Skip to content

Commit 29b6d24

Browse files
MacroPowerMacroPower
committed
Add initial infra for krobot01
1 parent 4a892ce commit 29b6d24

File tree

14 files changed

+352
-2
lines changed

14 files changed

+352
-2
lines changed

‎.taskfiles/talos/Taskfile.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ version: "3"
55
vars:
66
TALOS_SCRIPTS_DIR: "{{.ROOT_DIR}}/.taskfiles/talos/scripts"
77
EXTRAS_DIR: "{{.ROOT_DIR}}/hack/extra"
8-
CLUSTER_DOMAIN: cin.macro.network
8+
DEFAULT_CLUSTER_DOMAIN: cin.macro.network
99
DOPPLER_PROJECT: talhelper
1010
TALOS_DIR: "{{.TALOS_DIR}}"
1111

@@ -15,6 +15,7 @@ tasks:
1515
requires:
1616
vars: [CLUSTER_NAME]
1717
vars:
18+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
1819
CLUSTER_ENDPOINT: "k{{.CLUSTER_NAME}}.{{.CLUSTER_DOMAIN}}"
1920
DOPPLER_CMD: "doppler run -p {{.DOPPLER_PROJECT}} -c {{.CLUSTER_NAME}}"
2021
dir: &dir "{{.TALOS_DIR}}/{{.CLUSTER_NAME}}"
@@ -37,6 +38,7 @@ tasks:
3738
requires:
3839
vars: [CLUSTER_NAME]
3940
vars:
41+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
4042
CLUSTER_ENDPOINT: "k{{.CLUSTER_NAME}}.{{.CLUSTER_DOMAIN}}"
4143
DOPPLER_CMD: "doppler run -p {{.DOPPLER_PROJECT}} -c {{.CLUSTER_NAME}}"
4244
MODE: '{{.MODE | default "no-reboot"}}'
@@ -59,6 +61,8 @@ tasks:
5961
NODE: Target node (required)
6062
requires:
6163
vars: [CLUSTER_NAME, NODE]
64+
vars:
65+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
6266
dir: *dir
6367
cmds:
6468
- task: build
@@ -78,6 +82,7 @@ tasks:
7882
requires:
7983
vars: [CLUSTER_NAME]
8084
vars:
85+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
8186
CLUSTER_ENDPOINT: "k{{.CLUSTER_NAME}}.{{.CLUSTER_DOMAIN}}"
8287
dir: *dir
8388
cmds:
@@ -137,7 +142,7 @@ tasks:
137142
desc: Bootstrap Talos cluster
138143
summary: |
139144
Args:
140-
INITIAL_NODE: Node to bootstrap, e.g. kmain01.{{.CLUSTER_DOMAIN}}
145+
INITIAL_NODE: Node to bootstrap, e.g. kmain01.{{.DEFAULT_CLUSTER_DOMAIN}}
141146
RECOVERY_SNAPSHOT: Snapshot to recover from (default: "")
142147
dir: *dir
143148
requires:
@@ -189,6 +194,8 @@ tasks:
189194
NODE: Node to reset (required)
190195
requires:
191196
vars: [NODE]
197+
vars:
198+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
192199
cmds:
193200
- |-
194201
talosctl reset --graceful=false --reboot \
@@ -207,6 +214,7 @@ tasks:
207214
requires:
208215
vars: [CLUSTER_NAME, NODE]
209216
vars:
217+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
210218
DOPPLER_CMD: "doppler run -p {{.DOPPLER_PROJECT}} -c {{.CLUSTER_NAME}}"
211219
cmds:
212220
- |-
@@ -234,6 +242,7 @@ tasks:
234242
requires:
235243
vars: [CLUSTER_NAME, NODE]
236244
vars:
245+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
237246
DOPPLER_CMD: "doppler run -p {{.DOPPLER_PROJECT}} -c {{.CLUSTER_NAME}}"
238247
cmds:
239248
- |
@@ -272,6 +281,8 @@ tasks:
272281
dir: *dir
273282
requires:
274283
vars: [NODE]
284+
vars:
285+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
275286
cmds:
276287
- rm -rf {{.NODE}}.{{.CLUSTER_DOMAIN}}/ cluster/
277288
- defer: unzip support.zip && rm support.zip
@@ -287,6 +298,7 @@ tasks:
287298
requires:
288299
vars: [NODE]
289300
vars:
301+
CLUSTER_DOMAIN: "{{ .CLUSTER_DOMAIN | default .DEFAULT_CLUSTER_DOMAIN }}"
290302
FILENAME: '{{.FILENAME | default "db.snapshot"}}'
291303
cmds:
292304
- talosctl etcd snapshot -n {{.NODE}}.{{.CLUSTER_DOMAIN}} -e {{.NODE}}.{{.CLUSTER_DOMAIN}} {{.FILENAME}}

