feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs

terraform/templates/controlplane.tftpl

@@ -10,7 +10,9 @@ machine:
     key: ${ca_key}
   certSANs:
     - ${lan_ip}
+%{ if wg0_ip != null ~}
     - ${wg0_ip}
+%{ endif ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -23,6 +25,7 @@ machine:
         dhcp: false
         dhcpOptions:
           ipv6: false
+%{ if wg0_ip != null ~}
       - interface: wg0
         addresses:
           - ${wg0_ip}/24
@@ -37,6 +40,8 @@ machine:
                 - ${ip}
 %{ endfor ~}
 %{ endfor ~}
+%{ endif ~}
+%{ if wg1_ip != null ~}
       - interface: wg1
         addresses:
           - ${wg1_ip}/24
@@ -52,6 +57,7 @@ machine:
 %{ endfor ~}
               persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
 %{ endfor ~}
+%{ endif ~}
     nameservers:
 %{ for ns in dns_servers ~}
       - ${ns}
@@ -92,7 +98,14 @@ machine:
   nodeLabels:
     node.kubernetes.io/exclude-from-external-load-balancers: ""
     topology.kubernetes.io/region: homelab
-    topology.kubernetes.io/zone: az-a
+    topology.kubernetes.io/zone: ${zone}
+%{ if !allow_scheduling ~}
+  # Dedicated control plane — re-apply the control-plane taint that
+  # allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
+  # allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
+  nodeTaints:
+    node-role.kubernetes.io/control-plane: ":NoSchedule"
+%{ endif ~}
 
 cluster:
   id: ${cluster_id}
@@ -100,6 +113,8 @@ cluster:
   controlPlane:
     endpoint: https://${controlplane_ip}:6443
   clusterName: ${cluster_name}
+  # true removes the default control-plane taint from ALL CP nodes; dedicated
+  # nodes (allow_scheduling=false) get it re-added via machine.nodeTaints above.
   allowSchedulingOnControlPlanes: true
   network:
     dnsDomain: ${dns_domain}
@@ -126,7 +141,10 @@ cluster:
   apiServer:
     certSANs:
       - ${controlplane_ip}
+%{ if wg0_ip != null ~}
       - ${wg0_ip}
+%{ endif ~}
+      - ${lan_ip}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity
@@ -164,6 +182,11 @@ cluster:
         disabled: true
       service: {}
   etcd:
+    # Advertise/peer etcd on the LAN so all control planes can reach each other.
+    # Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
+    # LAN-only control planes can't route to — new members get stuck as learners.
+    advertisedSubnets:
+      - 192.168.1.0/24
     ca:
       crt: ${etcd_ca_crt}
       key: ${etcd_ca_key}