feat: Bootstrap cluster with Talos 1.11.3 ✅

2026-02-07 00:37:01 +01:00
parent 0fb1007e33
commit 9d42bbb46b
19 changed files with 121 additions and 91 deletions
--- a/kubernetes/apps/cert-manager/cert-manager/app/secret.sops.yaml
+++ b/kubernetes/apps/cert-manager/cert-manager/app/secret.sops.yaml
@@ -3,20 +3,20 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: ENC[AES256_GCM,data:g7EU9+F/w3ZfOmXfurtTriURKH6ACy0=,iv:cYlb1qcgA6rm4At9MB7gLd6nhx2xOUX3kS07EcFcpRc=,tag:M06roUVzO+KiCoo0Szafxw==,type:str]
+  api-token: ENC[AES256_GCM,data:8ZfAyBvM7tVWaG2G/L/FFY6hbAAALBQ=,iv:NlG4loGnqLe+ECP0ckFz1LSCd2OAxXoyVk61FV/nskA=,tag:8xYcDqsFkmPa6l8N+0rGtQ==,type:str]
 sops:
  age:
    - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4MlhjQTZjTnpReU5uOXBK
-        c2VzZmdFWXhBdHlRZEM2SHdJRUNTTDRFREVRCnMweDQzaTA5ZmlZTm1wc0NoYzBX
-        UTFoRXczMVl1ZExjSk9ENG9zYkRLdFkKLS0tIHNzbDRXbzEyS1c4TWxLLzdEU29E
-        UGZIbmJpOUVsMkV1eXlERVhhV2l4U1kKHwiICIi0T8JYanOwocbOjOJArZnp7+X0
-        S75OyFJSTWtX5s5lAfpOnc6xfYDmEKVFC1IWGLcPpHSiXrl9blsd0A==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWDJhaDR4QVhRZVZjbXVF
+        MDdGazU2RWRuRzVDTVV0N1ZzQmpVYTFMZGdnClp5UExtUzl5K3ZjRWJEcDY5RnN0
+        cUJ2QnA5ZGRONGFOeWhiZHhiWmJWRTQKLS0tIFM0ZStnK3VZRkQ5bU1EVUlFV0hY
+        WVZ6L0JlZzZGVmhWa0tKQXhDWFowbTgK9cxIrmI9NEN5/MLOKfM/porIWuVu1jKL
+        F+HPb7isgvY0P3c/PJLd9d0Z2mderFhvLPTgNVjXkqIVDMj8kJUtmg==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-06T17:15:16Z"
-  mac: ENC[AES256_GCM,data:2JyFiMBdroxwKgYCq7Nh+5m9iuOrVAFuMk/OUZW2Lj0W1R8INvnNcrcXmtcr1g1Z+4M1mwGa2XKwDoJjNzeN6G0sVcU6vDb7Gxs3bjsGjE+pr5rxrbVumL+6x86t0AF/I6bUDXmcPJPoEoHxyJ1nY+9AeMPsqAHJ5pd2+Bcx3PE=,iv:oyafLwhq6vHEu8wTEhqIgqQAwyDahzdvtwjtDVRSKXI=,tag:hZdGfTQEEbxFF4wdLkbS4w==,type:str]
+  lastmodified: "2026-02-06T23:19:54Z"
+  mac: ENC[AES256_GCM,data:8A0c8MxMJLCd4nhsFBLRUGiC8IUbu7qJBa8zgp3vhgY+W7YCThmYzu2Q147zbch5kvA8PORF5CAbZjDvvwQ7WojSDw2qHEA7wPU8wbSE7WSL9o3Lp1027z1fk15TvlFCGRR3V3L8kTyMQXxc9tHCd0vFx7F+O99/c6hlovbSuDE=,iv:V8Okp/ciK/rt0FnEc6NJ9PDxjdoiUgiYs4UK6D2t47E=,tag:AMX4EDTokC66DMMBZ4hpYw==,type:str]
  encrypted_regex: ^(data|stringData)$
  mac_only_encrypted: true
  version: 3.11.0
--- a/kubernetes/apps/flux-system/flux-instance/app/secret.sops.yaml
+++ b/kubernetes/apps/flux-system/flux-instance/app/secret.sops.yaml
@@ -3,20 +3,20 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: ENC[AES256_GCM,data:Ax/iC24DNn7q+Muzr/1n7nW5rHkyI+RL272ptAqNj9E=,iv:93LLC0H0/rP7SsEVwu/K+FXGSIT+JrOxyEy9E5yohVw=,tag:3M8XVHUe057sZe0YdjIBkw==,type:str]
+  token: ENC[AES256_GCM,data:tPhLMHfjDb36TYDTrURsThcMTPnEUXXd673xcrk0W9o=,iv:yTsvzqOTZvAJuEf8qmPS3boVQ6F0sUlFBy4VA67DXUM=,tag:DZr236d3zm55CufMo1+XQg==,type:str]
 sops:
  age:
    - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0dmt3TFl1cXZTUkJ6eDFt
-        NzVzUU96NEVwSWgyTUVyWGVZdEFTRWRMOVhzCm9SbVpVZ25wMDFrYlRSazhleng5
-        M3ZDUi9mWjJXSk1jS2x3cUtwNXpyd1UKLS0tIEZXWTZXVmdRRnBueG9aTzJwTitz
-        VysvZFpUOVEwV09yTXdEaUs0NXJ0a2sK6qQ9XVf/hlBeCM1t/jzdd9mbX5zPpddd
-        3wWEUxW+UnPiVDn5+4I1SYmx6ZGNs4hDZ41PzipV0MaD+VPbaVJkAA==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQzRTRms2bWdobnYzOW9Q
+        UTg4WGtmMUMyaWVrVXhJUmpsV0ZTTmJiMWlZCmEzUnYvdWNENG5DdTg2elFiY09O
+        ckhoTFp6RXdHM1NXcjlaMmdKd0dMaW8KLS0tIHFhMWNtZ0NzVU1ZOFUxQkN1NVBX
+        RUV4d2ZwQ1c0cThxK0h1Wmo5cE1NelEKn1zF0F3mTITgcfr2Pt6Xgy1HjuXLAF7e
+        d6xpY7HKSEhhESQO5veXdYpYi1k8o81HyZtl13pwkgwgOkuJw5MDlA==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-06T17:15:16Z"
-  mac: ENC[AES256_GCM,data:CsfeTXYkMOAO+oL88JFSi4Hg9wBlLb8Fx/PNPcJJdm7z5bekkKmjQDzTyoon5xLMQazppTZ3FUK6MMYCXXdXVK+KoSgrxjgjw+BBx7+SPuSowwLhRD0bw3qyzZkVoVJR26ZzeJ/L4Zn1gAH8O0wBOvgPqEn7kq+1y2ybeK6ONyg=,iv:xuh6P1TToQkIikCGCFu8WQzy3uN1X+DeT7fOKKEZG+Y=,tag:CHtHBAve8e7Yzx/C/bcRyA==,type:str]
+  lastmodified: "2026-02-06T23:19:54Z"
+  mac: ENC[AES256_GCM,data:DoTwNwD8Vx3KXNDPeCLp4vyJR8s0Q2IOV10sUvwCSGWbuBm6P63v3k/6Yr74e72x5HHRFEG19yV0SKOY5S5V9GgMdb587gt08Nd7iInO9pVFl6sIyMOx1OiVBlmtdtB5TQP57FhoQ1uttcESsbKHgyEJCD5AAW81gbg6083EA9g=,iv:/HlzSO/9rSSXE7FRa5NLCyApYYxbXbwIsuFsYV15HJc=,tag:X2dE8gXXbz6ZInkvZqEgLg==,type:str]
  encrypted_regex: ^(data|stringData)$
  mac_only_encrypted: true
  version: 3.11.0
--- a/kubernetes/apps/kube-system/cilium/app/networks.yaml
+++ b/kubernetes/apps/kube-system/cilium/app/networks.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
  allowFirstLastIPs: "No"
  blocks:
-    - cidr: "10.0.50.0/24"
+    - cidr: "10.0.0.0/24"
 ---
 apiVersion: cilium.io/v2alpha1
 kind: CiliumL2AnnouncementPolicy
--- a/kubernetes/apps/network/cloudflare-dns/app/secret.sops.yaml
+++ b/kubernetes/apps/network/cloudflare-dns/app/secret.sops.yaml
@@ -3,20 +3,20 @@ kind: Secret
 metadata:
  name: cloudflare-dns-secret
 stringData:
