kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: v1.12.3
+      version: v1.13.1
       sourceRef:
         kind: HelmRepository
         name: jetstack

kubernetes/apps/cert-manager/cert-manager/issuers/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager-webhook-dnsimple
-      version: 0.0.7
+      version: 0.0.8
       interval: 30m
       sourceRef:
         kind: HelmRepository
@@ -33,3 +33,4 @@ spec:
           secretKeyRef:
             name: dnsimple-api-token
             key: letsencrypt-email
+    containerPort: 8443

kubernetes/apps/kube-system/cilium/app/helmrelease.yaml

@@ -0,0 +1,60 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cilium
+      version: 1.14.2
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    cluster:
+      name: valinor
+      id: 1
+    ipam:
+      mode: kubernetes
+    kubeProxyReplacement: true
+    securityContext:
+      capabilities:
+        ciliumAgent:
+          - CHOWN
+          - KILL
+          - NET_ADMIN
+          - NET_RAW
+          - IPC_LOCK
+          - SYS_ADMIN
+          - SYS_RESOURCE
+          - DAC_OVERRIDE
+          - FOWNER
+          - SETGID
+          - SETUID
+        cleanCiliumState:
+          - NET_ADMIN
+          - SYS_ADMIN
+          - SYS_RESOURCE
+    cgroup:
+      autoMount:
+        enabled: false
+      hostRoot: /sys/fs/cgroup
+    # Talos Kubeprism
+    k8sServiceHost: localhost
+    k8sServicePort: 7445
+    rollOutCiliumPods: true

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -0,0 +1,17 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-cilium
+  namespace: flux-system
+spec:
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: "./kubernetes/apps/kube-system/cilium/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: valinor
+  wait: false

kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml

@@ -18,3 +18,8 @@ spec:
   values:
     metrics:
       enabled: true
+    args:
+      - --kubelet-insecure-tls
+      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+      - --kubelet-use-node-status-port
+      - --metric-resolution=15s

kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml

@@ -201,7 +201,7 @@ spec:
         enableAdminAPI: true
         walCompression: true
         thanos:
-          image: quay.io/thanos/thanos:v0.32.3
+          image: quay.io/thanos/thanos:v0.32.4
           objectStorageConfig:
             name: thanos-s3-secret
             key: objstore.yml

kubernetes/apps/monitoring/node-exporter/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: prometheus-node-exporter
-      version: 4.23.1
+      version: 4.23.2
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

kubernetes/apps/monitoring/thanos/app/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
   chart:
     spec:
       chart: thanos
-      version: 12.13.5
+      version: 12.13.6
       sourceRef:
         kind: HelmRepository
         name: bitnami
@@ -34,7 +34,7 @@ spec:
     image:
       registry: quay.io
       repository: thanos/thanos
-      tag: v0.32.3
+      tag: v0.32.4
     existingObjstoreSecret: thanos-s3-secret
     queryFrontend:
       enabled: true

requirements.txt

@@ -1,5 +1,5 @@
 ansible==8.4.0
-ansible-lint==6.20.0
+ansible-lint==6.20.2
 bcrypt==4.0.1
 jmespath==1.0.1
 netaddr==0.9.0

talos/clusterconfig/.gitignore

@@ -2,3 +2,6 @@ valinor-aule.hsn.dev.yaml
 valinor-eonwe.hsn.dev.yaml
 valinor-arlen.hsn.dev.yaml
 talosconfig
+valinor-vaire.hsn.dev.yaml
+valinor-nienna.hsn.dev.yaml
+valinor-orome.hsn.dev.yaml

talos/talconfig.yaml

@@ -63,6 +63,51 @@ nodes:
           - network: 10.2.0.0/16
             gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
             metric: 2048
+  - hostname: vaire.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.8
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
+  - hostname: nienna.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.9
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
+  - hostname: orome.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.10
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
 
 controlPlane:
   patches: