talos/controlplane.yaml.j2
1
---
2
machine:
3
type: controlplane
4
ca:
5
crt: op://Kubernetes/talos/MACHINE_CA_CRT
6
key: op://Kubernetes/talos/MACHINE_CA_KEY
7
features:
8
kubernetesTalosAPIAccess:
9
enabled: true
10
allowedKubernetesNamespaces:
11
- actions-runner-system
12
- system-upgrade
13
allowedRoles:
14
- os:admin
15
cluster:
16
ca:
17
crt: op://Kubernetes/talos/CLUSTER_CA_CRT
18
key: op://Kubernetes/talos/CLUSTER_CA_KEY
19
aggregatorCA:
20
crt: op://Kubernetes/talos/CLUSTER_AGGREGATORCA_CRT
21
key: op://Kubernetes/talos/CLUSTER_AGGREGATORCA_KEY
22
etcd:
23
advertisedSubnets:
24
- 192.168.69.0/24
25
ca:
26
crt: op://Kubernetes/talos/CLUSTER_ETCD_CA_CRT
27
key: op://Kubernetes/talos/CLUSTER_ETCD_CA_KEY
28
extraArgs:
29
listen-metrics-urls: http://0.0.0.0:2381
30
serviceAccount:
31
key: op://Kubernetes/talos/CLUSTER_SERVICEACCOUNT_KEY
32
---
33
apiVersion: v1alpha1
34
kind: WatchdogTimerConfig
35
device: /dev/watchdog0
36
timeout: 5m0s
37
---
38
apiVersion: v1alpha1
39
kind: KubeNodeConfig
40
labels:
41
node-role.kubernetes.io/control-plane: ""
42
---
43
apiVersion: v1alpha1
44
kind: KubeAPIServerConfig
45
certExtraSANs:
46
- k8s.janpuc.com
47
extraArgs:
48
enable-aggregator-routing: "true"
49
feature-gates: HPAScaleToZero=true
50
image: registry.k8s.io/kube-apiserver:v1.36.3
51
resources:
52
requests:
53
cpu: 200m
54
memory: 1536Mi
55
limits:
56
memory: 3Gi
57
---
58
apiVersion: v1alpha1
59
kind: KubeAuditPolicyConfig
60
configuration:
61
apiVersion: audit.k8s.io/v1
62
kind: Policy
63
rules:
64
- level: Metadata
65
---
66
apiVersion: v1alpha1
67
kind: KubeAuthenticationConfig
68
configuration:
69
anonymous:
70
conditions:
71
- path: /livez
72
- path: /readyz
73
- path: /healthz
74
enabled: true
75
jwt: []
76
---
77
apiVersion: v1alpha1
78
kind: KubeAuthorizerConfig
79
name: node
80
type: Node
81
---
82
apiVersion: v1alpha1
83
kind: KubeAuthorizerConfig
84
name: rbac
85
type: RBAC
86
---
87
apiVersion: v1alpha1
88
kind: KubeControllerManagerConfig
89
extraArgs:
90
bind-address: 0.0.0.0
91
feature-gates: HPAScaleToZero=true
92
image: registry.k8s.io/kube-controller-manager:v1.36.3
93
resources:
94
requests:
95
cpu: 50m
96
memory: 256Mi
97
limits:
98
memory: 768Mi
99
---
100
apiVersion: v1alpha1
101
kind: KubeCoreDNSConfig
102
enabled: false
103
---
104
apiVersion: v1alpha1
105
kind: KubeEtcdEncryptionConfig
106
config:
107
resources:
108
- providers:
109
- secretbox:
110
keys:
111
- name: key2
112
secret: op://Kubernetes/talos/CLUSTER_SECRETBOXENCRYPTIONSECRET
113
- identity: {}
114
resources:
115
- secrets
116
---
117
apiVersion: v1alpha1
118
kind: KubeProxyConfig
119
enabled: false
120
image: registry.k8s.io/kube-proxy:v1.36.3
121
---
122
apiVersion: v1alpha1
123
kind: KubeSchedulerConfig
124
config:
125
profiles:
126
- schedulerName: default-scheduler
127
plugins:
128
score:
129
disabled:
130
- name: ImageLocality
131
pluginConfig:
132
- name: PodTopologySpread
133
args:
134
defaultingType: List
135
defaultConstraints:
136
- maxSkew: 1
137
topologyKey: kubernetes.io/hostname
138
whenUnsatisfiable: ScheduleAnyway
139
extraArgs:
140
bind-address: 0.0.0.0
141
image: registry.k8s.io/kube-scheduler:v1.36.3
142
resources:
143
requests:
144
cpu: 10m
145
memory: 64Mi
146
limits:
147
memory: 256Mi