-  api-token: ENC[AES256_GCM,data:UKpTJgaK9G9O3J8d7Fgzw8WbfCg24JE=,iv:H1HKlF7vWiDxt7+A7OinafKHyNb5sf7U0krOZ3jK3DE=,tag:FrjImSrAjAf+ba3EWeieBw==,type:str]
+  api-token: ENC[AES256_GCM,data:WYpLcODNDH+hR5Du1vC0cyukqZxPSl0=,iv:m/EH50DeTQ1h15DKnLU+54XKfJzdSTB8kB3PiXpcYoA=,tag:FBaqpUvXd1iRxt+TgpBjIA==,type:str]
 sops:
  age:
    - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3MVRtS3UvTWkwUVpJVzlx
-        S2NPWUdVcEhCZjdXdmNBbDQ2MStic0FUblVVCjJrUHMwcWJ6YUI4YTR6NGJRN0RM
-        Nnh6WllvWWkzak1INENIWi8zTHNFNk0KLS0tIHhGRG0wRWNWWXVwUlRsaFYyWUxO
-        VUJTazdTanRPNCtLQXh4and5ZHJNYU0KruRvlrvLZkUTCTBa10m7+RWJ3o7AzntC
-        OnxLebUJC9aYTX6J1BVMPrhmFfSxsK6Rh7X3W8onDtIp2iy3ArrpNw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdUIrWHJhR1QrdWdpZHJI
+        a1R1M1lxc2FmUERmU0h0TkpzVWorRnF2a2dnCktmQTFjRzBnZGJ1enBWUWdmb0JB
+        MnRoZWs2eEZMbGhsSnFhTENQYUJXOTAKLS0tIC9rS2MxTVZUK0c2TEljRnkyTVBs
+        NDZrc3p4VFgrYjdXUkp6eTY5bnN4TzQKj77N+klrJSaenw7zNDh6tSj8av+oZwKo
+        zEiAV3l6WnhNPV6d1MXISkWs1jdmq1mnUj96uN4L/8M9Rp9e5oN8Pw==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-06T17:15:16Z"
-  mac: ENC[AES256_GCM,data:gVpksh43O9k+oB/d+zWnZmUdN1VoEsNTL0PzSh1sVceKgxKqVmnWZ2rd4SeGgb5ZRY8qWVoc/VjBpmO5MOR+e9G/Mnr+ObgaMNF7jHfONqHrKrI5cb/V1QY6dLlGfOJXZAeJjNlFW66eBbOA4MYxSL2BN9EmEujhcTw/wN0eg0s=,iv:JJaPxRmuQjkOuLchKqncQKHye4Y/WZNId2HAe+SDQf4=,tag:YcubZaOGX7fNtb3KhEYwew==,type:str]
+  lastmodified: "2026-02-06T23:19:54Z"
+  mac: ENC[AES256_GCM,data:Cu9pIzQf4QJGe6ur4QmT5uKyTywJ9Ayqe7U6IgVQl0YQWMTgzPcr7crE7HzcHbnSWf0VOLTc69+4cdsMqiwZ8p/PqET+UD7QprFPa7tmi19rbuPSMgRhrYlbCPjo8tx22ASh17rQPLKDN/hw4HCt7N8lABDod6irOh5kJt4Ewdk=,iv:FR+JkSo/BMKuhy36/R1Cx0tmvYzV+oTmEvjex8E4jVQ=,tag:ynTb7yutVO61YSm5JNemFg==,type:str]
  encrypted_regex: ^(data|stringData)$
  mac_only_encrypted: true
  version: 3.11.0
--- a/kubernetes/apps/network/cloudflare-tunnel/app/secret.sops.yaml
+++ b/kubernetes/apps/network/cloudflare-tunnel/app/secret.sops.yaml
@@ -3,20 +3,20 @@ kind: Secret
 metadata:
  name: cloudflare-tunnel-secret
 stringData:
-  TUNNEL_TOKEN: ENC[AES256_GCM,data:9esVt/nhRJpjGM3SprOlvtUHHwhbY1b03lcG/Mod68ljpaIlrdu3qJ4iOIch8tRAETPATpB0ikbyyXtygFIQZ2wD5oiO/KhkmqDwmGFA+KRCah6ghnipMhpYhdYytNDaLfEnQBv88sTZFWDT7apjnHp+msUcpb0F+mD4LrTjLVE+WIBHFYfdAWspsXa+JWQwemjoHASJ6c4gvbB/yW5V1bjLy5R05Zyb5d5SYh+pb9WCLatl,iv:/8uhuoSjwTXFutDUlBxRFsJXQ/lsqs2AcieeUL5Bf0U=,tag:KpzZF9ic999b4NxYiB+8VA==,type:str]
