chore(deps): update ghcr.io/fluxcd/notification-controller docker tag to v1.4.0

Reviewed-on: #37

.editorconfig

@@ -14,10 +14,6 @@ insert_final_newline = true
 indent_style = tab
 indent_size = 4
 
-[*.md]
-indent_size = 4
-trim_trailing_whitespace = false
-
 [{Dockerfile,*.bash,*.sh}]
 indent_style = space
-indent_size = 4
+indent_size = 4

.gitea/workflows/kubernetes-linter.yml

@@ -4,10 +4,10 @@ on:
   push:
     branches: [main, master]
     paths:
-      - "kubernetes/apps/**"
+      - "kubernetes/apps/production/**"
   pull_request:
     paths:
-      - "kubernetes/apps/**"
+      - "kubernetes/apps/production/**"
 
 jobs:
   scan:
@@ -37,4 +37,4 @@ jobs:
 
       - name: Scan yaml files with kube-linter
         run: |
-          kube-linter lint .kubernetes/apps
+          kube-linter lint ./kubernetes/apps/production --config kubelinter-config.yaml

.gitignore

@@ -1,2 +1,3 @@
 kubeconfig
 secrets.yaml
+talos-cluster

README.md

@@ -1,43 +1,42 @@
 <!-- PROJECT LOGO -->
 <br />
 <div align="center">
-  <a href="https://github.com/github_username/repo_name">
+  <a href="https://git.fascinated.cc/Fascinated/homelab">
     <img src="images/logo.png" alt="Logo" width="80" height="80">
   </a>
 
 <h3 align="center">Homelab</h3>
-
   <p align="center">
     Welcome to the configuration for my homelab.
     <br />
-    <br />
-    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Report Bug</a>
+    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Report Issue</a>
     ·
-    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Request Something</a>
+    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Request Feature/Service</a>
 
   </p>
 </div>
 
 ### Infrastructure
 
-- ![Kubernetes][k8s]
-- ![Helm][helm]
-- ![Traefik][traefik]
-- ![Cert Manager][cert-manager]
-- ![Metallb][metallb]
-- ![NFS][nfs]
-- ![FluxCD][fluxcd]
+- [Kubernetes][k8s] - Isn't it obvious?
+- [Helm][helm] - Easily deploy and manage Kubernetes applications
+- [Traefik][traefik] - Web reverse proxy
+- [Cert Manager][cert-manager] - Generates LetsEncrypt certificates
+- [Metallb][metallb] - Load Balancer
+- [NFS][nfs] - Remote Storage for PVs
+- [FluxCD][fluxcd] - GitOps
+- [Spegel][spegel] - Local Docker registry cache
+- [Eraser][eraser] - Automated cleanup of old docker images
 
 ### Services
 
-See [services](./apps/production/) for a list of services that I use in my homelab.
+See [services](./kubernetes/apps/production/) for a list of services that I use in my homelab.
 
 <!-- TODO -->
 
 ## Todo
 
-- [ ] Hashicorp Vault & Consul
-- [ ] DroneCI
+- [ ] Setup Grafana and Traefik metrics
 
 ### Backlog
 
@@ -63,10 +62,12 @@ Don't forget to give the project a star! Thanks again!
 <!-- MARKDOWN LINKS & IMAGES -->
 <!-- https://www.markdownguide.org/basic-syntax/#reference-style-links -->
 
-[fluxcd]: https://fluxcd.io
-[k8s]: https://kubernetes.io
-[helm]: https://helm.sh
-[traefik]: https://traefik.io
-[cert-manager]: https://cert-manager.io
-[metallb]: https://metallb.org
-[nfs]: https://nfs.fascinated.cc
+[fluxcd]: https://fluxcd.io/
+[k8s]: https://kubernetes.io/
+[helm]: https://helm.sh/
+[traefik]: https://traefik.io/
+[cert-manager]: https://cert-manager.io/
+[metallb]: https://metallb.org/
+[nfs]: https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner/
+[spegel]: https://github.com/spegel-org/spegel/
+[eraser]: https://github.com/eraser-dev/eraser/

