commit 710a6010c61dcefcf602853fa313db191aa7ae83 parent 329fb2a0d29d08d44ca100473975b02fa1a12c25 Author: MTRNord <MTRNord@users.noreply.github.com> Date: Fri, 27 Feb 2026 20:27:29 +0100 manage cilium and longhorn Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| A | infrastructure_talos/controllers/cilium.yaml | | | 137 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| M | infrastructure_talos/controllers/kustomization.yaml | | | 2 | ++ |
| A | infrastructure_talos/controllers/longhorn.yaml | | | 52 | ++++++++++++++++++++++++++++++++++++++++++++++++++++ |
3 files changed, 191 insertions(+), 0 deletions(-)
diff --git a/infrastructure_talos/controllers/cilium.yaml b/infrastructure_talos/controllers/cilium.yaml @@ -0,0 +1,137 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cilium + namespace: kube-system +spec: + interval: 24h + url: https://helm.cilium.io +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cilium + namespace: kube-system +spec: + releaseName: cilium + targetNamespace: kube-system + interval: 30m + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + chart: + spec: + chart: cilium + version: "1.18.7" + sourceRef: + kind: HelmRepository + name: cilium + namespace: kube-system + interval: 24h + values: + bpf: + datapathMode: netkit + hostLegacyRouting: false + masquerade: true + cgroup: + autoMount: + enabled: false + hostRoot: /sys/fs/cgroup + dnsProxy: + enableTransparentMode: true + egressGateway: + enabled: false + encryption: + enabled: true + type: wireguard + gatewayAPI: + enableAlpn: true + enableAppProtocol: true + enableProxyProtocol: true + enabled: false + externalTrafficPolicy: Cluster + gatewayClass: + create: "false" + hubble: + enabled: true + peerService: + clusterDomain: cluster.local + relay: + enabled: true + ui: + enabled: true + installNoConntrackIptablesRules: true + ipam: + mode: kubernetes + ipv4NativeRoutingCIDR: 10.0.0.0/16 + k8s: + requireIPv4PodCIDR: true + k8sServiceHost: 127.0.0.1 + k8sServicePort: 7445 + kubeProxyReplacement: true + kubeProxyReplacementHealthzBindAddr: "0.0.0.0:10256" + loadBalancer: + acceleration: native + operator: + nodeSelector: + node-role.kubernetes.io/control-plane: "" + podDisruptionBudget: + enabled: true + maxUnavailable: 1 + minAvailable: null + prometheus: + enabled: true + serviceMonitor: + enabled: true + interval: 15s + replicas: 2 + topologySpreadConstraints: + - labelSelector: + matchLabels: + app.kubernetes.io/name: cilium-operator + matchLabelKeys: + - pod-template-hash + maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + - labelSelector: + matchLabels: + app.kubernetes.io/name: cilium-operator + matchLabelKeys: + - pod-template-hash + maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + policyCIDRMatchMode: nodes + prometheus: + enabled: true + serviceMonitor: + enabled: true + interval: 15s + trustCRDsExist: true + routingMode: native + securityContext: + capabilities: + ciliumAgent: + - CHOWN + - KILL + - NET_ADMIN + - NET_RAW + - IPC_LOCK + - SYS_ADMIN + - SYS_RESOURCE + - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID + cleanCiliumState: + - NET_ADMIN + - SYS_ADMIN + - SYS_RESOURCE + socketLB: + hostNamespaceOnly: false diff --git a/infrastructure_talos/controllers/kustomization.yaml b/infrastructure_talos/controllers/kustomization.yaml @@ -6,3 +6,5 @@ resources: - capacitor.yaml - ./cloudnative-pg-operator - cert-manager.yaml + - cilium.yaml + - longhorn.yaml diff --git a/infrastructure_talos/controllers/longhorn.yaml b/infrastructure_talos/controllers/longhorn.yaml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: longhorn-system +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: longhorn + namespace: longhorn-system +spec: + interval: 24h + url: https://charts.longhorn.io +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: longhorn + namespace: longhorn-system +spec: + releaseName: longhorn + targetNamespace: longhorn-system + interval: 30m + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + chart: + spec: + chart: longhorn + version: "1.10.2" + sourceRef: + kind: HelmRepository + name: longhorn + namespace: longhorn-system + interval: 24h + values: + defaultSettings: + allowCollectingLonghornUsageMetrics: false + kubernetesClusterAutoscalerEnabled: false + upgradeChecker: false + networkPolicies: + enabled: true + type: rke1 + persistence: + defaultClass: true + preUpgradeChecker: + upgradeVersionCheck: false