homelab/terraform/templates/controlplane.tftpl

version: ${version}
debug: false
persist: true

machine:
  type: controlplane
  token: ${token}
  ca:
    crt: ${ca_crt}
    key: ${ca_key}
  certSANs:
    - ${lan_ip}
%{ if wg0_ip != null ~}
    - ${wg0_ip}
%{ endif ~}
%{ for san in cloudflare_talos_sans ~}
    - ${san}
%{ endfor ~}
  network:
    hostname: ${hostname}
    interfaces:
      - interface: eno1
        addresses:
          - ${lan_ip}/24
        routes:
          - network: 0.0.0.0/0
            gateway: ${lan_gateway}
        dhcp: false
        dhcpOptions:
          ipv6: false
%{ if wg0_ip != null ~}
      - interface: wg0
        addresses:
          - ${wg0_ip}/24
        wireguard:
          privateKey: "${wg0_private_key}"
          listenPort: ${wg0_port}
          peers:
%{ for peer in wg0_peers ~}
            - publicKey: "${peer.public_key}"
              allowedIPs:
%{ for ip in peer.allowed_ips ~}
                - ${ip}
%{ endfor ~}
%{ endfor ~}
%{ endif ~}
%{ if wg1_ip != null ~}
      - interface: wg1
        addresses:
          - ${wg1_ip}/24
        wireguard:
          privateKey: "${wg1_private_key}"
          listenPort: ${wg1_port}
          peers:
%{ for peer in wg1_peers ~}
            - publicKey: "${peer.public_key}"
              allowedIPs:
%{ for ip in peer.allowed_ips ~}
                - ${ip}
%{ endfor ~}
              persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
%{ endfor ~}
%{ endif ~}
    nameservers:
%{ for ns in dns_servers ~}
      - ${ns}
%{ endfor ~}
    extraHostEntries:
      - ip: ${forgejo_registry_ip}
        aliases:
          - ${forgejo_hostname}
  kubelet:
    image: ${kubelet_image}
    defaultRuntimeSeccompProfileEnabled: true
    disableManifestsDirectory: true
    clusterDNS:
      - ${cluster_dns_ip}
    extraArgs:
      rotate-server-certificates: true
    nodeIP:
      validSubnets:
        - 192.168.1.0/24
  install:
    disk: ${install_disk}
    image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
    wipe: false
    grubUseUKICmdline: true
  disks:
%{ for disk in longhorn_disks ~}
    - device: ${disk.device}
      partitions:
        - mountpoint: ${disk.mountpoint}
%{ endfor ~}
  features:
    diskQuotaSupport: true
    kubePrism:
      enabled: true
      port: 7445
    hostDNS:
      enabled: false
  nodeLabels:
    node.kubernetes.io/exclude-from-external-load-balancers: ""
    topology.kubernetes.io/region: homelab
    topology.kubernetes.io/zone: ${zone}
%{ if !allow_scheduling ~}
  # Dedicated control plane — re-apply the control-plane taint that
  # allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
  # allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
  nodeTaints:
    node-role.kubernetes.io/control-plane: ":NoSchedule"
%{ endif ~}

cluster:
  id: ${cluster_id}
  secret: ${cluster_secret}
  controlPlane:
    endpoint: https://${controlplane_ip}:6443
  clusterName: ${cluster_name}
  # true removes the default control-plane taint from ALL CP nodes; dedicated
  # nodes (allow_scheduling=false) get it re-added via machine.nodeTaints above.
  allowSchedulingOnControlPlanes: true
  network:
    dnsDomain: ${dns_domain}
    podSubnets:
%{ for subnet in pod_subnets ~}
      - ${subnet}
%{ endfor ~}
    serviceSubnets:
%{ for subnet in service_subnets ~}
      - ${subnet}
%{ endfor ~}
    cni:
      name: none
  token: ${bootstrap_token}
  secretboxEncryptionSecret: ${secretbox_encryption_secret}
  ca:
    crt: ${kubernetes_ca_crt}
    key: ${kubernetes_ca_key}
  aggregatorCA:
    crt: ${aggregator_ca_crt}
    key: ${aggregator_ca_key}
  serviceAccount:
    key: ${service_account_key}
  apiServer:
    certSANs:
      - ${controlplane_ip}
%{ if wg0_ip != null ~}
      - ${wg0_ip}
%{ endif ~}
      - ${lan_ip}
%{ for san in cloudflare_apiserver_sans ~}
      - ${san}
%{ endfor ~}
    image: ${kube_apiserver_img}
    admissionControl:
      - name: PodSecurity
        configuration:
          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
          defaults:
            audit: restricted
            audit-version: latest
            enforce: baseline
            enforce-version: latest
            warn: restricted
            warn-version: latest
          exemptions:
            namespaces:
              - kube-system
            runtimeClasses: []
            usernames: []
          kind: PodSecurityConfiguration
    auditPolicy:
      apiVersion: audit.k8s.io/v1
      kind: Policy
      rules:
        - level: Metadata
  controllerManager:
    image: ${controller_mgr_img}
  proxy:
    image: ${kube_proxy_img}
    disabled: true
  scheduler:
    image: ${scheduler_img}
  discovery:
    enabled: true
    registries:
      kubernetes:
        disabled: true
      service: {}
  etcd:
    # Advertise/peer etcd on the LAN so all control planes can reach each other.
    # Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
    # LAN-only control planes can't route to — new members get stuck as learners.
    advertisedSubnets:
      - 192.168.1.0/24
    ca:
      crt: ${etcd_ca_crt}
      key: ${etcd_ca_key}
  extraManifests:
    - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
  inlineManifests:
    - name: cilium
      contents: |
        apiVersion: v1
        kind: Namespace
        metadata:
          name: kube-system