talconfig.yaml

---
clusterName: cluster-0
clusterPodNets:
  - 10.244.0.0/16
clusterSvcNets:
  - 10.96.0.0/12
# renovate: depName=ghcr.io/siderolabs/installer datasource=docker
talosVersion: v1.8.3
# renovate: depName=ghcr.io/siderolabs/kubelet datasource=docker
kubernetesVersion: v1.31.2
endpoint: "https://cluster-0.${domainName}:6443"
allowSchedulingOnMasters: true
additionalMachineCertSans: &san
  - ${clusterEndpointIP}
  - cluster-0.${domainName}
  - "127.0.0.1" # KubePrism
additionalApiServerCertSans:
  *san
cniConfig:
  name: none
nodes:
  - hostname: node-0.${domainName}
    ipAddress: 10.20.0.128
    controlPlane: true
    installDisk: /dev/sda
    disableSearchDomain: true
    networkInterfaces:
      - interface: eth0
        mtu: 9000
        dhcp: false
        vip:
          ip: ${clusterEndpointIP}
        vlans:
          - vlanId: 20
            dhcp: false
            addresses:
              - 10.20.0.128/24
            mtu: 9000
            routes:
              - network: 0.0.0.0/0
                gateway: 10.20.0.1
          - vlanId: 30
            dhcp: false
            addresses:
              - 10.30.0.10/24
            mtu: 1500
            routes: []
    kernelModules:
      - name: usbserial
      - name: r8153_ecm
    extensionServices: &nut
      - name: nut-client
        configFiles:
          - content: |-
              MONITOR ${upsmonHost} 1 monuser ${upsmonPasswd} slave
              SHUTDOWNCMD "/sbin/poweroff"
            mountPath: /usr/local/etc/nut/upsmon.conf
  - hostname: node-1.${domainName}
    ipAddress: 10.20.0.125
    controlPlane: true
    installDisk: /dev/sda
    disableSearchDomain: true
    networkInterfaces:
      - interface: eth0
        mtu: 9000
        dhcp: false
        vip:
          ip: ${clusterEndpointIP}
        vlans:
          - vlanId: 20
            dhcp: false
            addresses:
              - 10.20.0.125/24
            mtu: 9000
            routes:
              - network: 0.0.0.0/0
                gateway: 10.20.0.1
          - vlanId: 30
            dhcp: false
            addresses:
              - 10.30.0.11/24
            mtu: 1500
            routes: []
    kernelModules:
      - name: usbserial
      - name: r8153_ecm
    extensionServices: 
      *nut
  - hostname: node-2.${domainName}
    ipAddress: 10.20.0.127
    controlPlane: true
    installDisk: /dev/sda
    disableSearchDomain: true
    networkInterfaces:
      - interface: eth0
        mtu: 9000
        dhcp: false
        vip:
          ip: ${clusterEndpointIP}
        vlans:
          - vlanId: 20
            dhcp: false
            addresses:
              - 10.20.0.127/24
            mtu: 9000
            routes:
              - network: 0.0.0.0/0
                gateway: 10.20.0.1
          - vlanId: 30
            dhcp: false
            addresses:
              - 10.30.0.12/24
            mtu: 1500
            routes: []
    kernelModules:
      - name: usbserial
      - name: r8153_ecm
    extensionServices: 
      *nut
controlPlane:
  schematic:
    customization:
      extraKernelArgs:
        - mitigations=off
        - module_blacklist=e1000e
        - net.ifnames=0
        - talos.logging.kernel=udp://vector.${ingressDomain}:6050/
      systemExtensions:
        officialExtensions:
          - siderolabs/intel-ucode
          - siderolabs/i915-ucode
          - siderolabs/nut-client
          - siderolabs/usb-modem-drivers
  patches:
    # Disable search domain everywhere
    - |-
      machine:
        network:
          disableSearchDomain: true
    
    # Force nameserver
    - |-
      machine:
        network:
          nameservers:
            - 10.20.0.1
    # Enable KubePrism
    - |-
      machine:
        features:
          kubePrism:
            enabled: true
            port: 7445

    # Disable DNS resolver cache
    - |-
      machine:
        features:
          hostDNS:
            enabled: false
            forwardKubeDNSToHost: true

    # Add cluster endpoint host entry
    - |-
      machine:
        network:
          extraHostEntries:
            - ip: ${clusterEndpointIP}
              aliases:
                - cluster-0.${domainName}
    # Configure Controller Manager
    - |-
      - op: add
        path: /cluster/controllerManager/extraArgs
        value:
          bind-address: 0.0.0.0
    # Configure Scheduler
    - |-
      - op: add
        path: /cluster/scheduler/extraArgs
        value:
          bind-address: 0.0.0.0
    # Disable service discovery
    - |-
      - op: add
        path: /cluster/discovery/registries/service
        value:
          disabled: true
    # Cluster configuration
    - |-
      cluster:
        allowSchedulingOnMasters: true
        proxy:
          disabled: true
    # ETCD configuration
    - |-
      cluster:
        etcd:
          extraArgs:
            listen-metrics-urls: http://0.0.0.0:2381
            election-timeout: 5000
            heartbeat-interval: 250
          advertisedSubnets:
            - 10.20.0.0/24
    # Configure containerd
    - |-
      machine:
        files:
          - op: create
            path: /etc/cri/conf.d/20-customization.part
            content: |
              [plugins]
                [plugins."io.containerd.grpc.v1.cri"]
                  enable_unprivileged_ports = true
                  enable_unprivileged_icmp = true
    # Disable default API server admission plugins.
    - |-
      - op: remove
        path: /cluster/apiServer/admissionControl
    # Enable K8s Talos API access
    - |-
      machine:
        features:
          kubernetesTalosAPIAccess:
            enabled: true
            allowedRoles:
              - os:admin
            allowedKubernetesNamespaces:
              - system-upgrade
    # Kubelet configuration
    - |-
      machine:
        kubelet:
          extraArgs:
            rotate-server-certificates: "true"
          extraConfig:
            maxPods: 150
          nodeIP:
            validSubnets:
                - 10.20.0.0/24
    # Custom sysctls
    - |-
      machine:
        sysctls:
          fs.inotify.max_user_watches: "1048576"
          fs.inotify.max_user_instances: "8192"