Story Crater Bot
491e88e493
Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead. Add Terraform configuration for Talos cluster machine configs: - Provider setup for Talos - Centralized variables for CP and worker configs - Template-based config generation for controlplane.yaml and worker-*.yaml - Sensitive data separated in terraform.tfvars (gitignored) - Local state tracking for infrastructure
84 lines
1.8 KiB
Plaintext
84 lines
1.8 KiB
Plaintext
version: ${version}
|
|
debug: false
|
|
persist: true
|
|
|
|
machine:
|
|
type: worker
|
|
token: ${token}
|
|
ca:
|
|
crt: ${ca_crt}
|
|
key: ""
|
|
certSANs: []
|
|
network:
|
|
hostname: ${hostname}
|
|
interfaces:
|
|
- interface: eno1
|
|
addresses:
|
|
- ${lan_ip}/24
|
|
routes:
|
|
- network: 0.0.0.0/0
|
|
gateway: ${lan_gateway}
|
|
dhcp: false
|
|
nameservers:
|
|
- ${cluster_dns_ip}
|
|
- 8.8.8.8
|
|
- 1.1.1.1
|
|
kubelet:
|
|
image: ${kubelet_image}
|
|
defaultRuntimeSeccompProfileEnabled: true
|
|
disableManifestsDirectory: true
|
|
extraArgs:
|
|
rotate-server-certificates: true
|
|
install:
|
|
disk: ${install_disk}
|
|
image: factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${talos_version}
|
|
wipe: true
|
|
grubUseUKICmdline: true
|
|
registries: {}
|
|
features:
|
|
diskQuotaSupport: true
|
|
kubePrism:
|
|
enabled: true
|
|
port: 7445
|
|
hostDNS:
|
|
enabled: true
|
|
forwardKubeDNSToHost: true
|
|
nodeLabels:
|
|
%{ for k, v in node_labels ~}
|
|
${k}: ${v}
|
|
%{ endfor ~}
|
|
|
|
cluster:
|
|
id: ${cluster_id}
|
|
secret: ${cluster_secret}
|
|
controlPlane:
|
|
endpoint: https://${controlplane_ip}:6443
|
|
clusterName: ${cluster_name}
|
|
network:
|
|
dnsDomain: ${dns_domain}
|
|
podSubnets:
|
|
%{ for subnet in pod_subnets ~}
|
|
- ${subnet}
|
|
%{ endfor ~}
|
|
serviceSubnets:
|
|
%{ for subnet in service_subnets ~}
|
|
- ${subnet}
|
|
%{ endfor ~}
|
|
cni:
|
|
name: none
|
|
token: ${bootstrap_token}
|
|
ca:
|
|
crt: ${kubernetes_ca_crt}
|
|
key: ""
|
|
discovery:
|
|
enabled: true
|
|
registries:
|
|
kubernetes:
|
|
disabled: true
|
|
service: {}
|
|
proxy:
|
|
disabled: true
|
|
extraManifests:
|
|
- https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
|
|
- https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
|