+  TUNNEL_TOKEN: ENC[AES256_GCM,data:7dUHKyUL1HueEKAUYXBXFBJjOG7+DQs/kO+nCf9J2WxK8i88DiKjkoSoHeKJLXAyggayVjzOM15kxgZIa6SFfBKZWFN/qLHZ7I8rULyzkHf+FQvJx1GE7I31uLvWj7EXejPp053z+pGYBjdYe5/eZMfHy1rFXPqEPXw8oPSZ43UbP+Oa9Af5h8QSfuevNOpKX9VhIVdL71OoBsfKPNQhGkuCID6e3+x3QEbAnlB0tD8o2nOt,iv:YSf2745drewpDiNmcT6r/fVYAwakdUkBJWmPBS7wNjo=,tag:6v3A3X7TRIOtxOwGeQsIjA==,type:str]
 sops:
  age:
    - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5M3F2RTNleFBoR0ZqWnJK
-        NnZJcUNjdXJ3NlJTN3NtMVU2RE96a1l0WFhBCkw1Z0ZCMmxwMU9IZUJsUUo1Lzhm
-        V3ViR2ZVaGVnU0RpUXBPZC8wYXlscHcKLS0tIExMbVEwdlk0a0RTN2d6M0tpNlo5
-        UHBPdnh0Y1N3SGk2N2ptT0o5bzEwMWsK1WCmvr5K8G6GCTmuNUlY9nmzvIh9UNuL
-        c5FQouMsoLnDcj7Vy/IwfHRr5wU2u28RdPmh4dq3yVVGxud3cPgfVw==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDQ2FOZEU4OWsvTDNZa3pj
+        dUhPMkd4ZUtKWGxCSFpQZE05ZFhuQnAvelVjCmp0S0VpcDhGRGpLRGpIbFBzOGEx
+        dUJScnBOcDhmYnkwY2VRc05sNGd0YXMKLS0tIGJhNGRGcWY5Vjc5cEZJVFVYcHcw
+        UkdCRWI4Y096bU53c05xMWdiMjBpcDQK+FcoUkF4fcSokWwiKpgcFOl99V7KV3/N
+        AvV/Zhl2nrB0u/fsEhSBoPx4sHbrYe8qZZx5wgazQMnjkgGbbgyJ6w==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-06T17:15:16Z"
-  mac: ENC[AES256_GCM,data:Grg4MQaP8HS2RFO9I6NBQX/zCbF/YbrK56sH4jCtXISt3FPEvYs31Ka9DwRQD4ajPH8wAK9NQDsX8l9ph27sXIPabbB2oxMvrtT7p8/Ntj5h5asX/hqOOb/5465unw1TzwmSIDN6+8jEQlWzwG2qndNCX6WC54+xa//V1euNjt4=,iv:eMGsHVcLN2IjqwZuH1JToEwyjKUdJZw5yG6Eu7lnsVM=,tag:0oIQa83kSb1suI4db9qhMA==,type:str]
+  lastmodified: "2026-02-06T23:19:54Z"
+  mac: ENC[AES256_GCM,data:/P01+iM+clwj5/M+mh8UyeFLM/s9FYJPwgqrc8tD8vGy/BGISd+D6PKn2ia8ETKpNxCtPcM/9rv0mrmRFRD7nrJeY3iDa87tpRnoyo3+CDe0yJ22stAavrJf5O1Tu71NPKWhsw1SRYJgWUUB0mhIXVcRB4/+ECA7u3Wm2ux080U=,iv:7ulGhyCFZQdy5LEKyxydzGhg9gKYUgiERTZ38k9s3QA=,tag:dDaCZCRtvNYmKXODQ0+dwQ==,type:str]
  encrypted_regex: ^(data|stringData)$
  mac_only_encrypted: true
  version: 3.11.0
--- a/kubernetes/apps/network/envoy-gateway/app/envoy.yaml
+++ b/kubernetes/apps/network/envoy-gateway/app/envoy.yaml
@@ -52,7 +52,7 @@ spec:
  infrastructure:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: external.${SECRET_DOMAIN}
-      lbipam.cilium.io/ips: "10.0.50.110"
+      lbipam.cilium.io/ips: "10.0.0.210"
  listeners:
    - name: http
      protocol: HTTP
@@ -82,7 +82,7 @@ spec:
  infrastructure:
    annotations:
      external-dns.alpha.kubernetes.io/hostname: internal.${SECRET_DOMAIN}
-      lbipam.cilium.io/ips: "10.0.50.102"
+      lbipam.cilium.io/ips: "10.0.0.202"
  listeners:
