feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC

Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead. Add Terraform configuration for Talos cluster machine configs: - Provider setup for Talos - Centralized variables for CP and worker configs - Template-based config generation for controlplane.yaml and worker-*.yaml - Sensitive data separated in terraform.tfvars (gitignored) - Local state tracking for infrastructure
2026-08-18 15:08:01 -07:00
parent e48580adb9
commit 491e88e493
14 changed files with 831 additions and 876 deletions
@@ -0,0 +1,83 @@
+version: ${version}
+debug: false
+persist: true
+
+machine:
+  type: worker
+  token: ${token}
+  ca:
+    crt: ${ca_crt}
+    key: ""
+  certSANs: []
+  network:
+    hostname: ${hostname}
+    interfaces:
+      - interface: eno1
+        addresses:
+          - ${lan_ip}/24
+        routes:
+          - network: 0.0.0.0/0
+            gateway: ${lan_gateway}
+        dhcp: false
+    nameservers:
+      - ${cluster_dns_ip}
+      - 8.8.8.8
+      - 1.1.1.1
+  kubelet:
+    image: ${kubelet_image}
+    defaultRuntimeSeccompProfileEnabled: true
+    disableManifestsDirectory: true
+    extraArgs:
+      rotate-server-certificates: true
+  install:
+    disk: ${install_disk}
+    image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
+    wipe: true
+    grubUseUKICmdline: true
+  registries: {}
+  features:
+    diskQuotaSupport: true
+    kubePrism:
+      enabled: true
+      port: 7445
+    hostDNS:
+      enabled: true
+      forwardKubeDNSToHost: true
+  nodeLabels:
+%{ for k, v in node_labels ~}
+    ${k}: ${v}
+%{ endfor ~}
+
+cluster:
+  id: ${cluster_id}
+  secret: ${cluster_secret}
+  controlPlane:
+    endpoint: https://${controlplane_ip}:6443
+  clusterName: ${cluster_name}
+  network:
+    dnsDomain: ${dns_domain}
+    podSubnets:
+%{ for subnet in pod_subnets ~}
+      - ${subnet}
+%{ endfor ~}
+    serviceSubnets:
+%{ for subnet in service_subnets ~}
+      - ${subnet}
+%{ endfor ~}
+    cni:
+      name: none
+  token: ${bootstrap_token}
+  ca:
+    crt: ${kubernetes_ca_crt}
+    key: ""
+  discovery:
+    enabled: true
+    registries:
+      kubernetes:
+        disabled: true
+      service: {}
+  proxy:
+    disabled: true
+  extraManifests:
+    - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
+    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml