From fafc0138961221d8187a20d0918e90e35234fa11 Mon Sep 17 00:00:00 2001 From: michael Date: Thu, 3 Sep 2026 00:35:34 -0400 Subject: [PATCH] wip --- proxmox/data.tf | 20 ++++++ proxmox/files.tf | 16 +++++ proxmox/files/talos_cluster_patch.yml | 66 ------------------- proxmox/files/talos_machine_patch.yml | 20 ------ proxmox/locals.tf | 32 ++++++++- proxmox/network.auto.tfvars | 5 +- proxmox/providers.tf | 4 +- proxmox/talos.auto.tfvars | 10 ++- .../templates/control_plane_user_data.tftpl | 27 -------- .../templates/talos_cluster_config.yml.tftpl | 42 ++++++++++++ .../templates/talos_hostname_config.yml.tftpl | 2 +- proxmox/templates/talos_link_config.yml.tftpl | 9 ++- .../templates/talos_machine_config.yml.tftpl | 26 ++++++++ proxmox/terraform.tf | 4 ++ proxmox/variables.tf | 28 ++++++++ proxmox/vms.auto.tfvars | 15 ----- 16 files changed, 187 insertions(+), 139 deletions(-) delete mode 100644 proxmox/files/talos_cluster_patch.yml delete mode 100644 proxmox/files/talos_machine_patch.yml delete mode 100644 proxmox/templates/control_plane_user_data.tftpl create mode 100644 proxmox/templates/talos_cluster_config.yml.tftpl create mode 100644 proxmox/templates/talos_machine_config.yml.tftpl diff --git a/proxmox/data.tf b/proxmox/data.tf index ab83847..f36d219 100644 --- a/proxmox/data.tf +++ b/proxmox/data.tf @@ -4,3 +4,23 @@ data "proxmox_virtual_environment_node" "hvc01" { for_each = toset(data.proxmox_virtual_environment_nodes.hvc01.names) node_name = each.value } + +data "dns_a_record_set" "cluster_api" { + host = local.cluster_fqdn +} + +data "dns_a_record_set" "guests" { + for_each = [ for guest in var.vm_guests: "${guest.name}.${var.local_domain}" ] + host = each.value +} + +data "dns_aaaa_record_set" "guests" { + for_each = [ for guest in var.vm_guests: "${guest.name}.${var.local_domain}" ] + host = each.value +} + +data "dns_aaaa_record_set" "cluster_api" { + host = local.cluster_fqdn +} + + diff --git a/proxmox/files.tf b/proxmox/files.tf index e36f775..9c461be 100644 --- a/proxmox/files.tf +++ b/proxmox/files.tf @@ -13,6 +13,8 @@ # upload_mode = "stream" # } + + resource "proxmox_virtual_environment_file" "talos_iso" { for_each = data.proxmox_virtual_environment_node.hvc01 content_type = "iso" @@ -28,4 +30,18 @@ resource "proxmox_virtual_environment_file" "talos_iso" { } timeout_upload = 120 # upload_mode = # N/A, has no effect when content_type = iso +} + +resource "proxmox_virtual_environment_file" "talos_cloud_init" { + for_each = { for guest in var.vm_guests: guest.name => guest if contains(["controlplane", "worker"], guest.role) } + content_type = "snippets" + datastore_id = "local" + node_name = each.value.node + overwrite = true + source_raw { + data = data.talos_machine_configuration.this[each.key].machine_configuration + file_name = "cloud_init_${each.key}.yml" + } + timeout_upload = 10 + upload_mode = "stream" } \ No newline at end of file diff --git a/proxmox/files/talos_cluster_patch.yml