‎clusters/robot/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
cluster/
2+
clusterconfig/
3+
*.macro.network/
4+
kubernetesResources/
5+
support.zip

‎clusters/robot/kcl.mod‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[package]
2+
name = "cluster_robot"
3+
version = "0.1.0"

‎clusters/robot/kcl.mod.lock‎

Whitespace-only changes.

‎clusters/robot/main.k‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
NAME = "robot"
2+
DOMAIN_NAME = "robot.fsn.macro.network"
3+
FRIENDLY_NAME = "Robot"

‎clusters/robot/talconfig.yaml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
clusterName: robot
2+
talosVersion: v1.11.1
3+
kubernetesVersion: v1.34.1
4+
endpoint: https://krobot.fsn.macro.network:6443
5+
cniConfig:
6+
name: none
7+
8+
additionalApiServerCertSans:
9+
- "10.136.0.1"
10+
- "fc42:0:0:88::1"
11+
12+
clusterSvcNets:
13+
- 10.136.0.0/16
14+
- fc42:0:0:88::/108
15+
clusterPodNets:
16+
- 10.137.0.0/16
17+
- fc42:0:0:89::/64
18+
19+
allowSchedulingOnMasters: true
20+
21+
nodes:
22+
- hostname: krobot01.fsn.macro.network
23+
ipAddress: 10.42.2.20
24+
controlPlane: true
25+
installDisk: /dev/null
26+
nodeLabels:
27+
feature.node.kubernetes.io/network.max-link-speed: 1g
28+
topology.kubernetes.io/region: fsn
29+
networkInterfaces:
30+
- deviceSelector:
31+
driver: macvlan
32+
dhcp: false
33+
addresses:
34+
- "10.42.2.20/24"
35+
mtu: 1400
36+
routes:
37+
- network: 10.42.0.0/16
38+
gateway: "10.42.2.1"
39+
- network: 0.0.0.0/0
40+
gateway: "162.55.243.65"
41+
metric: 2048
42+
- network: ::/0
43+
gateway: "fe80::1"
44+
metric: 4096
45+
patches:
46+
- |-
47+
machine:
48+
kubelet:
49+
extraMounts:
50+
- source: /var/media
51+
destination: /var/media
52+
type: bind
53+
options:
54+
- rbind
55+
- rshared
56+
- rw
57+
features:
58+
hostDNS:
59+
enabled: true
60+
forwardKubeDNSToHost: true
61+
62+
controlPlane:
63+
certSANs:
64+
- krobot.fsn.macro.network
65+
- "127.0.0.1"
66+
nameservers: &nameservers
67+
- "185.12.64.1"
68+
- "185.12.64.2"
69+
disableSearchDomain: &disableSearchDomain true
70+
schematic:
71+
customization:
72+
extraKernelArgs: &extraKernelArgs []
73+
machineFiles:
74+
- &spegelCriConfig
75+
path: /etc/cri/conf.d/20-customization.part
76+
op: create
77+
content: |
78+
[plugins."io.containerd.cri.v1.images"]
79+
discard_unpacked_layers = false
80+
patches:
81+
- |-
82+
- op: replace
83+
path: /cluster/apiServer/admissionControl
84+
value: []
85+
- |-
86+
cluster:
87+
controllerManager:
88+
extraArgs:
89+
bind-address: 0.0.0.0
90+
## Node CIDR mask size for IPv4 and IPv6.
91+
## One unique subnet of this size will be cut from the clusterPodNets
92+
## for every node.
93+
##
94+
node-cidr-mask-size-ipv4: "20"
95+
## The IPv6 node cidr mask size MUST be within 16 bits of the
96+
## clusterPodNets IPv6cidr. By default, the clusterPodNets IPv6 mask
97+
## size is 48 and the clusterPodNets IPv6 cidr is /64 (48+16).
98+
##
99+
node-cidr-mask-size-ipv6: "80"
100+
allocate-node-cidrs: "true"
101+
feature-gates: MemoryQoS=true,InPlacePodVerticalScaling=true,RotateKubeletServerCertificate=true
102+
tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
103+
- |-
104+
cluster:
105+
etcd:
106+
extraArgs:
107+
listen-metrics-urls: http://0.0.0.0:2381
108+
- |-
109+
cluster:
110+
scheduler:
111+
extraArgs:
112+
bind-address: "0.0.0.0"
113+
feature-gates: MemoryQoS=true,InPlacePodVerticalScaling=true,RotateKubeletServerCertificate=true
114+
tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
115+
- |-
116+
cluster:
117+
proxy:
118+
# Replaced by Cillium.
119+
disabled: true
120+
- |-
121+
cluster:
122+
apiServer:
123+
extraArgs:
124+
max-mutating-requests-inflight: 20
125+
max-requests-inflight: 80
126+
feature-gates: MemoryQoS=true,InPlacePodVerticalScaling=true,RotateKubeletServerCertificate=true
127+
tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
128+
- &machineKubelet |-
129+
machine:
130+
kubelet:
131+
nodeIP:
132+
validSubnets:
133+
- 10.42.2.0/24
134+
extraArgs:
135+
feature-gates: MemoryQoS=true,InPlacePodVerticalScaling=true,RotateKubeletServerCertificate=true
136+
rotate-server-certificates: "true"
137+
tls-cipher-suites: TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
138+
- &machineTime |-
139+
machine:
140+
time:
141+
disabled: false
142+
servers:
143+
- 0.north-america.pool.ntp.org
144+
- 1.north-america.pool.ntp.org
145+
- 2.north-america.pool.ntp.org
146+
- 3.north-america.pool.ntp.org
147+
- &machineOpenEBS |-
148+
machine:
149+
sysctls:
150+
vm.nr_hugepages: "1024"
151+
kubelet:
152+
extraMounts:
153+
- source: /var/openebs/local
154+
destination: /var/openebs/local
155+
type: bind
156+
options:
157+
- rbind
158+
- rshared
159+
- rw
160+
- &machineDNS |-
161+
machine:
162+
features:
163+
hostDNS:
164+
enabled: true
165+
forwardKubeDNSToHost: false
166+
167+
worker:
168+
certSANs:
169+
- "127.0.0.1"
170+
nameservers: *nameservers
171+
disableSearchDomain: *disableSearchDomain
172+
schematic:
173+
customization:
174+
extraKernelArgs: *extraKernelArgs
175+
machineFiles:
176+
- *spegelCriConfig
177+
patches:
178+
- *machineKubelet
179+
- *machineTime
180+
- *machineOpenEBS
181+
- *machineDNS
182+
- |-
183+
machine:
184+
kubelet:
185+
extraConfig:
186+
maxPods: 250

‎clusters/robot/talsecret.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
cluster:
2+
id: ${CLUSTER_ID}
3+
secret: ${CLUSTER_SECRET}
4+
secrets:
5+
bootstraptoken: ${SECRETS_BOOTSTRAPTOKEN}
6+
secretboxencryptionsecret: ${SECRETS_SECRETBOXENCRYPTIONSECRET}
7+
trustdinfo:
8+
token: ${TRUSTDINFO_TOKEN}
9+
certs:
10+
etcd:
11+
crt: ${CERTS_ETCD_CRT}
12+
key: ${CERTS_ETCD_KEY}
13+
k8s:
14+
crt: ${CERTS_K8S_CRT}
15+
key: ${CERTS_K8S_KEY}
16+
k8saggregator:
17+
crt: ${CERTS_K8SAGGREGATOR_CRT}
18+
key: ${CERTS_K8SAGGREGATOR_KEY}
19+
k8sserviceaccount:
20+
key: ${CERTS_K8SSERVICEACCOUNT_KEY}
21+
os:
22+
crt: ${CERTS_OS_CRT}
23+
key: ${CERTS_OS_KEY}

‎docs/truenas-scale/containers/talos.yaml‎ renamed to ‎docs/truenas-scale/nas01/containers/talos.yaml‎

File renamed without changes.

‎docs/truenas-scale/containers/utils.yaml‎ renamed to ‎docs/truenas-scale/nas01/containers/utils.yaml‎

File renamed without changes.

‎docs/truenas-scale/nas01/setup.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Setup
2+
3+
Create a shared macvlan network for docker containers:
4+
5+
```
6+
docker network create -d macvlan \
7+
--subnet=10.10.0.0/16 \
8+
--subnet=fc42:0:0:a::/64 \
9+
-o parent=bond0 \
10+
shared_macvlan
11+
```

0 commit comments

Comments
 (0)