Skip to content

Commit a69af19

Browse files
neoaggelosneoaggelos
authored
Add cluster template and documentation for Talos (#195)
Signed-off-by: Angelos Kolaitis <neoaggelos@gmail.com>
1 parent 4965620 commit a69af19

5 files changed

Lines changed: 300 additions & 0 deletions

File tree

‎docs/book/src/SUMMARY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
- [Kube VIP](./reference/templates/kube-vip.md)
2323
- [OVN Load Balancer](./reference/templates/ovn.md)
2424
- [Ubuntu](./reference/templates/ubuntu.md)
25+
- [Talos](./reference/templates/talos.md)
2526

2627
---
2728

‎docs/book/src/reference/api/v1alpha2/api.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -730,6 +730,19 @@ LXCLoadBalancerMachineSpec
730730
</tr>
731731
<tr>
732732
<td>
733+
<code>disableHealthzCheck</code><br/>
734+
<em>
735+
bool
736+
</em>
737+
</td>
738+
<td>
739+
<em>(Optional)</em>
740+
<p>DisableHealthzCheck allows disabling the HAProxy /healthz check on kube-apiserver endpoints.</p>
741+
<p>This is useful in scenarios where anonymous-auth=true is set on the kube-apiserver, in which case the haproxy check will always fail.</p>
742+
</td>
743+
</tr>
744+
<tr>
745+
<td>
733746
<code>customHAProxyConfigTemplate</code><br/>
734747
<em>
735748
string
@@ -1411,6 +1424,19 @@ bool
14111424
</tr>
14121425
<tr>
14131426
<td>
1427+
<code>cloudProviderNodePatchConfigured</code><br/>
1428+
<em>
1429+
bool
1430+
</em>
1431+
</td>
1432+
<td>
1433+
<em>(Optional)</em>
1434+
<p>CloudProviderNodePatchConfigured will be set to true once for each node, after the cloud provider node patch is applied.</p>
1435+
<p>Note that this field is only set when LXCCluster.spec.cloudProviderNodePatch is true.</p>
1436+
</td>
1437+
</tr>
1438+
<tr>
1439+
<td>
14141440
<code>addresses</code><br/>
14151441
<em>
14161442
<a href="https://doc.crds.dev/github.com/kubernetes-sigs/cluster-api@v1.10.9">

‎docs/book/src/reference/templates/talos.md‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Talos cluster template
2+
3+
The talos cluster template will create a cluster using [Talos Control Plane](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) provider.
4+
5+
A container running a haproxy server is used for the cluster load balancer endpoint. The load balancer endpoint will be the IP address of the haproxy container.
6+
7+
> **WARNING**: The load balancer container is a single point of failure for the control plane of the workload cluster, therefore should only be used for development or evaluation purposes. For production grade clusters, you should instead use a different option for the load balancer, e.g. [OVN](./ovn.md)
8+
9+
> **WARNING**: This cluster template is not currently tested in CI, therefore could be broken. Please raise a [GitHub issue](https://github.com/lxc/cluster-api-provider-incus/issues) if that is the case.
10+
11+
## Table Of Contents
12+
13+
<!-- toc -->
14+
15+
## Requirements
16+
17+
### 1. CAPN version
18+
19+
Talos cluster templates require CAPN version `v0.8.5` or newer.
20+
21+
### 2. Install Talos control plane and bootstrap providers on the cluster
22+
23+
```bash
24+
clusterctl init -c talos -b talos
25+
```
26+
27+
**Tested Versions**:
28+
- [cluster-api-control-plane-provider-talos v0.5.12](https://github.com/siderolabs/cluster-api-control-plane-provider-talos/releases/tag/v0.5.12)
29+
- [cluster-api-bootstrap-provider-talos v0.6.11](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos/releases/tag/v0.6.11)
30+
- [talos linux version v1.12.2](https://docs.siderolabs.com/talos/v1.12/overview/what-is-talos)
31+
32+
### 3. Import Talos nocloud server image into Incus
33+
34+
Start from [https://factory.talos.dev/](https://factory.talos.dev/)
35+
- Select **Cloud Server**
36+
- Select **Talos Linux Version** (v1.12.2)
37+
- Select **nocloud** variant
38+
- Select **Machine architecture** (amd64)
39+
- Select **Secure Boot** (true or false)
40+
- Select optional **System Extensions** (none required)
41+
- Select **Bootloader** (auto)
42+
- Select **BIOS Only** boot (**NOTE**: UEFI boot seems to not work correctly)
43+
44+
{{#tabs name:"image-configuration" tabs:"SecureBoot disabled,SecureBoot enabled" }}
45+
46+
{{#tab SecureBoot disabled }}
47+
48+
[Example configuration with SecureBoot disabled](https://factory.talos.dev/?arch=amd64&bootloader=auto&cmdline-set=true&extensions=-&platform=nocloud&target=cloud&version=1.12.2)
49+
50+
```bash
51+
# 1. download nocloud-amd64.raw.xz, extract and convert to "rootfs.qcow2"
52+
curl -L "https://factory.talos.dev/image/9ed5fecdacb36b5c5427b87d409f1065cfb2df69b0f71c58b868d9d466d8dab3/v1.12.2/nocloud-amd64.raw.xz" -o nocloud-amd64.raw.xz
53+
unxz nocloud-amd64.raw.xz
54+
qemu-img convert -f raw -O qcow2 nocloud-amd64.raw rootfs.qcow2
55+
```
56+
57+
{{#/tab }}
58+
59+
{{#tab SecureBoot enabled }}
60+
61+
> **WARNING**: Avoid SecureBoot enabled images if unsure of how they work.
62+
63+
[Example configuration with SecureBoot enabled](https://factory.talos.dev/?arch=amd64&bootloader=auto&cmdline-set=true&extensions=-&platform=nocloud&secureboot=true&target=cloud&version=1.12.2)
64+
65+
```bash
66+
# 1. download nocloud-amd64-secureboot.raw.xz, extract and convert to "rootfs.qcow2"
67+
curl -L "https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v1.12.2/nocloud-amd64-secureboot.raw.xz" -o nocloud-amd64-secureboot.raw.xz
68+
unxz nocloud-amd64-secureboot.raw.xz
69+
qemu-img convert -f raw -O qcow2 nocloud-amd64-secureboot.raw rootfs.qcow2
70+
```
71+
72+
{{#/tab }}
73+
74+
{{#/tabs }}
75+
76+
```bash
77+
# 2. generate image metadata tarball "metadata.tar.gz"
78+
SERIAL="$(date '+%s')"
79+
VERSION=v1.12.2
80+
echo "
81+
architecture: amd64
82+
creation_date: $SERIAL
83+
expiry_date: 0
84+
properties:
85+
architecture: amd64
86+
description: talos $VERSION amd64 ($SERIAL)
87+
name: talos-$VERSION
88+
os: talos
89+
release: $VERSION
90+
serial: $SERIAL
91+
variant: default
92+
templates: {}
93+
" | tee metadata.yaml
94+
tar cvzf metadata.tar.gz metadata.yaml
95+
```
96+
97+
Finally, import the image into Incus:
98+
99+
```bash
100+
# c. import image into Incus
101+
incus image import metadata.tar.gz rootfs.qcow2 --alias talos-v1.12.2
102+
```
103+
104+
Make a note of:
105+
- The image alias `talos-v1.12.2`, as we will later refer to it when generating the cluster manifest.
106+
- Whether you used the SecureBoot image variant (configuration below needs to match).
107+
108+
## Configuration
109+
110+
```bash
111+
{{#include ../../../../../templates/cluster-template-talos.rc }}
112+
```
113+
114+
## Generate cluster
115+
116+
```bash
117+
clusterctl generate cluster example-cluster -i incus --flavor talos
118+
```
119+
120+
## Cluster Template
121+
122+
```yaml
123+
{{#include ../../../../../templates/cluster-template-talos.yaml }}
124+
```

‎templates/cluster-template-talos.rc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Cluster version and size
2+
export KUBERNETES_VERSION=v1.34.0
3+
export CONTROL_PLANE_MACHINE_COUNT=3
4+
export WORKER_MACHINE_COUNT=2
5+
6+
# Name of secret with server credentials
7+
export LXC_SECRET_NAME=lxc-secret
8+
9+
# Talos version (tested v1.12)
10+
export TALOS_VERSION=v1.12
11+
12+
# Talos image (tested talos/nocloud/v1.12.2/amd64)
13+
export TALOS_IMAGE_NAME=talos-v1.12.2 # alias of imported Talos nocloud image
14+
export TALOS_IMAGE_SECURE_BOOT=false # 'true' or 'false' based on nocloud image
15+
16+
# Load balancer configuration
17+
export LXC_LOAD_BALANCER_TYPE=lxc # must be 'lxc' or 'oci'
18+
export LOAD_BALANCER_MACHINE_PROFILES=[default] # profiles for the haproxy container
19+
export LOAD_BALANCER_MACHINE_FLAVOR=c1-m1 # instance type for the haproxy container
20+
21+
# Control plane machine configuration
22+
export CONTROL_PLANE_MACHINE_FLAVOR=c2-m4 # flavor for control plane nodes
23+
export CONTROL_PLANE_MACHINE_PROFILES=[default] # profiles for control plane nodes
24+
25+
# Worker machine configuration
26+
export WORKER_MACHINE_FLAVOR=c2-m4 # flavor for worker nodes
27+
export WORKER_MACHINE_PROFILES=[default] # profiles for worker nodes

