Split project

proxmox/talos/data_dns.tf

@@ -0,0 +1,17 @@
+data "dns_a_record_set" "cluster_api" {
+  host = local.cluster_fqdn
+}
+
+data "dns_aaaa_record_set" "cluster_api" {
+  host = local.cluster_fqdn
+}
+
+data "dns_a_record_set" "guests" {
+  for_each = toset([ for guest in var.vm_guests: guest.name ])
+  host = "${each.value}.${var.local_domain}"
+}
+
+data "dns_aaaa_record_set" "guests" {
+  for_each = toset([ for guest in var.vm_guests: guest.name ])
+  host = "${each.value}.${var.local_domain}"
+}

proxmox/talos/data_proxmox.tf

@@ -0,0 +1,6 @@
+data "proxmox_virtual_environment_nodes" "hvc01" {}
+
+data "proxmox_virtual_environment_node" "hvc01" {
+  for_each = toset(data.proxmox_virtual_environment_nodes.hvc01.names)
+  node_name = each.value
+}

proxmox/talos/data_talos.tf

@@ -0,0 +1,24 @@
+data "talos_image_factory_versions" "this" {
+  filters = {
+    stable_versions_only = true
+  }
+}
+
+data "talos_image_factory_urls" "this" {
+  talos_version = local.talos_version
+  schematic_id = talos_image_factory_schematic.this.id
+  platform = "nocloud"
+}
+
+data "talos_machine_configuration" "this" {
+  for_each = { for guest in var.vm_guests: guest.name => guest if contains(["controlplane", "worker"], guest.role) }
+  cluster_endpoint = local.cluster_endpoint
+  cluster_name = var.cluster_name
+  config_patches = local.machine_config_patches[each.key]
+  docs = false
+  examples = false
+  kubernetes_version = var.kubernetes_version
+  machine_secrets = talos_machine_secrets.this.machine_secrets
+  machine_type = each.value.role
+  talos_version = local.talos_version
+}

proxmox/talos/files/talos_image_schematic.yml

@@ -0,0 +1,16 @@
+customization:
+  systemExtensions:
+    officialExtensions:
+      - siderolabs/amd-ucode
+      - siderolabs/amdgpu
+      - siderolabs/i915
+      - siderolabs/intel-ucode
+      - siderolabs/lldpd
+      - siderolabs/nfs-utils
+      - siderolabs/nfsd
+      - siderolabs/nfsrahead
+      - siderolabs/nut-client
+      - siderolabs/nvme-cli
+      - siderolabs/qemu-guest-agent
+      - siderolabs/xe
+  bootloader: sd-boot

proxmox/talos/files/talos_kubespan_config.yml

@@ -0,0 +1,5 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/network/kubespanconfig
+
+apiVersion: v1alpha1
+kind: KubeSpanConfig
+enabled: false

proxmox/talos/locals.tf

@@ -0,0 +1,54 @@
+locals {
+  # Validate talos_version variable
+  talos_version = [ for version in data.talos_image_factory_versions.this.talos_versions : version if version == var.talos_version][0]
+  cluster_fqdn = "${var.cluster_name}.${var.local_domain}"
+  cluster_endpoint = "https://${local.cluster_fqdn}:${var.cluster_api_port}"
+  cluster_api_ipv4_address = data.dns_a_record_set.cluster_api.addrs[0]
+  cluster_api_ipv6_address = data.dns_aaaa_record_set.cluster_api.addrs[0]
+  machine_config_patches = { for guest in var.vm_guests: guest.name => [
+    templatefile("${path.root}/templates/talos_machine_config.yml.tftpl", {
+      hostname = guest.name
+      local_domain = var.local_domain
+      cluster_fqdn = local.cluster_fqdn
+      cluster_api_ipv4_address = local.cluster_api_ipv4_address
+      cluster_api_ipv6_address = local.cluster_api_ipv6_address
+      ipv4_address = data.dns_a_record_set.guests[guest.name].addrs[0]
+      ipv6_address = data.dns_aaaa_record_set.guests[guest.name].addrs[0]
+    }),
+    templatefile("${path.root}/templates/talos_cluster_config.yml.tftpl", {
+      cluster_name = var.cluster_name
+      cluster_fqdn = local.cluster_fqdn
+      cluster_endpoint = local.cluster_endpoint
+      cluster_api_port = var.cluster_api_port
+      cluster_api_ipv4_address = local.cluster_api_ipv4_address
+      cluster_api_ipv6_address = local.cluster_api_ipv6_address
+      ipv4_pod_cidr = var.ipv4_pod_cidr
+      ipv6_pod_cidr = var.ipv6_pod_cidr
+      ipv4_service_cidr = var.ipv4_service_cidr
+      ipv6_service_cidr = var.ipv6_service_cidr
+      discovery_service_endpoint = var.discovery_service_endpoint
+    }),    
+    templatefile("${path.root}/templates/talos_hostname_config.yml.tftpl", {
+      hostname = guest.name
+      local_domain = var.local_domain
+    }),
+    templatefile("${path.root}/templates/talos_link_config.yml.tftpl", {
+      ipv4_address = data.dns_a_record_set.guests[guest.name].addrs[0]
+      ipv6_address = data.dns_aaaa_record_set.guests[guest.name].addrs[0]
+      ipv4_subnet_mask = var.ipv4_subnet_mask
+      ipv4_gateway = var.ipv4_gateway
+      ipv6_gateway = var.ipv6_gateway
+    }),
+    templatefile("${path.root}/templates/talos_resolver_config.yml.tftpl", {
+      ipv4_nameservers = var.ipv4_nameservers
+      ipv6_nameservers = var.ipv6_nameservers
+      search_domains = var.search_domains
+    }),
+    templatefile("${path.root}/templates/talos_timesync_config.yml.tftpl", {
+      ipv4_ntp_servers = var.ipv4_ntp_servers
+      ipv6_ntp_servers = var.ipv6_ntp_servers
+    }),
+    file("${path.root}/files/talos_kubespan_config.yml")
+  ] if contains(["controlplane", "worker"], guest.role)}
+  machine_configs = { for guest in var.vm_guests: guest.name => nonsensitive(data.talos_machine_configuration.this[guest.name].machine_configuration) if contains(["controlplane", "worker"], guest.role) }
+}

proxmox/talos/outputs.tf

@@ -0,0 +1,16 @@
+# output "ch01" {
+#   description = "Container Host 01 VM details"
+#   value = {
+#     status = data.proxmox_vm.ch01.status
+#   }
+# }
+
+output "talos_schematic_id" {
+  value = talos_image_factory_schematic.this.id
+}
+
+output "debug" {
+  description = "For debugging resource or data key values"
+  value = "chane_me"
+  sensitive = false
+}

proxmox/talos/providers.tf

@@ -0,0 +1,29 @@
+provider "proxmox" {
+    endpoint  = "https://hvc01.balsillie.house:443/"
+    insecure  = false
+    # api_token = # Takes value from PROXMOX_VE_API_TOKEN env var
+    random_vm_ids = true
+    random_vm_id_start = 10000
+    random_vm_id_end = 99999
+    ssh {
+      username = "ladmin"
+      # SSH Private Key provided by env var PROXMOX_VE_SSH_PRIVATE_KEY
+      agent = false
+      node_address_source = "dns"
+      node {
+        name = "hv01"
+        address = "hv01.balsillie.house"
+        port = 22
+      }
+      node {
+        name = "hv02"
+        address = "hv02.balsillie.house"
+        port = 22
+      }
+    }
+}
+provider "talos" {}
+
+provider "dns" {}
+
+provider "http" {}

proxmox/talos/resources_proxmox.tf

@@ -0,0 +1,30 @@
+resource "proxmox_virtual_environment_file" "talos_iso" {
+  for_each = data.proxmox_virtual_environment_node.hvc01
+  content_type = "iso"
+  datastore_id = "local"
+  node_name = each.value.id
+  overwrite = false
+  source_file {
+    # checksum = 
+    file_name = "talos_${local.talos_version}.iso"
+    insecure = false
+    min_tls = "1.2"
+    path = data.talos_image_factory_urls.this.urls.iso_secureboot 
+  }
+  timeout_upload = 120
+  # upload_mode = # N/A, has no effect when content_type = iso
+}
+
+resource "proxmox_virtual_environment_file" "talos_cloud_init" {
+  for_each = { for guest in var.vm_guests: guest.name => guest if contains(["controlplane", "worker"], guest.role) }
+  content_type = "snippets"
+  datastore_id = "local"
+  node_name = each.value.host
+  overwrite = true
+  source_raw {
+    data = local.machine_configs[each.key]
+    file_name = "cloud_init_${each.key}.yml"
+  }
+  timeout_upload = 10
+  upload_mode = "stream"
+}

proxmox/talos/resources_talos.tf

@@ -0,0 +1,7 @@
+resource "talos_machine_secrets" "this" {
+  talos_version = local.talos_version
+}
+
+resource "talos_image_factory_schematic" "this" {
+  schematic = file("${path.root}/files/talos_image_schematic.yml")
+}

proxmox/talos/templates/talos_cluster_config.yml.tftpl

@@ -0,0 +1,42 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/v1alpha1/config#cluster
+
+cluster:
+  controlPlane:
+    endpoint: ${cluster_endpoint}
+    localAPIServerPort: ${cluster_api_port}
+  clusterName: ${cluster_name}  
+  network:
+    cni:
+      name: custom
+      urls: [] # FIX
+    dnsDomain: ${cluster_fqdn}
+    podSubnets:
+      - "${ipv4_pod_cidr}"
+      - "${ipv6_pod_cidr}"
+    serviceSubnets:
+      - "${ipv4_service_cidr}"
+      - "${ipv6_service_cidr}"
+  apiServer:
+    certSANs:
+      - "${cluster_fqdn}"
+      - "${cluster_api_ipv4_address}"
+      - "${cluster_api_ipv6_address}"
+  proxy:
+    disabled: true
+  discovery:
+    enabled: true
+    registries:
+      kubernetes:
+        disabled: true
+      service:
+        disabled: false
+        endpoint: ${discovery_service_endpoint}
+  coreDNS:
+    disabled: false
+  extraManifests: []
+  inlineManifests:
+    - name:
+      contents:
+  adminKubeconfig:
+    certLifetime: "87600h" # 10 years (24 hours * 365 * 10)
+  allowSchedulingOnControlPlanes: false

proxmox/talos/templates/talos_hostname_config.yml.tftpl

@@ -0,0 +1,6 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/network/hostnameconfig
+
+apiVersion: v1alpha1
+kind: HostnameConfig
+hostname: ${hostname}.${local_domain}
+auto: off

proxmox/talos/templates/talos_link_config.yml.tftpl

@@ -0,0 +1,15 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/network/linkconfig
+
+apiVersion: v1alpha1
+kind: LinkConfig
+name: enp0s1 # Default link position assigned by proxmox
+up: true
+mtu: 1500
+addresses:
+  - address: "${ipv4_address}/${ipv4_subnet_mask}"
+  - address: "${ipv6_address}/64"
+routes:
+  - destination: "0.0.0.0/0"
+    gateway: "${ipv4_gateway}"
+  - destination: "::/0"
+    gateway: "${ipv6_gateway}"

proxmox/talos/templates/talos_machine_config.yml.tftpl

@@ -0,0 +1,27 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/v1alpha1/config#machine
+
+machine:
+  certSANs:
+    - "${hostname}.${local_domain}"
+    - "${cluster_fqdn}"
+    - "${cluster_api_ipv4_address}"
+    - "${cluster_api_ipv6_address}"
+    - "${ipv4_address}"
+    - "${ipv6_address}"
+  kubelet:
+    defaultRuntimeSeccompProfileEnabled: true
+    disableManifestsDirectory: true
+  install:
+    disk: /dev/sda
+    wipe: true
+    grubUseUKICmdline: true
+    legacyBIOSSupport: false
+  features:
+    kubernetesTalosAPIAccess:
+      enabled: false
+    diskQuotaSupport: false
+    kubePrism:
+      enabled: false
+    hostDNS:
+      enabled: true
+      forwardKubeDNSToHost: false

proxmox/talos/templates/talos_resolver_config.yml.tftpl

@@ -0,0 +1,8 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/network/resolverconfig
+
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers: ${jsonencode(concat(ipv4_nameservers, ipv6_nameservers))}
+searchDomains:
+  disableDefault: true
+  domains: ${jsonencode(search_domains)}

proxmox/talos/templates/talos_timesync_config.yml.tftpl

@@ -0,0 +1,8 @@
+# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/network/timesyncconfig
+
+apiVersion: v1alpha1
+kind: TimeSyncConfig
+enabled: true
+# bootTimeout: "infinity"
+ntp:
+  servers: ${jsonencode(concat(ipv4_ntp_servers, ipv6_ntp_servers))}

