rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs

Browse Source
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:02 -07:00
parent 9956379f5f
commit 5b34e71111
24 changed files with 75 additions and 1226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/main.tf
+26 -66
View File
@@ -14,38 +14,42 @@ locals {
factory_image = "factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${var.talos_version}"
}
# Control plane machine configuration
resource "local_file" "controlplane_config" {
filename = "${path.module}/../cluster-config/controlplane.yaml"
# Control plane machine configurations
resource "local_file" "controlplane_configs" {
for_each = var.controlplane_configs
filename = "${path.module}/../cluster-config/${each.key}.yaml"
content = templatefile("${path.module}/templates/controlplane.tftpl", {
version = "v1alpha1"
hostname = var.controlplane_config.hostname
hostname = each.value.hostname
token = var.machine_token
ca_crt = var.machine_ca_crt
ca_key = var.machine_ca_key
lan_ip = var.controlplane_config.lan_ip
lan_subnet = var.controlplane_config.lan_subnet
lan_gateway = var.controlplane_config.lan_gateway
wg0_ip = var.controlplane_config.wg0_ip
wg0_subnet = var.controlplane_config.wg0_subnet
wg0_port = var.controlplane_config.wg0_port
wg0_private_key = var.controlplane_config.wg0_private_key
wg0_peers = var.controlplane_config.wg0_peers
wg1_ip = var.controlplane_config.wg1_ip
wg1_subnet = var.controlplane_config.wg1_subnet
wg1_port = var.controlplane_config.wg1_port
wg1_private_key = var.controlplane_config.wg1_private_key
wg1_peers = var.controlplane_config.wg1_peers
lan_ip = each.value.lan_ip
lan_subnet = each.value.lan_subnet
lan_gateway = each.value.lan_gateway
wg0_ip = each.value.wg0_ip
wg0_subnet = each.value.wg0_subnet
wg0_port = each.value.wg0_port
wg0_private_key = each.value.wg0_private_key
wg0_peers = each.value.wg0_peers
wg1_ip = each.value.wg1_ip
wg1_subnet = each.value.wg1_subnet
wg1_port = each.value.wg1_port
wg1_private_key = each.value.wg1_private_key
wg1_peers = each.value.wg1_peers
kubelet_image = local.kubelet_image
cluster_dns_ip = local.cluster_dns_ip
install_disk = var.controlplane_config.install_disk
install_disk = each.value.install_disk
factory_image = local.factory_image
talos_version = var.talos_version
longhorn_disks = var.controlplane_config.longhorn_disks
longhorn_disks = each.value.longhorn_disks
dns_servers = var.cluster_config.dns_servers
forgejo_registry_ip = var.forgejo_registry_ip
forgejo_hostname = var.forgejo_hostname
zone = each.value.zone
allow_scheduling = each.value.allow_scheduling
# Cluster config
cluster_id = var.cluster_id
@@ -75,54 +79,10 @@ resource "local_file" "controlplane_config" {
})
}
# Worker machine configurations
resource "local_file" "worker_configs" {
for_each = var.worker_configs
filename = "${path.module}/../cluster-config/${each.key}.yaml"
content = templatefile("${path.module}/templates/worker.tftpl", {
version = "v1alpha1"
hostname = each.value.hostname
token = var.machine_token
ca_crt = var.machine_ca_crt
lan_ip = each.value.lan_ip
lan_subnet = each.value.lan_subnet
lan_gateway = each.value.lan_gateway
kubelet_image = local.kubelet_image
cluster_dns_ip = local.cluster_dns_ip
install_disk = each.value.install_disk
factory_image = local.factory_image
talos_version = var.talos_version
node_labels = each.value.node_labels
# Cluster config
cluster_id = var.cluster_id
cluster_secret = var.cluster_secret
controlplane_ip = local.controlplane_ip
cluster_name = var.cluster_name
pod_subnets = var.cluster_config.pod_subnets
service_subnets = var.cluster_config.service_subnets
dns_domain = var.cluster_config.dns_domain
bootstrap_token = var.bootstrap_token
# Kubernetes certs
kubernetes_ca_crt = var.kubernetes_ca_crt
# Component images
kube_proxy_img = local.kube_proxy_img
})
}
# Output paths for reference
output "controlplane_config_path" {
value = local_file.controlplane_config.filename
description = "Path to generated controlplane config"
}
output "worker_config_paths" {
output "controlplane_config_paths" {
value = {
for k, v in local_file.worker_configs : k => v.filename
for k, v in local_file.controlplane_configs : k => v.filename
}
description = "Paths to generated worker configs"
description = "Paths to generated controlplane configs"
}
terraform/templates/controlplane.tftpl
+24 -1
View File
@@ -10,7 +10,9 @@ machine:
key: ${ca_key}
certSANs:
- ${lan_ip}
%{ if wg0_ip != null ~}
- ${wg0_ip}
%{ endif ~}
network:
hostname: ${hostname}
interfaces:
@@ -23,6 +25,7 @@ machine:
dhcp: false
dhcpOptions:
ipv6: false
%{ if wg0_ip != null ~}
- interface: wg0
addresses:
- ${wg0_ip}/24
@@ -37,6 +40,8 @@ machine:
- ${ip}
%{ endfor ~}
%{ endfor ~}
%{ endif ~}
%{ if wg1_ip != null ~}
- interface: wg1
addresses:
- ${wg1_ip}/24
@@ -52,6 +57,7 @@ machine:
%{ endfor ~}
persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
%{ endfor ~}
%{ endif ~}
nameservers:
%{ for ns in dns_servers ~}
- ${ns}
@@ -92,7 +98,14 @@ machine:
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
topology.kubernetes.io/region: homelab
topology.kubernetes.io/zone: az-a
topology.kubernetes.io/zone: ${zone}
%{ if !allow_scheduling ~}
# Dedicated control plane — re-apply the control-plane taint that
# allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
# allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
nodeTaints:
node-role.kubernetes.io/control-plane: ":NoSchedule"
%{ endif ~}
cluster:
id: ${cluster_id}
@@ -100,6 +113,8 @@ cluster:
controlPlane:
