feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs

terraform/templates/controlplane.tftpl

@@ -10,7 +10,9 @@ machine:
     key: ${ca_key}
   certSANs:
     - ${lan_ip}
+%{ if wg0_ip != null ~}
     - ${wg0_ip}
+%{ endif ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -23,6 +25,7 @@ machine:
         dhcp: false
         dhcpOptions:
           ipv6: false
+%{ if wg0_ip != null ~}
       - interface: wg0
         addresses:
           - ${wg0_ip}/24
@@ -37,6 +40,8 @@ machine:
                 - ${ip}
 %{ endfor ~}
 %{ endfor ~}
+%{ endif ~}
+%{ if wg1_ip != null ~}
       - interface: wg1
         addresses:
           - ${wg1_ip}/24
@@ -52,6 +57,7 @@ machine:
 %{ endfor ~}
               persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
 %{ endfor ~}
+%{ endif ~}
     nameservers:
 %{ for ns in dns_servers ~}
       - ${ns}
@@ -92,7 +98,14 @@ machine:
   nodeLabels:
     node.kubernetes.io/exclude-from-external-load-balancers: ""
     topology.kubernetes.io/region: homelab
-    topology.kubernetes.io/zone: az-a
+    topology.kubernetes.io/zone: ${zone}
+%{ if !allow_scheduling ~}
+  # Dedicated control plane — re-apply the control-plane taint that
+  # allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
+  # allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
+  nodeTaints:
+    node-role.kubernetes.io/control-plane: ":NoSchedule"
+%{ endif ~}
 
 cluster:
   id: ${cluster_id}
@@ -100,6 +113,8 @@ cluster:
   controlPlane:
     endpoint: https://${controlplane_ip}:6443
   clusterName: ${cluster_name}
+  # true removes the default control-plane taint from ALL CP nodes; dedicated
+  # nodes (allow_scheduling=false) get it re-added via machine.nodeTaints above.
   allowSchedulingOnControlPlanes: true
   network:
     dnsDomain: ${dns_domain}
@@ -126,7 +141,10 @@ cluster:
   apiServer:
     certSANs:
       - ${controlplane_ip}
+%{ if wg0_ip != null ~}
       - ${wg0_ip}
+%{ endif ~}
+      - ${lan_ip}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity
@@ -164,6 +182,11 @@ cluster:
         disabled: true
       service: {}
   etcd:
+    # Advertise/peer etcd on the LAN so all control planes can reach each other.
+    # Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
+    # LAN-only control planes can't route to — new members get stuck as learners.
+    advertisedSubnets:
+      - 192.168.1.0/24
     ca:
       crt: ${etcd_ca_crt}
       key: ${etcd_ca_key}

terraform/templates/worker.tftpl

@@ -1,83 +0,0 @@
-version: ${version}
-debug: false
-persist: true
-
-machine:
-  type: worker
-  token: ${token}
-  ca:
-    crt: ${ca_crt}
-    key: ""
-  certSANs: []
-  network:
-    hostname: ${hostname}
-    interfaces:
-      - interface: eno1
-        addresses:
-          - ${lan_ip}/24
-        routes:
-          - network: 0.0.0.0/0
-            gateway: ${lan_gateway}
-        dhcp: false
-    nameservers:
-      - ${cluster_dns_ip}
-      - 8.8.8.8
-      - 1.1.1.1
-  kubelet:
-    image: ${kubelet_image}
-    defaultRuntimeSeccompProfileEnabled: true
-    disableManifestsDirectory: true
-    extraArgs:
-      rotate-server-certificates: true
-  install:
-    disk: ${install_disk}
-    image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
-    wipe: true
-    grubUseUKICmdline: true
-  registries: {}
-  features:
-    diskQuotaSupport: true
-    kubePrism:
-      enabled: true
-      port: 7445
-    hostDNS:
-      enabled: true
-      forwardKubeDNSToHost: true
-  nodeLabels:
-%{ for k, v in node_labels ~}
-    ${k}: ${v}
-%{ endfor ~}
-
-cluster:
-  id: ${cluster_id}
-  secret: ${cluster_secret}
-  controlPlane:
-    endpoint: https://${controlplane_ip}:6443
-  clusterName: ${cluster_name}
-  network:
-    dnsDomain: ${dns_domain}
-    podSubnets:
-%{ for subnet in pod_subnets ~}
-      - ${subnet}
-%{ endfor ~}
-    serviceSubnets:
-%{ for subnet in service_subnets ~}
-      - ${subnet}
-%{ endfor ~}
-    cni:
-      name: none
-  token: ${bootstrap_token}
-  ca:
-    crt: ${kubernetes_ca_crt}
-    key: ""
-  discovery:
-    enabled: true
-    registries:
-      kubernetes:
-        disabled: true
-      service: {}
-  proxy:
-    disabled: true
-  extraManifests:
-    - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
-    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml