theshire/kubernetes/bootstrap/talos/talconfig.yaml

295 lines
7.1 KiB
YAML

---
# yaml-language-server: $schema=https://ks.hsn.dev/talconfig.json
clusterName: theshire
talosVersion: v1.7.6
kubernetesVersion: 1.30.2
endpoint: "https://10.1.1.57:6444"
additionalApiServerCertSans:
- 10.1.1.57
additionalMachineCertSans:
- 10.1.1.57
nodes:
- hostname: bilbo
disableSearchDomain: true
ipAddress: 10.1.1.62
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: frodo
disableSearchDomain: true
ipAddress: 10.1.1.63
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: sam
disableSearchDomain: true
ipAddress: 10.1.1.64
controlPlane: true
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: pippin
disableSearchDomain: true
ipAddress: 10.1.1.65
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: merry
disableSearchDomain: true
ipAddress: 10.1.1.66
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: rosie
disableSearchDomain: true
ipAddress: 10.1.1.67
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/
networkInterfaces:
- interface: eno1
dhcp: true
- hostname: gandalf-01
disableSearchDomain: true
ipAddress: 10.1.1.68
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host6/target6:0:0/6:0:0:1/
networkInterfaces:
- interface: enp5s0
dhcp: true
- hostname: shadowfax-01
disableSearchDomain: true
ipAddress: 10.1.1.69
controlPlane: false
installDiskSelector:
busPath: /pci0000:00/0000:00:01.1/0000:02:00.0/virtio6/host0/target0:0:0/0:0:0:1/
networkInterfaces:
- interface: enp5s0
dhcp: true
patches:
- |-
machine:
sysctls:
net.core.bpf_jit_harden: 1
kernelModules:
- name: nvidia
- name: nvidia_uvm
- name: nvidia_drm
- name: nvidia_modeset
schematic:
customization:
systemExtensions:
officialExtensions:
- siderolabs/amd-ucode
- siderolabs/nonfree-kmod-nvidia
- siderolabs/nvidia-container-toolkit
worker:
schematic:
customization:
extraKernelArgs:
- net.ifnames=1
systemExtensions:
officialExtensions:
- siderolabs/intel-ucode
- siderolabs/i915-ucode
patches:
# hugepages
- &hugepages |-
machine:
sysctls:
vm.nr_hugepages: "1024"
# Kubelet local mount
- &kubelet_extra_mounts |-
machine:
kubelet:
extraMounts:
- destination: /var/openebs/local
type: bind
source: /var/openebs/local
options:
- bind
- rshared
- rw
# Configure containerd
- &containerd |-
machine:
files:
- op: create
path: /etc/cri/conf.d/20-customization.part
content: |
[plugins]
[plugins."io.containerd.grpc.v1.cri"]
enable_unprivileged_ports = true
enable_unprivileged_icmp = true
[plugins."io.containerd.grpc.v1.cri".containerd]
discard_unpacked_layers = false
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
discard_unpacked_layers = false
# Kubelet configuration
- &kubeletConf |-
machine:
kubelet:
defaultRuntimeSeccompProfileEnabled: true
extraArgs:
rotate-server-certificates: "true"
extraConfig:
maxPods: 150
nodeIP:
validSubnets:
- 10.1.1.0/24
- &sysctls |-
machine:
sysctls:
fs.inotify.max_queued_events: "65536"
fs.inotify.max_user_instances: "8192"
fs.inotify.max_user_watches: "524288"
net.core.rmem_max: "2500000"
net.core.wmem_max: "2500000"
- &nfsMountOptions |-
machine:
files:
- op: overwrite
path: /etc/nfsmount.conf
permissions: 0o644
content: |
[ NFSMount_Global_Options ]
nfsvers=4.1
hard=True
noatime=True
nodiratime=True
rsize=131072
wsize=131072
nconnect=8
- &hostDNS |-
machine:
features:
hostDNS:
enabled: true
resolveMemberNames: true
forwardKubeDNSToHost: false
- &searchDomain |-
machine:
network:
disableSearchDomain: true
- &nameservers |-
machine:
network:
nameservers:
- 10.1.1.1
controlPlane:
schematic:
customization:
extraKernelArgs:
- net.ifnames=1
systemExtensions:
officialExtensions:
- siderolabs/intel-ucode
- siderolabs/i915-ucode
patches:
# hugepages
- *hugepages
# Kubelet local mount
- *kubelet_extra_mounts
# Disable search domain everywhere
- *searchDomain
# Force nameserver
- *nameservers
# Configure NTP
- |-
machine:
time:
disabled: false
servers:
- time.cloudflare.com
# hostDNS configuration
- *hostDNS
# coreDNS configuration
- |-
cluster:
coreDNS:
disabled: true
# Cluster configuration
- |-
cluster:
allowSchedulingOnMasters: true
proxy:
disabled: true
network:
cni:
name: none
controllerManager:
extraArgs:
bind-address: 0.0.0.0
etcd:
extraArgs:
listen-metrics-urls: http://0.0.0.0:2381
scheduler:
extraArgs:
bind-address: 0.0.0.0
# ETCD configuration
- |-
cluster:
etcd:
advertisedSubnets:
- 10.1.1.0/24
# Configure containerd
- *containerd
# Disable default API server admission plugins.
- |-
- op: remove
path: /cluster/apiServer/admissionControl
# Enable K8s Talos API Access
- |-
machine:
features:
kubernetesTalosAPIAccess:
enabled: true
allowedRoles:
- os:admin
allowedKubernetesNamespaces:
- system-upgrade
# Kubelet configuration
- *kubeletConf
# Custom sysctls
- *sysctls
# Configure nfs mount options
- *nfsMountOptions