b/proxmox/files/talos_cluster_patch.yml deleted file mode 100644 index 210377d..0000000 --- a/proxmox/files/talos_cluster_patch.yml +++ /dev/null @@ -1,66 +0,0 @@ -version: v1alpha1 -debug: false -persist: true - -cluster: - network: - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: 0rgiji.bwgranqg365c7no5 - secretboxEncryptionSecret: Q4npGGVfneHxxB+CKI1ELnc9bbjvVv/q0raybNAe/lc= - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpVENDQVRDZ0F3SUJBZ0lSQUpOZ0FkaVFxVUovWEdjVjd6clhoeFl3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakE1TURFeU1URTVNek5hRncwek5qQTRNamt5TVRFNQpNek5hTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRNSE96Mlh0K2xVaERUajRKRU1PRWNlQ2tENkRVZ3lsZzJ3bXFJREpqUE1aMG9VajdwZkVscDUyc28KelJycTlwTXEyK2s2eTlTM21Rc1NqekQ1OWFSam8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGS3V1cTN1QUJSSEJoendPNG1WaTRRK2FNaE40TUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDSUFIdythcXIKbDl4eWpHVUpKTjFyYnJ6c2psZDZSeVhUMk0xVXRVMDdWK1k2QWlBVzJtS1pCSnE3dEk0YmNOMGlNSWo3SFc5NApRT0Q5SnVQbVRRSG5UcGRpN2c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUtZSnJ2Y1hFU0NLRDlwMURhRjFvLy9Kbm5uWDh5MmtFbnNIQlo1RFFtdEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFekJ6czlsN2ZwVklRMDQrQ1JERGhISGdwQStnMUlNcFlOc0pxaUF5WXp6R2RLRkkrNlh4SgphZWRyS00wYTZ2YVRLdHZwT3N2VXQ1a0xFbzh3K2ZXa1l3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - aggregatorCA: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZRENDQVFhZ0F3SUJBZ0lSQUl2RG94RmJUN0h1OHRYenM4SjRZSVl3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5qQTVNREV5TVRFNU16TmFGdzB6TmpBNE1qa3lNVEU1TXpOYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVNvUi80QitOR2RzWHJKUUJHRTJNc05BaktZSnBRLzJOc2RzYTYyUDlraG5HTVZzOE1kCnp1cXpFQktOdStLalVNb0xvT3dZUnlCOUQyZXVDcWRFY0hUUW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGSG9McFRvRE9IQVZKU2ZWMFNnVkpIdEJIb1pPTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDCklRQzA0czY3aXI1VnpaSWdyU1I5bG90WGM5NHp2dkphcGo4QXVXR1VxYjlZcXdJZ0tDVWJFSGZYc2VOY1hqYUoKVmhaQ0ZQWHc3YXY0S0hhZWJwMXo5UEM2eHhJPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUU3QTJ5TTRsVTFPS1EzSFhXTTVLZ3h4a1VKZHorem9zOGhSRmFvREthRUdvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFcUVmK0FmalJuYkY2eVVBUmhOakxEUUl5bUNhVVA5amJIYkd1dGovWklaeGpGYlBESGM3cQpzeEFTamJ2aW8xREtDNkRzR0VjZ2ZROW5yZ3FuUkhCMDBBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= - serviceAccount: - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKSndJQkFBS0NBZ0VBckFIUXdtRWVka3g3YlNUdzFBMkxpQjNHRzNWVGtDRWRlR2tpdUJ5ZVF0UCtsYVgyCjUvZEFpYnoyNUVCUWhPVDlPZVFJQ1NYbldRUW5abUFFd2lvK3N1Z0hPVlk2QXdqNjhsdkpIMDBoVG5rK0E1VTEKZTZmeU04MUlKOGtwMXhvUTJjamhZQ2ZuZTVVUW5mblN6RHJjblNDYUpUQXNIK1VFUUFuSS8vU01ndjFLbVJhcQprTFpnTXpVYnJlQkdLZnNidEFYRmNBYWtvOVRzOWlNZFAwYk5KWkpCRElFYndBQjRuWGdRS1k5OWtPcVdHRGpSCmwrRXZ3R3pkd0d6d2RMNXJvakx4UGZZSncvMEhRWjRCcG1KWHlaU3N1bDkzSnhCTmxFSHVJbHlUd053alFFNm0KVnYyNjNod3NkWUJsSXR2NUJWdzZ3aDZmMHRiMmNSVEdQMnlPYzJRemg