theshire/kubernetes/bootstrap/talos/talconfig.yaml

358 lines
8.7 KiB
YAML
Raw Normal View History

2024-05-06 08:53:47 -05:00
---
# yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json
clusterName: theshire
2024-05-06 08:53:47 -05:00
2024-10-11 18:12:51 -05:00
talosVersion: v1.8.1
2024-07-04 11:33:24 -05:00
kubernetesVersion: 1.30.2
endpoint: "https://10.1.1.57:6444"
2024-05-06 08:53:47 -05:00
additionalApiServerCertSans:
- 10.1.1.57
2024-05-06 08:53:47 -05:00
additionalMachineCertSans:
- 10.1.1.57
2024-05-06 08:53:47 -05:00
nodes:
- hostname: bilbo
2024-05-06 08:53:47 -05:00
disableSearchDomain: true
ipAddress: 10.1.1.62
2024-05-06 08:53:47 -05:00
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
2024-05-06 08:53:47 -05:00
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: b8:ca:3a:8d:cb:c1
driver: e1000e
vlans:
- &vlan-iot
vlanId: 30
mtu: 1500
dhcp: true
dhcpOptions:
routeMetric: 4096
2024-05-07 19:05:31 -05:00
- hostname: frodo
disableSearchDomain: true
ipAddress: 10.1.1.63
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: b8:ca:3a:73:09:ab
driver: e1000e
vlans:
- *vlan-iot
- hostname: sam
disableSearchDomain: true
ipAddress: 10.1.1.64
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: 90:b1:1c:a5:df:67
driver: e1000e
vlans:
- *vlan-iot
- hostname: pippin
disableSearchDomain: true
ipAddress: 10.1.1.65
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: b8:ca:3a:af:b2:e6
driver: e1000e
vlans:
- *vlan-iot
2024-08-08 12:50:06 -05:00
- hostname: merry
disableSearchDomain: true
ipAddress: 10.1.1.66
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: b8:ca:3a:af:fa:62
driver: e1000e
vlans:
- *vlan-iot
- hostname: rosie
disableSearchDomain: true
ipAddress: 10.1.1.67
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: 90:b1:1c:96:e1:7b
driver: e1000e
vlans:
- *vlan-iot
- hostname: gandalf-01
disableSearchDomain: true
ipAddress: 10.1.1.68
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host6/target6:0:0/6:0:0:1/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: 00:25:90:85:51:c9
driver: igb
vlans:
- *vlan-iot
- hostname: shadowfax-01
disableSearchDomain: true
ipAddress: 10.1.1.69
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host0/target0:0:0/0:0:0:1/
networkInterfaces:
2024-10-14 11:10:58 -05:00
- interface: bond0
dhcp: true
2024-10-14 11:10:58 -05:00
bond:
mode: active-backup
deviceSelectors:
- hardwareAddr: 04:42:1a:ef:35:74
driver: ixgbe
vlans:
- *vlan-iot
patches:
- |-
machine:
sysctls:
net.core.bpf_jit_harden: 1
kernelModules:
- name: nvidia
- name: nvidia_uvm
- name: nvidia_drm
- name: nvidia_modeset
schematic:
customization:
systemExtensions:
officialExtensions:
- siderolabs/amd-ucode
2024-10-11 07:30:38 -05:00
- siderolabs/nonfree-kmod-nvidia-production
- siderolabs/nvidia-container-toolkit-production
worker:
schematic:
customization:
extraKernelArgs:
- net.ifnames=1
systemExtensions:
officialExtensions:
- siderolabs/intel-ucode
- siderolabs/i915-ucode
2024-09-05 03:18:26 -05:00
patches:
# hugepages
- &hugepages |-
machine:
sysctls:
vm.nr_hugepages: "1024"
# Kubelet local mount
- &kubelet_extra_mounts |-
machine:
kubelet:
extraMounts:
- destination: /var/openebs/local
type: bind
source: /var/openebs/local
options:
- bind
- rshared
- rw
2024-09-05 03:18:26 -05:00
# Configure containerd
- &containerd |-
machine:
files:
- op: create
path: /etc/cri/conf.d/20-customization.part
content: |
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
enable_unprivileged_ports = true
enable_unprivileged_icmp = true
[plugins."io.containerd.grpc.v1.cri".containerd]
discard_unpacked_layers = false
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
discard_unpacked_layers = false
# Kubelet configuration
- &kubeletConf |-
machine:
kubelet:
defaultRuntimeSeccompProfileEnabled: true
extraArgs:
rotate-server-certificates: "true"
extraConfig:
maxPods: 150
nodeIP:
validSubnets:
- 10.1.1.0/24
- &sysctls |-
machine:
sysctls:
fs.inotify.max_queued_events: "65536"
fs.inotify.max_user_instances: "8192"
fs.inotify.max_user_watches: "524288"
net.core.rmem_max: "2500000"
net.core.wmem_max: "2500000"
- &nfsMountOptions |-
machine:
files:
- op: overwrite
path: /etc/nfsmount.conf
permissions: 0o644
content: |
[ NFSMount_Global_Options ]
nfsvers=4.1
hard=True
noatime=True
nodiratime=True
rsize=131072
wsize=131072
nconnect=8
- &hostDNS |-
machine:
features:
hostDNS:
enabled: true
resolveMemberNames: true
forwardKubeDNSToHost: false
- &searchDomain |-
machine:
network:
disableSearchDomain: true
- &nameservers |-
machine:
network:
nameservers:
- 10.1.1.1
2024-05-06 08:53:47 -05:00
controlPlane:
schematic:
customization:
extraKernelArgs:
- net.ifnames=1
systemExtensions:
officialExtensions:
- siderolabs/intel-ucode
- siderolabs/i915-ucode
2024-05-06 08:53:47 -05:00
patches:
# hugepages
- *hugepages
# Kubelet local mount
- *kubelet_extra_mounts
# Disable search domain everywhere
2024-09-05 03:18:26 -05:00
- *searchDomain
2024-05-06 08:53:47 -05:00
# Force nameserver
2024-09-05 03:18:26 -05:00
- *nameservers
2024-05-06 08:53:47 -05:00
# Configure NTP
- |-
machine:
time:
disabled: false
servers:
2024-09-01 21:16:41 -05:00
- time.cloudflare.com
2024-05-06 08:53:47 -05:00
# hostDNS configuration
2024-09-05 03:18:26 -05:00
- *hostDNS
# coreDNS configuration
- |-
cluster:
coreDNS:
disabled: true
2024-05-06 08:53:47 -05:00
# Cluster configuration
- |-
cluster:
allowSchedulingOnMasters: true
proxy:
disabled: true
network:
cni:
name: none
2024-05-14 08:56:38 -05:00
controllerManager:
extraArgs:
bind-address: 0.0.0.0
etcd:
extraArgs:
listen-metrics-urls: http://0.0.0.0:2381
scheduler:
extraArgs:
bind-address: 0.0.0.0
2024-05-06 08:53:47 -05:00
# ETCD configuration
- |-
cluster:
etcd:
advertisedSubnets:
- 10.1.1.0/24
# Configure containerd
2024-09-05 03:18:26 -05:00
- *containerd
2024-05-06 08:53:47 -05:00
# Disable default API server admission plugins.
- |-
- op: remove
path: /cluster/apiServer/admissionControl
# Enable K8s Talos API Access
- |-
machine:
features:
kubernetesTalosAPIAccess:
enabled: true
allowedRoles:
- os:admin
allowedKubernetesNamespaces:
- system-upgrade
# Kubelet configuration
2024-09-05 03:18:26 -05:00
- *kubeletConf
2024-05-06 08:53:47 -05:00
# Custom sysctls
2024-09-05 03:18:26 -05:00
- *sysctls
# Configure nfs mount options
2024-09-05 03:18:26 -05:00
- *nfsMountOptions