fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes

terraform/main.tf

@@ -11,7 +11,8 @@ locals {
   kube_proxy_img     = "registry.k8s.io/kube-proxy:${var.kubernetes_version}"
   scheduler_img      = "registry.k8s.io/kube-scheduler:${var.kubernetes_version}"
 
-  factory_image = "factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${var.talos_version}"
+  # Use Image Factory generated URL with Longhorn extensions (iscsi-tools, util-linux-tools)
+  factory_image = data.talos_image_factory_urls.longhorn_installer.urls.installer
 }
 
 # Control plane machine configurations
@@ -29,16 +30,6 @@ resource "local_file" "controlplane_configs" {
     lan_ip              = each.value.lan_ip
     lan_subnet          = each.value.lan_subnet
     lan_gateway         = each.value.lan_gateway
-    wg0_ip              = each.value.wg0_ip
-    wg0_subnet          = each.value.wg0_subnet
-    wg0_port            = each.value.wg0_port
-    wg0_private_key     = each.value.wg0_private_key
-    wg0_peers           = each.value.wg0_peers
-    wg1_ip              = each.value.wg1_ip
-    wg1_subnet          = each.value.wg1_subnet
-    wg1_port            = each.value.wg1_port
-    wg1_private_key     = each.value.wg1_private_key
-    wg1_peers           = each.value.wg1_peers
     kubelet_image       = local.kubelet_image
     cluster_dns_ip      = local.cluster_dns_ip
     install_disk        = each.value.install_disk

terraform/talos_schematic.tf

@@ -0,0 +1,31 @@
+# Talos Image Factory schematic with Longhorn dependencies
+resource "talos_image_factory_schematic" "longhorn" {
+  schematic = jsonencode({
+    customization = {
+      systemExtensions = {
+        officialExtensions = [
+          "siderolabs/iscsi-tools",
+          "siderolabs/util-linux-tools",
+        ]
+      }
+    }
+  })
+}
+
+# Generate installer image URL for the schematic
+data "talos_image_factory_urls" "longhorn_installer" {
+  talos_version = var.talos_version
+  schematic_id  = talos_image_factory_schematic.longhorn.id
+  platform      = "metal"
+}
+
+# Output the schematic ID and installer URL for reference
+output "talos_schematic_id" {
+  value       = talos_image_factory_schematic.longhorn.id
+  description = "Talos Image Factory schematic ID with Longhorn dependencies"
+}
+
+output "talos_installer_url" {
+  value       = data.talos_image_factory_urls.longhorn_installer.urls.installer
+  description = "Talos installer image URL with iscsi-tools and util-linux-tools"
+}

terraform/templates/controlplane.tftpl

@@ -10,9 +10,6 @@ machine:
     key: ${ca_key}
   certSANs:
     - ${lan_ip}
-%{ if wg0_ip != null ~}
-    - ${wg0_ip}
-%{ endif ~}
 %{ for san in cloudflare_talos_sans ~}
     - ${san}
 %{ endfor ~}
@@ -28,39 +25,6 @@ machine:
         dhcp: false
         dhcpOptions:
           ipv6: false
-%{ if wg0_ip != null ~}
-      - interface: wg0
-        addresses:
-          - ${wg0_ip}/24
-        wireguard:
-          privateKey: "${wg0_private_key}"
-          listenPort: ${wg0_port}
-          peers:
-%{ for peer in wg0_peers ~}
-            - publicKey: "${peer.public_key}"
-              allowedIPs:
-%{ for ip in peer.allowed_ips ~}
-                - ${ip}
-%{ endfor ~}
-%{ endfor ~}
-%{ endif ~}
-%{ if wg1_ip != null ~}
-      - interface: wg1
-        addresses:
-          - ${wg1_ip}/24
-        wireguard:
-          privateKey: "${wg1_private_key}"
-          listenPort: ${wg1_port}
-          peers:
-%{ for peer in wg1_peers ~}
-            - publicKey: "${peer.public_key}"
-              allowedIPs:
-%{ for ip in peer.allowed_ips ~}
-                - ${ip}
-%{ endfor ~}
-              persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
-%{ endfor ~}
-%{ endif ~}
     nameservers:
 %{ for ns in dns_servers ~}
       - ${ns}
@@ -104,8 +68,7 @@ machine:
     topology.kubernetes.io/zone: ${zone}
 %{ if !allow_scheduling ~}
   # Dedicated control plane — re-apply the control-plane taint that
-  # allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
-  # allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
+  # allowSchedulingOnControlPlanes=true removed cluster-wide.
   nodeTaints:
     node-role.kubernetes.io/control-plane: ":NoSchedule"
 %{ endif ~}
@@ -144,9 +107,6 @@ cluster:
   apiServer:
     certSANs:
       - ${controlplane_ip}
-%{ if wg0_ip != null ~}
-      - ${wg0_ip}
-%{ endif ~}
       - ${lan_ip}
 %{ for san in cloudflare_apiserver_sans ~}
       - ${san}
@@ -188,9 +148,7 @@ cluster:
         disabled: true
       service: {}
   etcd:
-    # Advertise/peer etcd on the LAN so all control planes can reach each other.
-    # Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
-    # LAN-only control planes can't route to — new members get stuck as learners.
+    # Pin etcd peer/advertise addresses to the LAN subnet explicitly.
     advertisedSubnets:
       - 192.168.1.0/24
     ca:

terraform/variables.tf

@@ -102,27 +102,10 @@ variable "secretbox_encryption_secret" {
 
 variable "controlplane_configs" {
   type = map(object({
-    hostname        = string
-    lan_ip          = string
-    lan_subnet      = string
-    lan_gateway     = string
-    wg0_ip          = optional(string)
-    wg0_subnet      = optional(string)
-    wg0_port        = optional(number)
-    wg0_private_key = optional(string)
-    wg0_peers = optional(list(object({
-      public_key  = string
-      allowed_ips = list(string)
-    })), [])
-    wg1_ip          = optional(string)
-    wg1_subnet      = optional(string)
-    wg1_port        = optional(number)
-    wg1_private_key = optional(string)
-    wg1_peers = optional(list(object({
-      public_key                = string
-      allowed_ips               = list(string)
-      persistent_keepalive_secs = number
-    })), [])
+    hostname     = string
+    lan_ip       = string
+    lan_subnet   = string
+    lan_gateway  = string
     install_disk = string
     longhorn_disks = list(object({
       device     = string