3bXVJU0lNenFaQlRUNEQyVER6Wm1IWAp3Mm55cVN0TXJhV3lSczJnWWk5aXp4OXU1WFIzWTVPVXQrelpOSlVzcFdoQitBZnhJQWxKWTR6NnNieTUyL3JPCnVUWEdQeFlHTzRQNmM5a0FWQ1BqaVVaMFQvYU9ZZU13Q200VmNqNGF6ZGU0eEhJLzNLU0t3MHlwamtLeTZQaFIKQjM5a1FuQlkwOHJyQlJJZHpld1VHb2tXN2ZObTBZWGpHNFgzQ2pGUTBST0pTSnp0MFlSZlZLNXh6Yk1qaS9zeAprdnVnVjA1NWhiTVUwa3BqOThYbTVhYWp5b1UxNVRITklFNDBhWXlnTTlYWXl6ME9jZzdZa0kxVHMrT2laaVZLCkhZOEdyRFltaTJkYUNHdHBFSzlkRjVkNVdDOGY4dEFRdjJWUDFja2tBQWhxZ0JvTzhiL1dSZTVyaFZrQ0F3RUEKQVFLQ0FnQVE1bVpEbk8xMFo5Z1dMWk9jY0I3Q0gxUEdRYUUxMTIwWTlqSi9OcStkaHd6NzJOaEJLeGZNR0xVRQowT1ZnWTB2V2p1Y3p0K1hLeHhmVWJSRjJudFkxZDRyektSdk96Y2h6UE0ydVhjS01ubWkzaXliYnVSRDQ0ajNwClM5Qm90aUxLOVJ2Z3VkYjZlMWRNUUQ0a0N4SC9QYk5yZlRmT28rNm1tSmVIUDNpNVM0ZnpjZWpOQ21BNkU4a2UKREx1MEZ2d2VORlYxWisrdithVVZHM2JkajFncmJYcm03cjRDWDhGNkRsQi9OdDRhV1pRbytkY3RCaWJ1RC93NwpNbkR2TllEbmlUd083NUErMFlydm1XWFYybEtBQjdPdlpaOFVSMXVwK2c3YTBUQUN1bFpiMUladkpHT2lmRS9wCmRSV3F4c1JwTUlwRTVhT2tJSE1MQWdTbStXUm0vSC9wZW92M1g5UURSMFNRYXM5WlNLOVh4R2hlcTNKUDBXSC8KVWFZaFVhb29xb0R0RU1RWGE3VHhLRzNCVE9FU081MDUvWVNTa2V1VW9jR2RyeXJuWnFzd3UwMDJEa3krMTJ2NApiUEl6dEJYT041akx2RUhsNFluL1p0NjVTcWNYQUFObkR4V2hPUkUvWnhCTzcyMjI0NjVBQ1JjUEFVTjF6S1VxCkttdDUwbWJIVGhUNUxsKzRubFpIRmR2RnFlSzZMa2RNeUtvNTVmWW8xL1IzaGk3Q2JibUdTazFra3JxQkhwcmgKTFNsWktuQ2JXUXBDWFpaN3pSdEdyRWp0aHlMZ1hvQXJEKzNTVzZRWDhDNWNvSXpkM2tEaTFUMER2Z1NVa05Mdwoya2tQK3h1R21Hb2hVYU1NSWUxbGVwZGIvaFQxVlJDSmhIdzhScWNhM3hPQ3lHVkpBUUtDQVFFQTJuZDlpdWw4CnFvdUVaWlVDTHVWcnRzNWR1NEEvTW0ycEp5anAzWDh1TktLUTlSSjNQbERvOTV0RkFZMi9PbDEyVmFsYzF0c20KYXp1bm1TOHU1clVyWjZxT1JJdHpoZnBqQVNObi9HTE5RMGtNb2Y5c2lzMEdYR3c1WktOU3lJb0dNM2hvblVsNQpucmhHM1k1R24vUFNLUCtLWVFtUFQ4TUs2RXN5bWMvZ0pDTjkxa1p5cU9RVndSWmljczNCb3Fud3AzOWFLZlZoCmNORk9URjNIbFpPOTZVNGxGeTVURHRHOERsbis1RG5VOHl5clJlUmFaQkN5ZXpLaE83QWZEOUEyV1E4TU5weHIKRE94RWxSVCt6ME5rWWkrN1FEOXhWUlBQZ1hHYk1jZUFEdmpSMkhhU215eXJlTHp2SDZvdG91UUltVDV2SlhLMgp5T05ZR2tQMEp2c1RBUUtDQVFFQXlZNzB6TkJzY0FQdFdyU0doVVZiSFBCN1lpTnBjcWRkU2NiQld5TnJEOHZMCmZJUDBlclkrTnNpaVNsUTY0ZGxVMy9hc2d5QmJKWXFWNWptdmd4YVFaeDJoUlg2VWtheGxlWmZKUURheFJlTjYKSHpMcGgyY04vVEZWTVA1bjZMZjlEUW5ldGd2b1ZlT04xVm1ibDFidE9DVGJhTVpUUG5jb0VsNStMWEFUVEJ1Ngo4OU11ZEVSdjhRbVRQalNhcTZraWJINUdpMlNqc1R3NHRhNHI5Y0YzajBZQ0IzazlCeU5UR2lmQlNmT3d4YkhaCkg5NVBMR3FFTXdUY0MxSFREdm1nVlkyQks3SmlBaVdHSmNmRmN5bHZhN1hzUm1oV0FJNS9VaE1TSDNZQm8wek0KampTeWZKaDE2SkxsUEZpN0NobVJVbmg1Zm1NK2VHa0NRVWpMYU1QcVdRS0NBUUJVZ3JURjc5eVIvTGFTdFRuSworbVRZcXF3SHhHeXVEVTNLSUVHWHRZTWlTV0RaN1BMRDRIaStrQW41dCtPcHFFNEdoU1dzMThuYzRZN0w2enl4CmNwUC8zako2d1pkRzFMMUh5M0tHWjVJUDNVcE53SWswaUd0VmhXZ09Uai9QNDlUU1JGbnp2bUNWemFOY1FaV0EKZXNscG9yRGRLTjJQZFZ2YTBId2FsQmVZNDBIaWlnNEExM3F5M3YzbWUwSFVzdml0VXM2R1BLNGMvbHJUbjlOOQpRVkhOMXJUeWFyRW1vbXVsQVp0Z25oNktrMVVPREhBTEZZcDFyZmhCSnJoZFhhWW9mWEcwRG40NjJZc09RTGp4ClpKaUlndjVrdENZYlN6YVNWR2c4c1hnUVVxQ2FwQVBDazEwaHI3U3hBeHYwVDFJa05jcTVLYzhibHhhVjBvTzQKTUpnQkFvSUJBRFhkT0ZxTDBJN1czZFdCclBsc29YN0lYWkRLZWVHa0RIQXM1M3RkcWJ6Yzc1SmxDUzdLQ1RKRwp4K2dwUGxzZzQyZSsyamRvckRNS0tDa1FmWEVBMUxKWjNzRmRwSUtSbWNTMjVaZDloajV4SGkrOFFXQm9EL3I3CjloSlR5cDBNbmxtZnE1N202NzRZUTgwaVYweElkTGl1VU54ZE05M2JwaC9TbE5HN3c4eHhGTE1ZV3EvRG9rNisKQ2xWelpXbytsdTU3aUlxejZITHk3d3pPY1AwS0tOTm5HQis3TEszOXFMV3lyaHIvUHR4MlBOb2haUE12dkFpTwpZZWU4aERUYVRSalA2aGN0WXJmRUkyZHhUYmtLOTdYSE5rOVNqcmt6VzU4cGJZeHUwdDA3SnVkUitla0dMV3hyCjVVc05RMTdkbWxKNTA2NE5BNkxXSFQ0cElBTHRhSEVDZ2dFQVI0WTB2dTNDbUlZU09taGZaV0ZwdGh0UUJHSUkKemJCYzdDWWd0SU4yZVpDNVA0bUtkRlBFQm9sd1lKcXZ4Z0pSR1VPQ2VCV3J5YmlENFpNMGt2ektmNWpXL3ppNQoybCtGQ1hoUkN1bmZ0WkQxeVdvKytlUDIvTE5EbEs2WTNNOXZzakplSkk2YnVRNjMwU3c0SDBMUmJJanlvVVNvCkEzMzBjdlJiTXpKY2JZaUN6ZWdYK3hoUDZXekRZUlN0OVppZ095WTRldXNpMEU5bkJ2QXBSYUVOQlROMjFLdVMKbmkrODcvZlNBNEprcUJKSWFCOEJISmk4ZWZGVzA1MkdDZXVzUkt5OE5zazc4Q0Q2dnZlWW1YQTZCdUxvSnZqNgpmbWZ1U2ZPdnNoNUtiMy9zR3lmNTM4Q2hTelBKc2RQcGdJNENQaHJFNFU3RVo3c0cxZTFDR29IRExRPT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K - apiServer: - image: registry.k8s.io/kube-apiserver:v1.36.3 - admissionControl: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration - auditPolicy: - apiVersion: audit.k8s.io/v1 - kind: Policy - rules: - - level: Metadata - controllerManager: - image: registry.k8s.io/kube-controller-manager:v1.36.3 - proxy: - image: registry.k8s.io/kube-proxy:v1.36.3 - scheduler: - image: registry.k8s.io/kube-scheduler:v1.36.3 - discovery: - enabled: true - registries: - kubernetes: - disabled: true - service: - disabled: false - etcd: - # ca: - # crt: - # key: ---- -apiVersion: v1alpha1 -kind: HostnameConfig -auto: stable diff --git a/proxmox/files/talos_machine_patch.yml b/proxmox/files/talos_machine_patch.yml deleted file mode 100644 index 8637b5a..0000000 --- a/proxmox/files/talos_machine_patch.yml +++ /dev/null @@ -1,20 +0,0 @@ -machine: - certSANs: [] - # kubelet: - # image: ghcr.io/siderolabs/kubelet:v1.36.3 - # defaultRuntimeSeccompProfileEnabled: true - # disableManifestsDirectory: true - install: - disk: /dev/sda - image: ghcr.io/siderolabs/installer:v1.13.0 - wipe: false - grubUseUKICmdline: true - features: - diskQuotaSupport: true - kubePrism: - enabled: false - hostDNS: - enabled: true - forwardKubeDNSToHost: false - nodeLabels: - node.kubernetes.io/exclude-from-external-load-balancers: "" \ No newline at end of file diff --git a/proxmox/locals.tf b/proxmox/locals.tf index f81ede5..7aee11e 100644 --- a/proxmox/locals.tf +++ b/proxmox/locals.tf @@ -2,15 +2,43 @@ locals { hv01_id = [ for node in data.proxmox_virtual_environment_node.hvc01 : node if node.node_name == "hv01"][0].id # Validate talos_version variable talos_version = [ for version in data.talos_image_factory_versions.this.talos_versions : version if version == var.talos_version][0] - cluster_endpoint = "https://${var.cluster_name}:6443" + cluster_fqdn = "${var.cluster_name}.