proxmox/talos/terraform.tf

@@ -0,0 +1,27 @@
+terraform {
+  required_version = ">= 1.15.9"
+
+  required_providers {
+    proxmox = {
+      source = "registry.terraform.io/bpg/proxmox"
+      version = ">= 0.111.1"
+    }
+    talos = {
+      source = "registry.terraform.io/siderolabs/talos"
+      version = "0.11.0"
+    }
+    dns = {
+      source = "registry.terraform.io/hashicorp/dns"
+      version = ">= 3.6.1"
+    }
+    http = {
+      source = "registry.terraform.io/hashicorp/http"
+      version = ">= 3.6.1"
+    }
+  }
+
+  backend "local" {
+    path = "/mnt/nfs/terraform/proxmox/talos.tfstate"
+  }
+
+}

proxmox/talos/variables.tf

@@ -0,0 +1,83 @@
+variable "vm_guests" {
+  type = list(object({
+    name = string
+    host = string
+    role = string
+  }))
+}
+
+variable "talos_version" {
+  type = string
+}
+
+variable "cluster_name" {
+  type = string
+}
+
+variable "cluster_api_port" {
+  type = number
+}
+
+variable "kubernetes_version" {
+  type = string
+}
+
+variable "ipv4_gateway" {
+  type = string
+}
+
+variable "ipv6_gateway" {
+  type = string
+}
+
+variable "ipv4_ntp_servers" {
+  type = list(string)
+}
+
+variable "ipv6_ntp_servers" {
+  type = list(string)
+}
+
+variable "ipv4_subnet_mask" {
+  type = number
+}
+
+variable "search_domains" {
+  type = list(string)
+}
+
+variable "ipv4_nameservers" {
+  type = list(object({
+    address = string
+  }))
+}
+
+variable "ipv6_nameservers" {
+  type = list(object({
+    address = string
+  }))
+}
+
+variable "ipv4_pod_cidr" {
+  type = string
+}
+
+variable "ipv6_pod_cidr" {
+  type = string
+}
+
+variable "ipv4_service_cidr" {
+  type = string
+}
+
+variable "ipv6_service_cidr" {
+  type = string
+}
+
+variable "discovery_service_endpoint" {
+  type = string
+}
+
+variable "local_domain" {
+  type = string
+}

proxmox/talos/vars_network.auto.tfvars

@@ -0,0 +1,20 @@
+ipv4_gateway = "10.96.10.254"
+ipv4_subnet_mask = 24
+ipv6_gateway = "2600:4040:593d:8b10:6662:66ff:fe21:e9c4"
+ipv4_nameservers = [
+  {address = "10.96.10.254"}
+]
+ipv6_nameservers = [
+  {address = "2600:4040:593d:8b10:6662:66ff:fe21:e9c4"}
+]
+local_domain = "balsillie.house"
+search_domains = [ 
+  "balsillie.net",
+  "balsillie.house"
+]
+ipv4_ntp_servers = [
+  "10.96.10.254"
+]
+ipv6_ntp_servers = [
+  "2600:4040:593d:8b10:6662:66ff:fe21:e9c4"
+]

proxmox/talos/vars_talos.auto.tfvars

@@ -0,0 +1,9 @@
+talos_version = "v1.13.9"
+kubernetes_version = "1.36.3"
+cluster_name = "k8s01"
+cluster_api_port = 6443
+ipv4_pod_cidr = ""
+ipv6_pod_cidr = ""
+ipv4_service_cidr = ""
+ipv6_service_cidr = ""
+discovery_service_endpoint = "https://talos-discovery.balsillie.house"

proxmox/talos/vars_vms.auto.tfvars

@@ -0,0 +1,32 @@
+vm_guests = [
+  {
+    host = "hv01"
+    name = "cp01"
+    role = "controlplane"
+  },
+  {
+    host = "hv02"
+    name = "cp02"
+    role = "controlplane"
+  },
+  {
+    host = "hv03"
+    name = "cp03"
+    role = "controlplane"
+  },
+  {
+    host = "hv01"
+    name = "wn01"
+    role = "worker"
+  },
+  {
+    host = "hv02"
+    name = "wn02"
+    role = "worker"
+  },
+  {
+    host = "hv03"
+    name = "wn03"
+    role = "worker"
+  }
+]