    - name: http
      protocol: HTTP
--- a/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml
+++ b/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml
@@ -16,6 +16,6 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        lbipam.cilium.io/ips: "10.0.50.101"
+        lbipam.cilium.io/ips: "10.0.0.201"
      externalTrafficPolicy: Cluster
    watchedResources: ["HTTPRoute", "Service"]
--- a/kubernetes/components/sops/cluster-secrets.sops.yaml
+++ b/kubernetes/components/sops/cluster-secrets.sops.yaml
@@ -3,20 +3,20 @@ kind: Secret
 metadata:
  name: cluster-secrets
 stringData:
-  SECRET_DOMAIN: ENC[AES256_GCM,data:/oM3dDZMlNi/FNit,iv:Rcx5E20gYVa/KYsT+LBAB3WCOXVo8xn82XJlEHzCIno=,tag:XwQNLwZNF9kRX90DbtZiXA==,type:str]
+  SECRET_DOMAIN: ENC[AES256_GCM,data:FiRQTWKukYWG5SeU,iv:ZF66ws//NtgsLAAopFWxqfnS3v+zJ91cCtGDdKmrt8I=,tag:qpZ02/pHY75vPiNn55bnCQ==,type:str]
 sops:
  age:
    - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLRDVKT0QwRHNNSzlicVMz
-        YW52SHR5UmVSUTFzMHlOeCtPUjBPQWtQRzJRClJYUWdZWGlaeVF6ZDdJclVZQ0ht
-        TnVHb214MkE4NkgwZUcwcmtoUmxWU2cKLS0tIEltL09BK0R5Z0VkWURzbmxGbE1M
-        Y1hPbFo0eDlvZ0lnazc3aTRGd2htd0kKdyJCErhBU1d/d7ijNkW9OYWEjLAnsdjO
-        Ov2z/d+7swzx7xhh5mmpjgDbLYoh/CMqTwGj5O4toNDgv/Zus4VpCg==
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPeU9xRzFpNUIwVDd0L1FW
+        TzBwS0U4bmNob0dISGlhRS9vY1FWVWRnVmlnCnlxOEZPUEd1WUdzK2VyNEpxckts
+        S1QyUDVGaTJQYW53VzNHWHp2ek1CbzgKLS0tIG9hczhjY2s0U1N6RCtRS3pBUWd5
+        S21ack5la3RDUTQ2dW8rRHNNK2ZXVEUK63/NjwmIn0cKAfbGGdgdN7meUQxHPnNH
+        acqptglQpDthoGoI3sDhBeG+jcMfIwNCYP+lANbVaN0JXnTG/O7qxg==
        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-06T17:15:16Z"
-  mac: ENC[AES256_GCM,data:DRtYVDbOL02OivB7Bymy/bMW9I3gJfVcpHDYXaVDRdj1Nq6oQNbToTBdfJNgOcvVzVtq+AuJg7UF7mL4+hGN5EC8DoSbU9CfJxV0w7Zw7gyHKMV9OFsvE6dzXEXKYfsQtHnmQ/tZ6uSx9yrUzdq8cyLS8Dc9MxncCygTFwFp/fU=,iv:IjTWClKnorqCLVGxzq2pnp7EaivDdjMqnZ126CkQGbs=,tag:eO+t9hV9B4CZpnoO4DQonw==,type:str]
+  lastmodified: "2026-02-06T23:19:54Z"
+  mac: ENC[AES256_GCM,data:vAD+P1BodNPfsReicZ45ODsKol0e4zxG/x6USbJKvkNkVFAoqIlXCfbh8TeabDUbrVsucZMpCtViuhjGwnRaU1qhwoxxCAcq27MZk28c6eCjsWG8KxrUx3WM5nBk19Htgkm118Y+ls0vYCcS+H8rVuezAJ1+ZT2OhfD76JYHatY=,iv:T1nN8eKDlwICgRxfURETqrlD2FMie1ux9SlR/YnYkbc=,tag:IyCZ12r1hvpiKm4xXf62Yw==,type:str]
  encrypted_regex: ^(data|stringData)$
  mac_only_encrypted: true
  version: 3.11.0