${var.local_domain}" + cluster_endpoint = "https://${local.cluster_fqdn}:${var.cluster_api_port}" + cluster_api_ipv4_address = data.dns_a_record_set.cluster_api_ipv4_address.addrs[0] + cluster_api_ipv6_address = data.dns_aaaa_record_set.cluster_api_ipv6_address.addrs[0] machine_config_patches = { for guest in var.vm_guests: guest.name => [ + templatefile("${path.root}/templates/talos_machine_config.yml.tftpl", { + hostname = guest.name + local_domain = var.local_domain + cluster_fqdn = local.cluster_fqdn + cluster_api_ipv4_address = local.cluster_api_ipv4_address + cluster_api_ipv6_address = local.cluster_api_ipv6_address + ipv4_address = data.dns_a_record_set.guests[guest.name].addrs[0] + ipv6_address = data.dns_aaaa_record_set.guests[guest.name].addrs[0] + }), + templatefile("${path.root}/templates/talos_cluster_config.yml.tftpl", { + cluster_name = var.cluster_name + cluster_fqdn = local.cluster_fqdn + cluster_endpoint = local.cluster_endpoint + cluster_api_port = var.cluster_api_port + cluster_api_ipv4_address = local.cluster_api_ipv4_address + cluster_api_ipv6_address = local.cluster_api_ipv6_address + ipv4_pod_cidr = var.ipv4_pod_cidr + ipv6_pod_cidr = var.ipv6_pod_cidr + ipv4_service_cidr = var.ipv4_service_cidr + ipv6_service_cidr = var.ipv6_service_cidr + discovery_service_endpoint = var.discovery_service_endpoint + }), templatefile("${path.root}/templates/talos_hostname_config.yml.tftpl", { hostname = guest.name + local_domain = var.local_domain }), templatefile("${path.root}/templates/talos_link_config.yml.tftpl", { - ipv4_address = guest.ipv4_address + ipv4_address = data.dns_a_record_set.guests[guest.name].addrs[0] + ipv6_address = data.dns_aaaa_record_set.guests[guest.name].addrs[0] ipv4_subnet_mask = var.ipv4_subnet_mask ipv4_gateway = var.ipv4_gateway + ipv6_gateway = var.ipv6_gateway }), templatefile("${path.root}/templates/talos_resolver_config.yml.tftpl", { ipv4_nameservers = var.ipv4_nameservers diff --git a/proxmox/network.auto.tfvars b/proxmox/network.auto.tfvars index 82d1007..e796bad 100644 --- a/proxmox/network.auto.tfvars +++ b/proxmox/network.auto.tfvars @@ -4,7 +4,8 @@ ipv6_gateway = null ipv4_nameservers = [ {address = "10.96.10.254"} ] -ipv6_ntp_servers = [] +ipv6_nameservers = [] +local_domain = "balsillie.house" search_domains = [ "balsillie.net", "balsillie.house" @@ -12,4 +13,4 @@ search_domains = [ ipv4_ntp_servers = [ "10.96.10.254" ] -ipv6_nameservers = [] \ No newline at end of file +ipv6_ntp_servers = [] \ No newline at end of file diff --git a/proxmox/providers.tf b/proxmox/providers.tf index edbf9c5..ce648c7 100644 --- a/proxmox/providers.tf +++ b/proxmox/providers.tf @@ -21,4 +21,6 @@ provider "proxmox" { } } } -provider "talos" {} \ No newline at end of file +provider "talos" {} + +provider "dns" {} \ No newline at end of file diff --git a/proxmox/talos.auto.tfvars b/proxmox/talos.auto.tfvars index 150e73c..5e136ae 100644 --- a/proxmox/talos.auto.tfvars +++ b/proxmox/talos.auto.tfvars @@ -1,3 +1,9 @@ talos_version = "v1.13.9" -cluster_name = "k8s01.balsillie.house" -kubernetes_version = "1.36.3" \ No newline at end of file +kubernetes_version = "1.36.3" +cluster_name = "k8s01" +cluster_api_port = 6443 +ipv4_pod_cidr = "" +ipv6_pod_cidr = "" +ipv4_service_cidr = "" +ipv6_service_cidr = "" +discovery_service_endpoint = "https://talos-discovery.balsillie.house" \ No newline at end of file diff --git a/proxmox/templates/control_plane_user_data.tftpl b/proxmox/templates/control_plane_user_data.tftpl deleted file mode 100644 index 5b5b756..0000000 --- a/proxmox/templates/control_plane_user_data.tftpl +++ /dev/null @@ -1,27 +0,0 @@ -cluster: - id: - secret: - token: - endpoint: https://:6443 - -machine: - type: controlplane - token: - kubelet: - image: ghcr.io/siderolabs/kubelet:v1.29.0 - install: - disk: /dev/sda - image: ghcr.io/siderolabs/installer:v1.6.0 - bootLOADER: grub - network: - interfaces: - - interface: eth0 - dhcp: true - nameservers: - - 8.8.8.8 - sysctls: - fs.inotify.max_user_watches: "1048576" - features: - rbac: true - stableHostname: true - appArmor: true \ No newline at end of file diff --git a/proxmox/templates/talos_cluster_config.yml.tftpl b/proxmox/templates/talos_cluster_config.yml.tftpl new file mode 100644 index 0000000..7fd338b --- /dev/null +++ b/proxmox/templates/talos_cluster_config.yml.tftpl @@ -0,0 +1,42 @@ +# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/v1alpha1/config#cluster + +cluster: + controlPlane: + endpoint: ${cluster_endpoint} + localAPIServerPort: ${cluster_api_port} + clusterName: ${cluster_name} + network: + cni: + name: custom + urls: [] # FIX + dnsDomain: ${cluster_fqdn} + podSubnets: + - "${ipv4_pod_cidr}" + - "${ipv6_pod_cidr}" + serviceSubnets: + - "${ipv4_service_cidr}" + - "${ipv6_service_cidr}" + apiServer: + certSANs: + - "${cluster_fqdn}" + - "${cluster_api_ipv4_address}" + - "${cluster_api_ipv6_address}" + proxy: + disabled: true + discovery: + enabled: true + registries: + kubernetes: + disabled: true + service: + disabled: false + endpoint: ${discovery_service_endpoint} + coreDNS: + disabled: false + extraManifests: [] + inlineManifests: + - name: + contents: + adminKubeconfig: + certLifetime: 10y + allowSchedulingOnControlPlanes: false diff --git a/proxmox/templates/talos_hostname_config.yml.tftpl b/proxmox/templates/talos_hostname_config.yml.tftpl index dfc579a..0cf9282 100644 --- a/proxmox/templates/talos_hostname_config.yml.tftpl +++ b/proxmox/templates/talos_hostname_config.yml.tftpl @@ -2,5 +2,5 @@ apiVersion: v1alpha1 kind: HostnameConfig -hostname: ${hostname} +hostname: ${hostname}.$(local_domain) auto: off \ No newline at end of file diff --git a/proxmox/templates/talos_link_config.yml.tftpl b/proxmox/templates/talos_link_config.yml.tftpl index c43940f..35be6a7 100644 --- a/proxmox/templates/talos_link_config.yml.tftpl +++ b/proxmox/templates/talos_link_config.yml.tftpl @@ -6,7 +6,10 @@ name: enp0s1 # Default link position assigned by proxmox up: true mtu: 1500 addresses: - - address: ${ipv4_address}/${ipv4_subnet_mask} + - address: "${ipv4_address}/${ipv4_subnet_mask}" + - address: "${ipv6_address}/64" routes: - - destination: 0.0.0.0/0 - gateway: ${ipv4_gateway} + - destination: "0.0.0.0/0" + gateway: "${ipv4_gateway}" + - destination: "::/0" + gateway: "${ipv6_gateway}" diff --git a/proxmox/templates/talos_machine_config.yml.tftpl b/proxmox/templates/talos_machine_config.yml.tftpl new file mode 100644 index 0000000..d7b42a4 --- /dev/null +++ b/proxmox/templates/talos_machine_config.yml.tftpl @@ -0,0 +1,26 @@ +# Ref: https://docs.siderolabs.com/talos/latest/reference/configuration/v1alpha1/config#machine + +machine: + certSANs: + - "${hostname}.${local_domain}" + - "${cluster_fqdn}" + - "${cluster_api_ipv4_address}" + - "${cluster_api_ipv6_address}" + - "${ipv4_address}" + - "${ipv6_address}" + kubelet: + defaultRuntimeSeccompProfileEnabled: true + disableManifestsDirectory: true + install: + disk: /dev/sda + wipe: true + grubUseUKICmdline: true + legacyBIOSSupport: false + features: + kubernetesTalosAPIAccess: false + diskQuotaSupport: false + kubePrism: + enabled: false + hostDNS: + enabled: true + forwardKubeDNSToHost: false \ No newline at end of file diff --git a/proxmox/terraform.tf b/proxmox/terraform.tf index 9a3aa62..1082dc3 100644 --- a/proxmox/terraform.tf +++ b/proxmox/terraform.tf @@ -10,6 +10,10 @@ terraform { source = "registry.terraform.io/siderolabs/talos" version = "0.11.0" } + dns = { + source = "registry.terraform.io/hashicorp/dns" + version = ">= 3.6.1" + } } backend "local" { diff --git a/proxmox/variables.tf b/proxmox/variables.tf index a50bf7c..e33b286 100644 --- a/proxmox/variables.tf +++ b/proxmox/variables.tf @@ -17,6 +17,10 @@ variable "cluster_name" { type = string } +variable "cluster_api_port" { + type = number +} + variable "kubernetes_version" { type = string } @@ -55,4 +59,28 @@ variable "ipv6_nameservers" { type = list(object({ address = string })) +} + +variable "ipv4_pod_cidr" { + type = string +} + +variable "ipv6_pod_cidr" { + type = string +} + +variable "ipv4_service_cidr" { + type = string +} + +variable "ipv6_service_cidr" { + type = string +} + +variable "discovery_service_endpoint" { + type = string +} + +variable "local_domain" { + type = string } \ No newline at end of file diff --git a/proxmox/vms.auto.tfvars b/proxmox/vms.auto.tfvars index 791e8ad..aee0c7c 100644 --- a/proxmox/vms.auto.tfvars +++ b/proxmox/vms.auto.tfvars @@ -1,41 +1,26 @@ vm_guests = [ { - cpu = 1 host = "hv01" - ipv4_address = "10.96.10.61" - memory = 4096 name = "cp01" role = "controlplane" }, { - cpu = 1 host = "hv02" - ipv4_address = "10.96.10.62" - memory = 4096 name = "cp02" role = "controlplane" }, { - cpu = 1 host = "hv03" - ipv4_address = "10.96.10.63" - memory = 4096 name = "cp03" role = "controlplane" }, { - cpu = 1 host = "hv02" - ipv4_address = "10.96.10.64" - memory = 4096 name = "wn01" role = "worker" }, { - cpu = 1 host = "hv03" - ipv4_address = "10.96.10.65" - memory = 4096 name = "wn02" role = "worker" }