integrate clustertool sourcecode

2024-10-16 14:06:31 +02:00
parent bc2a642e7a
commit 6365c6205f
265 changed files with 24073 additions and 45 deletions
@@ -0,0 +1,100 @@
+- op: replace
+  path: /machine/time
+  value:
+    "disabled": false
+    "servers":
+      - "time.cloudflare.com"
+- op: add
+  path: /machine/kernel
+  value:
+    modules:
+     - "name": "dm_thin_pool"
+     - "name": "dm_mod"
+     - "name": nvme_tcp
+     - "name": vfio_pci
+     - "name": uio_pci_generic
+- op: replace
+  path: /cluster/proxy
+  value:
+    "disabled": true
+- op: add
+  path: /machine/kubelet/extraArgs
+  value:
+    "rotate-server-certificates": true
+- op: add
+  path: /machine/kubelet/extraConfig
+  value:
+    "maxPods": 250
+    "shutdownGracePeriod": "15s"
+    "shutdownGracePeriodCriticalPods": "10s"
+- op: add
+  path: /machine/kubelet/extraMounts
+  value:
+    - "destination": "/var/openebs/local"
+      "type": "bind"
+      "source": "/var/openebs/local"
+      "options":
+        - "bind"
+        - "rshared"
+        - "rw"
+    - destination: /var/lib/longhorn
+      type: bind
+      source: /var/lib/longhorn
+      options:
+        - bind
+        - rshared
+        - rw
+- op: replace
+  path: /machine/features/hostDNS
+  value:
+    enabled: true
+    resolveMemberNames: true
+    forwardKubeDNSToHost: false
+- op: add
+  path: /machine/sysctls
+  value:
+    fs.inotify.max_queued_events: "65536"
+    fs.inotify.max_user_instances: "8192"
+    fs.inotify.max_user_watches: "524288"
+    net.core.rmem_max: "2500000"
+    net.core.wmem_max: "2500000"
+    vm.nr_hugepages: "2048"
+
+## TODO: Check how we can have this pass checks
+# - op: add
+#   path: /machine/udev
+#   value:
+#     # Thunderbolt
+#     - ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1"
+#     # Intel GPU
+#     - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
+#     # Google Coral USB Accelerator
+#     - SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a6e", ATTRS{idProduct}=="089a", GROUP="20", MODE="0660"
+#     - SUBSYSTEMS=="usb", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="9302", GROUP="20", MODE="0660"
+
+- op: add
+  path: /machine/files
+  value:
+    - content: |
+        [plugins."io.containerd.grpc.v1.cri"]
+          enable_unprivileged_ports = true
+          enable_unprivileged_icmp = true
+        [plugins."io.containerd.grpc.v1.cri".containerd]
+          discard_unpacked_layers = false
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+          discard_unpacked_layers = false
+      permissions: 0
+      path: /etc/cri/conf.d/20-customization.part
+      op: create
+    - content: |
+        [ NFSMount_Global_Options ]
+        nfsvers=4.2
+        hard=True
+        noatime=True
+        nodiratime=True
+        rsize=131072
+        wsize=131072
+        nconnect=8
+      permissions: 420
+      path: /etc/nfsmount.conf
+      op: overwrite
@@ -0,0 +1,50 @@
+- op: add
+  path: /cluster/proxy/extraArgs
+  value:
+    "metrics-bind-address": "0.0.0.0:10249"
+- op: add
+  path: /cluster/controllerManager/extraArgs
+  value:
+    "bind-address": "0.0.0.0"
+
+- op: add
+  path: /cluster/scheduler/extraArgs
+  value:
+    "bind-address": "0.0.0.0"
+- op: replace
+  path: /cluster/apiServer/admissionControl
+  value:
+      - name: PodSecurity
+        configuration:
+          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
+          defaults:
+            audit: restricted
+            audit-version: latest
+            enforce: baseline
+            enforce-version: latest
+            warn: restricted
+            warn-version: latest
+          exemptions:
+            namespaces:
+              - kube-system
+              - metallb
+              - metallb-config
+              - topolvm-system
+              - longhorn-system
+              - kyverno
+              - system-upgrade
+              - openebs
+              - snapshot-controller
+              - volsync
+              - flux-system
+            runtimeClasses: []
+            usernames: []
+          kind: PodSecurityConfiguration
+- op: add
+  path: /machine/features/kubernetesTalosAPIAccess
+  value:
+    enabled: true
+    allowedRoles:
+      - os:admin
+    allowedKubernetesNamespaces:
+      - system-upgrade
@@ -0,0 +1,6 @@
+- op: replace
+  path: /machine/time
+  value:
+    "disabled": false
+    "servers":
+      - "time.cloudflare.com"
@@ -0,0 +1,40 @@
+- op: add
+  path: /cluster/inlineManifests
+  value:
+    - name: flux-system
+      contents: |-
+        apiVersion: v1
+        kind: Namespace
+        metadata:
+          name: flux-system
+    - name: sops-age
+      contents: |-
+        apiVersion: v1
+        stringData:
+          age.agekey: REPLACEWITHSOPS
+        kind: Secret
+        metadata:
+          creationTimestamp: null
+          name: sops-age
+          namespace: flux-system
+    - name: cluster-config
+      contents: |-
+        apiVersion: v1
+        kind: ConfigMap
+        metadata:
+          creationTimestamp: null
+          name: cluster-config
+          namespace: flux-system
+        data:
+REPLACEWITHTALENV
+    - name: deploy-key
+      contents: |-
+        apiVersion: v1
+        kind: ConfigMap
+        metadata:
+          creationTimestamp: null
+          name: deploy-key
+          namespace: flux-system
+        stringData:
+REPLACEWITHDEPLOYKEY
+            
@@ -0,0 +1,6 @@
+- op: replace
+  path: /machine/time
+  value:
+    "disabled": false
+    "servers":
+      - "time.cloudflare.com"