‎templates/cluster-template-talos.yaml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
---
2+
apiVersion: cluster.x-k8s.io/v1beta1
3+
kind: Cluster
4+
metadata:
5+
name: ${CLUSTER_NAME}
6+
spec:
7+
clusterNetwork:
8+
pods:
9+
cidrBlocks: ${POD_CIDR:=[10.244.0.0/16]}
10+
services:
11+
cidrBlocks: ${SERVICE_CIDR:=[10.96.0.0/12]}
12+
serviceDomain: cluster.local
13+
controlPlaneRef:
14+
apiVersion: controlplane.cluster.x-k8s.io/v1alpha3
15+
kind: TalosControlPlane
16+
name: ${CLUSTER_NAME}-control-plane
17+
infrastructureRef:
18+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
19+
kind: LXCCluster
20+
name: ${CLUSTER_NAME}
21+
---
22+
apiVersion: controlplane.cluster.x-k8s.io/v1alpha3
23+
kind: TalosControlPlane
24+
metadata:
25+
name: ${CLUSTER_NAME}-control-plane
26+
spec:
27+
replicas: ${CONTROL_PLANE_MACHINE_COUNT}
28+
version: ${KUBERNETES_VERSION}
29+
infrastructureTemplate:
30+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
31+
kind: LXCMachineTemplate
32+
name: ${CLUSTER_NAME}-control-plane
33+
controlPlaneConfig:
34+
controlplane:
35+
generateType: controlplane
36+
talosVersion: ${TALOS_VERSION}
37+
hostname:
38+
source: InfrastructureName
39+
---
40+
apiVersion: cluster.x-k8s.io/v1beta1
41+
kind: MachineDeployment
42+
metadata:
43+
name: ${CLUSTER_NAME}-md-0
44+
spec:
45+
clusterName: ${CLUSTER_NAME}
46+
replicas: ${WORKER_MACHINE_COUNT}
47+
selector:
48+
matchLabels:
49+
template:
50+
spec:
51+
version: ${KUBERNETES_VERSION}
52+
clusterName: ${CLUSTER_NAME}
53+
bootstrap:
54+
configRef:
55+
apiVersion: bootstrap.cluster.x-k8s.io/v1alpha3
56+
kind: TalosConfigTemplate
57+
name: ${CLUSTER_NAME}-md-0
58+
infrastructureRef:
59+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
60+
kind: LXCMachineTemplate
61+
name: ${CLUSTER_NAME}-md-0
62+
---
63+
apiVersion: bootstrap.cluster.x-k8s.io/v1alpha3
64+
kind: TalosConfigTemplate
65+
metadata:
66+
name: ${CLUSTER_NAME}-md-0
67+
spec:
68+
template:
69+
spec:
70+
generateType: worker
71+
talosVersion: ${TALOS_VERSION}
72+
hostname:
73+
source: InfrastructureName
74+
---
75+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
76+
kind: LXCCluster
77+
metadata:
78+
name: ${CLUSTER_NAME}
79+
spec:
80+
secretRef:
81+
name: ${LXC_SECRET_NAME}
82+
cloudProviderNodePatch: true
83+
loadBalancer:
84+
${LXC_LOAD_BALANCER_TYPE:=lxc}:
85+
instanceSpec:
86+
flavor: ${LOAD_BALANCER_MACHINE_FLAVOR:=""}
87+
profiles: ${LOAD_BALANCER_MACHINE_PROFILES:=[default]}
88+
disableHealthzCheck: true
89+
---
90+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
91+
kind: LXCMachineTemplate
92+
metadata:
93+
name: ${CLUSTER_NAME}-control-plane
94+
spec:
95+
template:
96+
spec:
97+
instanceType: virtual-machine
98+
config:
99+
security.secureboot: "${TALOS_IMAGE_SECURE_BOOT:=false}"
100+
devices:
101+
- cloud-init,type=disk,source=cloud-init:config
102+
image:
103+
name: ${TALOS_IMAGE_NAME}
104+
flavor: ${CONTROL_PLANE_MACHINE_FLAVOR}
105+
profiles: ${CONTROL_PLANE_MACHINE_PROFILES:=[default]}
106+
---
107+
apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
108+
kind: LXCMachineTemplate
109+
metadata:
110+
name: ${CLUSTER_NAME}-md-0
111+
spec:
112+
template:
113+
spec:
114+
instanceType: virtual-machine
115+
config:
116+
security.secureboot: "${TALOS_IMAGE_SECURE_BOOT:=false}"
117+
devices:
118+
- cloud-init,type=disk,source=cloud-init:config
119+
image:
120+
name: ${TALOS_IMAGE_NAME}
121+
flavor: ${WORKER_MACHINE_FLAVOR}
122+
profiles: ${WORKER_MACHINE_PROFILES:=[default]}

0 commit comments

Comments
 (0)