theshire/kubernetes/bootstrap/talos/talconfig.yaml
2024-07-23 23:48:58 -05:00

190 lines
4.5 KiB
YAML

---
# yaml-language-server: $schema=https://ks.hsn.dev/talhelper-schema.json
clusterName: homelab
talosVersion: v1.8.0-alpha.1
kubernetesVersion: 1.30.2
endpoint: "https://10.1.1.57:6443"
additionalApiServerCertSans:
- 10.1.1.57
additionalMachineCertSans:
- 10.1.1.57
nodes:
- hostname: shadowfax
disableSearchDomain: true
ipAddress: 10.1.1.61
controlPlane: true
installDiskSelector:
busPath: /pci0000:20/0000:20:01.2/0000:2c:00.0/nvme/nvme4/nvme4n1
machineDisks:
- device: /dev/disk/by-id/nvme-SOLIDIGM_SSDPFKNU020TZ_PHEH3142017H2P0C
partitions:
- mountpoint: /var/mnt/nvme1
networkInterfaces:
- interface: enp37s0f1
dhcp: true
- interface: enp37s0f0
dhcp: false
kernelModules:
- name: nvidia
- name: nvidia_uvm
- name: nvidia_drm
- name: nvidia_modeset
schematic:
customization:
systemExtensions:
officialExtensions:
- siderolabs/amd-ucode
- siderolabs/nonfree-kmod-nvidia
- siderolabs/nvidia-container-toolkit
# Need talos 1.8 for nvidia and zfs to coexist
# https://github.com/siderolabs/extensions/issues/380
- siderolabs/zfs
patches:
- |-
machine:
sysctls:
net.core.bpf_jit_harden: 1
vm.nr_hugepages: "1024"
- &kubelet_extra_mounts |-
machine:
kubelet:
extraMounts:
- destination: /var/mnt/nvme1
type: bind
source: /var/mnt/nvme1
options:
- rbind
- rshared
- rw
controlPlane:
patches:
# Disable search domain everywhere
- |-
machine:
network:
disableSearchDomain: true
# Force nameserver
- |-
machine:
network:
nameservers:
- 10.1.1.1
# Configure NTP
- |-
machine:
time:
disabled: false
servers:
- 10.1.1.1
# Enable KubePrism
- |-
machine:
features:
kubePrism:
enabled: true
port: 7445
# Cluster configuration
- |-
cluster:
allowSchedulingOnMasters: true
proxy:
disabled: true
network:
cni:
name: none
controllerManager:
extraArgs:
bind-address: 0.0.0.0
etcd:
extraArgs:
listen-metrics-urls: http://0.0.0.0:2381
scheduler:
extraArgs:
bind-address: 0.0.0.0
# ETCD configuration
- |-
cluster:
etcd:
advertisedSubnets:
- 10.1.1.0/24
# Disable default API server admission plugins.
- |-
- op: remove
path: /cluster/apiServer/admissionControl
# Enable K8s Talos API Access
- |-
machine:
features:
kubernetesTalosAPIAccess:
enabled: true
allowedRoles:
- os:admin
allowedKubernetesNamespaces:
- system-upgrade
# Kubelet configuration
- |-
machine:
kubelet:
defaultRuntimeSeccompProfileEnabled: true
extraArgs:
rotate-server-certificates: "true"
extraConfig:
maxPods: 150
nodeIP:
validSubnets:
- 10.1.1.0/24
extraMounts:
- destination: /var/openebs/keys
type: bind
source: /var/openebs/keys
options:
- bind
- rshared
- rw
- destination: /var/openebs/local
type: bind
source: /var/openebs/local
options:
- bind
- rshared
- rw
# Custom sysctls
- |-
machine:
sysctls:
fs.inotify.max_queued_events: "65536"
fs.inotify.max_user_instances: "8192"
fs.inotify.max_user_watches: "524288"
net.core.rmem_max: "2500000"
net.core.wmem_max: "2500000"
# Configure nfs mount options
- |
machine:
files:
- op: overwrite
path: /etc/nfsmount.conf
permissions: 0o644
content: |
[ NFSMount_Global_Options ]
nfsvers=4.1
hard=True
noatime=True
nodiratime=True
rsize=131072
wsize=131072
nconnect=8