kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: v1.12.3
+      version: v1.13.1
       sourceRef:
         kind: HelmRepository
         name: jetstack

kubernetes/apps/cert-manager/cert-manager/issuers/helmrelease.yaml

@@ -10,7 +10,7 @@ spec:
   chart:
     spec:
       chart: cert-manager-webhook-dnsimple
-      version: 0.0.7
+      version: 0.0.8
       interval: 30m
       sourceRef:
         kind: HelmRepository
@@ -33,3 +33,4 @@ spec:
           secretKeyRef:
             name: dnsimple-api-token
             key: letsencrypt-email
+    containerPort: 8443

kubernetes/apps/kube-system/cilium/app/helmrelease.yaml

@@ -0,0 +1,60 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cilium
+      version: 1.14.2
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    cluster:
+      name: valinor
+      id: 1
+    ipam:
+      mode: kubernetes
+    kubeProxyReplacement: true
+    securityContext:
+      capabilities:
+        ciliumAgent:
+          - CHOWN
+          - KILL
+          - NET_ADMIN
+          - NET_RAW
+          - IPC_LOCK
+          - SYS_ADMIN
+          - SYS_RESOURCE
+          - DAC_OVERRIDE
+          - FOWNER
+          - SETGID
+          - SETUID
+        cleanCiliumState:
+          - NET_ADMIN
+          - SYS_ADMIN
+          - SYS_RESOURCE
+    cgroup:
+      autoMount:
+        enabled: false
+      hostRoot: /sys/fs/cgroup
+    # Talos Kubeprism
+    k8sServiceHost: localhost
+    k8sServicePort: 7445
+    rollOutCiliumPods: true

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -0,0 +1,17 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-cilium
+  namespace: flux-system
+spec:
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: "./kubernetes/apps/kube-system/cilium/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: valinor
+  wait: false

kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml

@@ -18,3 +18,8 @@ spec:
   values:
     metrics:
       enabled: true
+    args:
+      - --kubelet-insecure-tls
+      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+      - --kubelet-use-node-status-port
+      - --metric-resolution=15s

talos/clusterconfig/.gitignore

@@ -2,3 +2,6 @@ valinor-aule.hsn.dev.yaml
 valinor-eonwe.hsn.dev.yaml
 valinor-arlen.hsn.dev.yaml
 talosconfig
+valinor-vaire.hsn.dev.yaml
+valinor-nienna.hsn.dev.yaml
+valinor-orome.hsn.dev.yaml

talos/talconfig.yaml

@@ -63,6 +63,51 @@ nodes:
           - network: 10.2.0.0/16
             gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
             metric: 2048
+  - hostname: vaire.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.8
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
+  - hostname: nienna.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.9
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
+  - hostname: orome.hsn.dev
+    disableSearchDomain: true
+    ipAddress: 10.2.0.10
+    controlPlane: false
+    installDiskSelector:
+      busPath: /dev/sda
+    networkInterfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth1
+        dhcp: true
+        routes:
+          - network: 10.2.0.0/16
+            gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
+            metric: 2048
 
 controlPlane:
   patches: