddress: 10.1.1.63
    controlPlane: true
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"

  - hostname: sam
    disableSearchDomain: true
    ipAddress: 10.1.1.64
    controlPlane: true
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"

  - hostname: pippin
    disableSearchDomain: true
    ipAddress: 10.1.1.65
    controlPlane: false
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"
      - &kubelet_extra_mounts |-
        machine:
          kubelet:
            extraMounts:
              - destination: /var/openebs/local
                type: bind
                source: /var/openebs/local
                options:
                  - bind
                  - rshared
                  - rw

  - hostname: merry
    disableSearchDomain: true
    ipAddress: 10.1.1.66
    controlPlane: false
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"
      - *kubelet_extra_mounts

  - hostname: rosie
    disableSearchDomain: true
    ipAddress: 10.1.1.67
    controlPlane: false
    installDiskSelector:
      busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
    networkInterfaces:
      - interface: eno1
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"
      - *kubelet_extra_mounts
  - hostname: gandalf-01
    disableSearchDomain: true
    ipAddress: 10.1.1.68
    controlPlane: false
    installDiskSelector:
      busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host6/target6:0:0/6:0:0:1/
    networkInterfaces:
      - interface: enp5s0
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            vm.nr_hugepages: "1024"
      - *kubelet_extra_mounts

  - hostname: shadowfax-01
    disableSearchDomain: true
    ipAddress: 10.1.1.69
    controlPlane: false
    installDiskSelector:
      busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host0/target0:0:0/0:0:0:1/
    networkInterfaces:
      - interface: enp5s0
        dhcp: true
    patches:
      - |-
        machine:
          sysctls:
            net.core.bpf_jit_harden: 1
            vm.nr_hugepages: "1024"
      - *kubelet_extra_mounts

    kernelModules:
      - name: nvidia
      - name: nvidia_uvm
      - name: nvidia_drm
      - name: nvidia_modeset
    schematic:
      customization:
        systemExtensions:
          officialExtensions:
            - siderolabs/amd-ucode
            - siderolabs/nonfree-kmod-nvidia
            - siderolabs/nvidia-container-toolkit

worker:
  schematic:
    customization:
      extraKernelArgs:
        - net.ifnames=1
      systemExtensions:
        officialExtensions:
          - siderolabs/intel-ucode
          - siderolabs/i915-ucode
controlPlane:
  schematic:
    customization:
      extraKernelArgs:
        - net.ifnames=1
      systemExtensions:
        officialExtensions:
          - siderolabs/intel-ucode
          - siderolabs/i915-ucode
  patches:
    # Disable search domain everywhere
    - |-
      machine:
        network:
          disableSearchDomain: true

    # Force nameserver
    - |-
      machine:
        network:
          nameservers:
            - 10.1.1.1

    # Configure NTP
    - |-
      machine:
        time:
          disabled: false
          servers:
            - time.cloudflare.com

    # Enable KubePrism
    - |-
      machine:
        features:
          kubePrism:
            enabled: true
            port: 7445

    # hostDNS configuration
    - |-
      machine:
        features:
          hostDNS:
            enabled: true
            resolveMemberNames: true
            forwardKubeDNSToHost: false

    # coreDNS configuration
    - |-
      cluster:
        coreDNS:
          disabled: true

    # Cluster configuration
    - |-
      cluster:
        allowSchedulingOnMasters: true
        proxy:
          disabled: true
        network:
          cni:
            name: none
        controllerManager:
          extraArgs:
            bind-address: 0.0.0.0
        etcd:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
        scheduler:
          extraArgs:
            bind-address: 0.0.0.0

    # ETCD configuration
    - |-
      cluster:
        etcd:
          advertisedSubnets:
            - 10.1.1.0/24

    # Configure containerd
    - |-
      machine:
        files:
          - op: create
            path: /etc/cri/conf.d/20-customization.part
            content: |
              [plugins]
                [plugins."io.containerd.grpc.v1.cri"]
                  enable_unprivileged_ports = true
                  enable_unprivileged_icmp = true
              [plugins."io.containerd.grpc.v1.cri".containerd]
                discard_unpacked_layers = false
              [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
                discard_unpacked_layers = false

    # Disable default API server admission plugins.
    - |-
      - op: remove
        path: /cluster/apiServer/admissionControl

    # Enable K8s Talos API Access
    - |-
      machine:
        features:
          kubernetesTalosAPIAccess:
            enabled: true
            allowedRoles:
              - os:admin
            allowedKubernetesNamespaces:
              - system-upgrade

    # Kubelet configuration
    - |-
      machine:
        kubelet:
          defaultRuntimeSeccompProfileEnabled: true
          extraArgs:
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
          nodeIP:
            validSubnets:
                - 10.1.1.0/24

    # Custom sysctls
    - |-
      machine:
        sysctls:
          fs.inotify.max_queued_events: "65536"
          fs.inotify.max_user_instances: "8192"
          fs.inotify.max_user_watches: "524288"
          net.core.rmem_max: "2500000"
          net.core.wmem_max: "2500000"

    # Configure nfs mount options
    - |-
      machine:
        files:
          - op: overwrite
            path: /etc/nfsmount.conf
            permissions: 0o644
            content: |
              [ NFSMount_Global_Options ]
              nfsvers=4.1
              hard=True
              noatime=True
              nodiratime=True
              rsize=131072
              wsize=131072
              nconnect=8