---
clusterName: valinor

talosVersion: v1.5.5
kubernetesVersion: 1.28.4
endpoint: "https://${clusterEndpointIP}:6443"

cniConfig:
  name: none

additionalApiServerCertSans:
  - ${clusterEndpointIP}

additionalMachineCertSans:
  - ${clusterEndpointIP}

nodes:
  # cloud CAX21 Arm64
  - hostname: arlen
    disableSearchDomain: true
    ipAddress: ${arlenIP}
    controlPlane: true
    installDiskSelector:
      busPath: /dev/sda
    networkInterfaces:
      - interface: eth0
        dhcp: true
      - interface: eth1
        dhcp: true
        routes:
          - network: 10.2.0.0/16
            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
            metric: 2048
  # cloud CAX21 Arm64
  - hostname: eonwe
    disableSearchDomain: true
    ipAddress: ${eonweIP}
    controlPlane: true
    installDiskSelector:
      busPath: /dev/sda
    networkInterfaces:
      - interface: eth0
        dhcp: true
      - interface: eth1
        dhcp: true
        routes:
          - network: 10.2.0.0/16
            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
            metric: 2048
  # cloud CAX21 Arm64
  - hostname: aule
    disableSearchDomain: true
    ipAddress: ${auleIP}
    controlPlane: true
    installDiskSelector:
      busPath: /dev/sda
    networkInterfaces:
      - interface: eth0
        dhcp: true
      - interface: eth1
        dhcp: true
        routes:
          - network: 10.2.0.0/16
            gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).
            metric: 2048
  # Bare-metal AX41-Nvme - AMD Ryzen 5 3600 6-Core Processor (Zen2) - 64GB ECC RAM
  - hostname: nienna
    disableSearchDomain: true
    ipAddress: ${niennaIP}
    controlPlane: false
    # customization:
    #   extraKernelArgs:
    #     - net.ifnames=0
    #   systemExtensions:
    #     officialExtensions:
    #       - siderolabs/amd-ucode
    #       - siderolabs/qemu-guest-agent
    talosImageURL: harbor.hsn.dev/factory.talos.dev/installer/696bb48d9c48e567596f393a4ff9bfd26d4dda5d92c16beb580e96fa68d6324c
    # https://factory.talos.dev/image/696bb48d9c48e567596f393a4ff9bfd26d4dda5d92c16beb580e96fa68d6324c/v1.5.5/metal-amd64.iso
    # no guest agent in the raw.xz image
    # https://factory.talos.dev/image/6c789e7a3eec37617fd9d239a7f696ba48e75bc4780f5cb30bf8882686d79a22/v1.5.5/metal-amd64.raw.xz
    installDiskSelector:
      busPath: /pci0000:00/0000:00:0a.0/virtio2/
    networkInterfaces:
      - interface: eth0
        dhcp: true
      - interface: eth1
        dhcp: false
        vlans:
          - vlanId: 4010
            mtu: 1400
            addresses:
              - 10.2.1.2/24
            dhcp: false
            routes:
              - network: 10.2.0.0/16
                gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
                metric: 2048
  # VM on EX44 - Intel Gen 13 (Raptor Lake) - 64GB RAM
  - hostname: orome
    disableSearchDomain: true
    ipAddress: ${oromeIP}
    controlPlane: false
    # customization:
    #     extraKernelArgs:
    #         - net.ifnames=0
    #     systemExtensions:
    #         officialExtensions:
    #             - siderolabs/i915-ucode
    #             - siderolabs/intel-ucode
    #             - siderolabs/qemu-guest-agent
    talosImageURL: harbor.hsn.dev/factory.talos.dev/installer/f2f665587318c2d79e7b315cc333fff276ed59c8de831f16e28b4db107496ac2
    # https://factory.talos.dev/image/f2f665587318c2d79e7b315cc333fff276ed59c8de831f16e28b4db107496ac2/metal-amd64.iso
    installDiskSelector:
      busPath: /pci0000:00/0000:00:0a.0/virtio2/
    networkInterfaces:
      - interface: eth0
        dhcp: true
      - interface: eth1
        dhcp: false
        vlans:
          - vlanId: 4010
            mtu: 1400
            addresses:
              - 10.2.1.3/24
            dhcp: false
            routes:
              - network: 10.2.0.0/16
                gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
                metric: 2048
worker:
  patches:
    - |-
      cluster:
        externalCloudProvider:
          enabled: true
          manifests:
            - https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/latest/download/ccm.yaml
      machine:
        sysctls:
            fs.inotify.max_user_watches: "1048576"
            fs.inotify.max_user_instances: "8192"
        time:
          disabled: false
          servers:
            - ntp.hetzner.com
        kubelet:
          extraArgs:
            feature-gates: CronJobTimeZone=true,GracefulNodeShutdown=true,NewVolumeManagerReconstruction=false
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
          nodeIP:
            validSubnets:
                - 10.2.0.0/16
        registries:
          mirrors:
            docker.io:
              endpoints:
                - http://harbor.hsn.dev/v2/docker.io
              overridePath: true
            ghcr.io:
              endpoints:
                - http://harbor.hsn.dev/v2/ghcr.io
              overridePath: true
controlPlane:
  patches:
    - |-
      cluster:
        allowSchedulingOnMasters: true
        externalCloudProvider:
          enabled: true
          manifests:
            - https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/latest/download/ccm.yaml
        network:
          cni:
            name: none
        proxy:
          disabled: true
        etcd:
          advertisedSubnets:
            - 10.2.0.0/24

    - |-
      - op: remove
        path: /cluster/apiServer/admissionControl

    - |-
      machine:
        features:
          kubePrism:
            enabled: true
            port: 7445
        registries:
          mirrors:
            docker.io:
              endpoints:
                - http://harbor.hsn.dev/v2/docker.io
              overridePath: true
            ghcr.io:
              endpoints:
                - http://harbor.hsn.dev/v2/ghcr.io
              overridePath: true

        files:
          - op: create
            path: /etc/cri/conf.d/20-customization.part
            content: |
              [plugins]
                [plugins."io.containerd.grpc.v1.cri"]
                  enable_unprivileged_ports = true
                  enable_unprivileged_icmp = true
        kubelet:
          extraArgs:
            feature-gates: CronJobTimeZone=true,GracefulNodeShutdown=true,NewVolumeManagerReconstruction=false
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
          nodeIP:
            validSubnets:
                - 10.2.0.0/16
        sysctls:
          fs.inotify.max_user_watches: "1048576"
          fs.inotify.max_user_instances: "8192"
        time:
          disabled: false
          servers:
            - ntp.hetzner.com