endpoint: https://${controlplane_ip}:6443
clusterName: ${cluster_name}
# true removes the default control-plane taint from ALL CP nodes; dedicated
# nodes (allow_scheduling=false) get it re-added via machine.nodeTaints above.
allowSchedulingOnControlPlanes: true
network:
dnsDomain: ${dns_domain}
@@ -126,7 +141,10 @@ cluster:
apiServer:
certSANs:
- ${controlplane_ip}
%{ if wg0_ip != null ~}
- ${wg0_ip}
%{ endif ~}
- ${lan_ip}
image: ${kube_apiserver_img}
admissionControl:
- name: PodSecurity
@@ -164,6 +182,11 @@ cluster:
disabled: true
service: {}
etcd:
# Advertise/peer etcd on the LAN so all control planes can reach each other.
# Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
# LAN-only control planes can't route to — new members get stuck as learners.
advertisedSubnets:
- 192.168.1.0/24
ca:
crt: ${etcd_ca_crt}
key: ${etcd_ca_key}
terraform/templates/worker.tftpl
-83
View File
@@ -1,83 +0,0 @@
version: ${version}
debug: false
persist: true
machine:
type: worker
token: ${token}
ca:
crt: ${ca_crt}
key: ""
certSANs: []
network:
hostname: ${hostname}
interfaces:
- interface: eno1
addresses:
- ${lan_ip}/24
routes:
- network: 0.0.0.0/0
gateway: ${lan_gateway}
dhcp: false
nameservers:
- ${cluster_dns_ip}
- 8.8.8.8
- 1.1.1.1
kubelet:
image: ${kubelet_image}
defaultRuntimeSeccompProfileEnabled: true
disableManifestsDirectory: true
extraArgs:
rotate-server-certificates: true
install:
disk: ${install_disk}
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
wipe: true
grubUseUKICmdline: true
registries: {}
features:
diskQuotaSupport: true
kubePrism:
enabled: true
port: 7445
hostDNS:
enabled: true
forwardKubeDNSToHost: true
nodeLabels:
%{ for k, v in node_labels ~}
${k}: ${v}
%{ endfor ~}
cluster:
id: ${cluster_id}
secret: ${cluster_secret}
controlPlane:
endpoint: https://${controlplane_ip}:6443
clusterName: ${cluster_name}
network:
dnsDomain: ${dns_domain}
podSubnets:
%{ for subnet in pod_subnets ~}
- ${subnet}
%{ endfor ~}
serviceSubnets:
%{ for subnet in service_subnets ~}
- ${subnet}
%{ endfor ~}
cni:
name: none
token: ${bootstrap_token}
ca:
crt: ${kubernetes_ca_crt}
key: ""
discovery:
enabled: true
registries:
kubernetes:
disabled: true
service: {}
proxy:
disabled: true
extraManifests:
- https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
- https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
terraform/variables.tf
+22 -32
View File
@@ -100,48 +100,38 @@ variable "secretbox_encryption_secret" {
description = "Secretbox encryption secret (base64 encoded)"
}
variable "controlplane_config" {
type = object({
hostname = string
lan_ip = string
lan_subnet = string
lan_gateway = string
wg0_ip = string
wg0_subnet = string
wg0_port = number
wg0_peers = list(object({
variable "controlplane_configs" {
type = map(object({
hostname = string
lan_ip = string
lan_subnet = string
lan_gateway = string
wg0_ip = optional(string)
wg0_subnet = optional(string)
wg0_port = optional(number)
wg0_private_key = optional(string)
wg0_peers = optional(list(object({
public_key = string
allowed_ips = list(string)
}))
wg1_ip = string
wg1_subnet = string
wg1_port = number
wg1_peers = list(object({
})), [])
wg1_ip = optional(string)
wg1_subnet = optional(string)
wg1_port = optional(number)
wg1_private_key = optional(string)
wg1_peers = optional(list(object({
public_key = string
allowed_ips = list(string)
persistent_keepalive_secs = number
}))
wg0_private_key = string
wg1_private_key = string
install_disk = string
})), [])
install_disk = string
longhorn_disks = list(object({
device = string
mountpoint = string
}))
})
description = "Control plane machine configuration"
}
variable "worker_configs" {
type = map(object({
hostname = string
lan_ip = string
lan_subnet = string
lan_gateway = string
install_disk = string
node_labels = map(string)
zone = string
allow_scheduling = bool
}))
description = "Worker machine configurations"
description = "Control plane machine configurations, keyed by node"
}
variable "cluster_config" {