common/seal-secret.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Function to seal a Kubernetes secret
+seal_secret() {
+    local input_file="$1"
+    if [[ -z "$input_file" ]]; then
+        echo "Usage: seal <path-to-secret-file>"
+        exit 1
+    fi
+
+    if [[ ! -f "$input_file" ]]; then
+        echo "Error: File '$input_file' does not exist."
+        exit 1
+    fi
+
+    local output_file="$(dirname "$input_file")/sealed-$(basename "$input_file")"
+
+    echo "Sealing secret from '$input_file'..."
+    kubeseal --format=yaml < "$input_file" > "$output_file"
+
+    if [[ $? -eq 0 ]]; then
+        echo "Success! Sealed secret created at '$output_file'"
+    else
+        echo "Error: Failed to seal the secret."
+        exit 1
+    fi
+}
+
+# Call the function with the provided argument
+seal_secret "$1"

kubelinter-config.yaml

@@ -0,0 +1,3 @@
+checks:
+  include: []
+  exclude: ["run-as-non-root", "no-read-only-root-fs"]

kubernetes/apps/disabled/drone/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: drone-ci
+resources:
+  - namespace.yaml
+  - ./server/sealed-secrets.yaml
+  - ./server/pvc.yaml
+  - ./server/server-deployment.yaml
+  - ./server/service.yaml
+  - ./server/ingress.yaml
+  - ./runner/runner-deployment.yaml
+  - ./runner/rbac.yaml

kubernetes/apps/disabled/drone/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: drone-ci
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/apps/disabled/drone/runner/rbac.yaml

@@ -0,0 +1,70 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - watch
+      - update
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: drone-ci
+roleRef:
+  kind: Role
+  name: drone
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: drone-deploy-sa
+  namespace: public-services
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: public-services
+  name: drone-deployment-manager
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "create", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: drone-deployment-manager-binding
+  namespace: public-services
+subjects:
+  - kind: ServiceAccount
+    name: drone-deploy-sa
+    namespace: public-services
+roleRef:
+  kind: Role
+  name: drone-deployment-manager
+  apiGroup: rbac.authorization.k8s.io

kubernetes/apps/disabled/drone/runner/runner-deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone-runner
+  namespace: drone-ci
+  labels:
+    app.kubernetes.io/name: drone
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: drone
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: drone
+    spec:
+      containers:
+        - name: runner
+          image: drone/drone-runner-kube:latest
+          ports:
+            - containerPort: 3000
+          resources:
+            requests:
+              cpu: 50m
+              memory: 75Mi
+            limits:
+              cpu: 100m
+              memory: 200Mi
+          env:
+            - name: DRONE_RPC_HOST
+              value: drone.fascinated.cc
+            - name: DRONE_RPC_PROTO
+              value: https
+            - name: DRONE_NAMESPACE_DEFAULT
+              value: drone-ci
+            - name: DRONE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_RPC_SECRET

kubernetes/apps/disabled/drone/server/ingress.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: drone-ci-ingress
+  namespace: drone-ci
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`drone.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: drone-service
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/apps/disabled/drone/server/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drone-pvc
+  namespace: drone-ci
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

kubernetes/apps/disabled/drone/server/sealed-secrets.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: drone-secret
+  namespace: drone-ci
+spec:
+  encryptedData:
+    DRONE_GITEA_CLIENT_ID: AgBvs/BRqipwanwhehkG+efGyDYwbvkaYkOSsoW6PCqiKx3GX7wFUnSEEljoTLn8qCx7GKGT73KBcK6ItwFisAlJwFHTC7DtgCSJzpHBwHvbCWs+QtKumHCtgnj2XCHGs8yt4o9I9KClGl6mqKFfWAWiDAoBcY6YHCM5l23jh/ipglT1jcRGm+dxouZ5QCCNjHSEN/SD0wVv4bCajRmZ7fwOrJ9lsJFhfhu6hvm0UsFggsrtOGavk0TzwzUoeZPvGM7LOhFk5qAFFdJAMucErcfKlEKcxfPd4V0rwJTNaSQqSL01iEQLSdgwQqsypJxKpKz5D2aByEiYHe4HvpFzm0KnwaOth7MO6gmnp7+mb008MyUL4KSdcj82z76YjD5S9uU3XaeuxlEWrAU1obGWNzFU5E8a9L0iJIoOhH33kwcYhUFjloZ3S2mL0gyl2EpZ3tIXlXpjr8B0WXC/bgWOk5kq+veIaM2+jeTge7iLXhS/8rtxAy7tUk22jEK9ecXT5zqlLrTIpcJz3UMpKTh5N397vIGfRNJ1DoRPCL/UHXWTleNBQTijhGWDb+JcT70makwroXYOLQorZXOVbRLWCC/b+i9Aq8yVNhyBUJy0SR1qhkO4tCgZ5/E5+mXFJvjkH64JYHCyFDI/KPjzefby2HSINjTR1AD5mW+KKOfINMCffFD7Zy90jcd9iViU9JE4coqBRPG4v1lmoGPv++fnJEC5ZNoWKy2FMTkf5rt0cPtuBSsP8CU=
+    DRONE_GITEA_CLIENT_SECRET: AgBBub2TZ2xb6oVxTVHWZkdiVMo9zFNUrYxL0Iw1YeUFgZmJjkk/CP6UCxlCJbnzOj+b//HbYn1w8sS3vzGK82be8GgfkgI4/hTHHll3GSjEbdaTn7xEL/XJrp+JyVvX7bQNPLCkTsaxIrz7dh7kHUvcgRxOoSsFKHj73hjf27lHa+Qa89fDO5Zb1PjUSeT4IlAHlUuQraKx0viAoy8uEX6OyX3lhX5Aa2NQkbLRYCd8T7+IW0lyKvwwOpOdVH/38G8eAVXmADdKuNyIoq9++bYnUMMFMBj6OdMp3xNyGcEkuKlMI9+DaT29tmOgvDiWog/E2Hg0IERh4z5Dr2p4oJyT7b1N1ynRiwfndLp2di9d+nrzG5STf9NRKOK8U+NWTRcXv4JRkKyIDAi0j4eoC9cVyKGe341A4os3kTg9dky0RL+Q7+NWCWUYFAXIkU5cRHgwW7LTkv96cduerVT8YF3sxvu4FlJgHDNKvNuxFAhPOCwoOozPX8JbhhlEPfxWZ0s9B7QgRdNm/GY6RxV0Dl7F+IhzSxA/PrMxYUzuhenW+K9bIJd5dR73NfTlxbTdt/tM7DpVb00DrHx2Y2BOME1H76AXrRr+MZdWz46XHBSh6yeTMf5D3PRU8SPDEqSUrODEnjlEnJCkjYoxLOYAjXa/5dyZnyxIpS4WDMIB0/aXde0CX83fJ9C5KM6P36kKUZL8VOiJ5HA4Fzz/45X0wjEOkccuIHElWzPzOcW5geLc4vZRNiJa5ydLoktnMObqf7Iy3Jxrlg3SGg==
+    DRONE_RPC_SECRET: AgA96+L9/gvS8PkIfwDBnpBcagdL+eE1wyTqvMnG2pIGMhy7li10yvra/B1ptsuBak1Aab7WNZvNR5zUf2b2QVEk9Rz0q7D0ZqVFP0U6JiILPJ6p61K0GC+Lh5MKI4yzFmYrT+hfk6HkKGy5dEtJ+JoY2aT6Mn26pIs3dEnKlIObxxR7rQzlKuV2yrkguHnhV38DCvsMkMYaF8G1IiwfDsHJ1JcwXjHlRtkl02v/Arc1sGZi/2lXZpqXMW3UFb2YGRGP6rgeXcsGeNslIkMJkJaUSZdI3HS0ufHwSbJJaiug370E/ZkHChpaABibAEImoblgrRD2IPbwlNymiZdAqXpwjj++sAgoHvBDUkFk48TkIXb0uxOmVFeevgxJgYyXP9DPqJVPj+CtSRxWle7pAODYpmf1avn4bOB4DXdJVR1IR9si8OYgTZW3Fz4Lxh8naOuaTrnyzJosJBrB3Nks9q96IZQHitnzBJZKEuEjhfp6oAzkgaYPej4q2EAy8DoIb8kltFyaA+f+0s+9ipQeXL5OKhfCzNq6vBFsOqn3g5wHse/86NH3FHZnHEmqlOw/4N18gsj+g09TqJSeDVm/Tbzq+eYyPV6KKNN2F/890VAieUo+AyoCznjjv85AXHjA5gfj3JQj7zczW7CyQolcXxvcxoE9+/7fiy6sDQgFciDo1qswFRnYpVML4Y/UBb3howbVMONAt/fSnytT/DB5EH6FLKBxFOzmM9yuTacu4jo1HQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: drone-secret
+      namespace: drone-ci
+    type: Opaque

kubernetes/apps/disabled/drone/server/server-deployment.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone-server
+  namespace: drone-ci
+  labels:
+    app: drone
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: drone
+  template:
+    metadata:
+      labels:
+        app: drone
+    spec:
+      containers:
+        - name: drone
+          image: drone/drone:2
+          ports:
+            - containerPort: 80
+            - containerPort: 443
+          resources:
+            requests:
+              cpu: 50m
+              memory: 75Mi
+            limits:
+              cpu: 100m
+              memory: 200Mi
+          env:
+            - name: DRONE_GITEA_SERVER
+              value: "https://git.fascinated.cc"
+            - name: DRONE_GITEA_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_GITEA_CLIENT_ID
+            - name: DRONE_GITEA_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_GITEA_CLIENT_SECRET
+            - name: DRONE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_RPC_SECRET
+            - name: DRONE_SERVER_HOST
+              value: "drone.fascinated.cc"
+            - name: DRONE_SERVER_PROTO
+              value: "https"
+            - name: DRONE_REGISTRATION_CLOSED
+              value: "true"
+          volumeMounts:
+            - name: drone-data
+              mountPath: /data
+      volumes:
+        - name: drone-data
+          persistentVolumeClaim:
+            claimName: drone-pvc

kubernetes/apps/disabled/drone/server/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: drone-service
+  namespace: drone-ci
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP
+  selector:
+    app: drone

kubernetes/apps/disabled/searxng/config.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: searxng-config
+data:
+  limiter.toml: |
+    # This configuration file updates the default configuration file
+    # See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
+
+    [botdetection.ip_limit]
+    # activate link_token method in the ip_limit method
+    link_token = true
+
+  settings.yml: |
+    # see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings
+    use_default_settings: true
+    server:
+      # base_url is defined in the SEARXNG_BASE_URL environment variable, see .env and docker-compose.yml
+      limiter: true  # can be disabled for a private instance
+      image_proxy: false
+    ui:
+      static_use_hash: true
+    redis:
+      url: redis://searxng-redis:6379/0

kubernetes/apps/disabled/searxng/deployment.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng
+  namespace: public-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: searxng
+  template:
+    metadata:
+      labels:
+        app: searxng
+    spec:
+      containers:
+        - name: searxng
+          image: docker.io/searxng/searxng:2024.9.23-6be56aee1
+          ports:
+            - containerPort: 8080
+          env:
+            - name: SEARXNG_BASE_URL
+              value: "https://search.fascinated.cc"
+            - name: SEARXNG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: searxng-secret
+                  key: secret_key
+          volumeMounts:
+            - name: searxng-config-volume
+              mountPath: /etc/searxng/limiter.toml
+              subPath: limiter.toml
+            - name: searxng-config-volume
+              mountPath: /etc/searxng/settings.yml
+              subPath: settings.yml
+          resources:
+            requests:
+              memory: "1024Mi"
+              cpu: "100m"
+            limits:
+              memory: "1024M"
+              cpu: "500m"
+      volumes:
+        - name: searxng-config-volume
+          configMap:
+            name: searxng-config

kubernetes/apps/disabled/searxng/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: searxng-ingress
+  namespace: public-services
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`search.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: searxng-service
+          port: 8080
+  tls:
+    secretName: fascinated-cc

kubernetes/apps/disabled/searxng/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: public-services
+resources:
+  - ./redis/pvc.yaml
+  - ./redis/redis.yaml
+  - ./redis/service.yaml
+  - config.yaml
+  - sealed-secrets.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

kubernetes/apps/disabled/searxng/redis/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: searxng-redis-pvc
+  namespace: public-services
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

kubernetes/apps/disabled/searxng/redis/redis.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng-redis
+  namespace: public-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: searxng-redis
+  template:
+    metadata:
+      labels:
+        app: searxng-redis
+    spec:
+      containers:
+        - name: searxng-redis
+          image: docker.io/valkey/valkey:8-alpine
+          command:
+            ["valkey-server", "--save", "30", "1", "--loglevel", "warning"]
+          ports:
+            - containerPort: 6379
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: searxng-redis-pvc

kubernetes/apps/disabled/searxng/redis/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng-redis
+  namespace: public-services
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: 6379
+  selector:
+    app: searxng-redis

kubernetes/apps/disabled/searxng/sealed-secrets.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: searxng-secret
+  namespace: public-services
+spec:
+  encryptedData:
+    secret_key: AgC0GFaPKSBszjmam9HxhhPIKPj3aTaa7BtMEJJBaPUGRA7wPi/9utkHcQL5MG/1HB2nHwfVmBKQY/nmJaYIZBCE+MGjLljjVED37rNEj6PCTcptA/b27+Rnbn7XxH8Zt19uBZapWf0TO8EZaHu/6B9cYIiThlQ0o5+Im7nwuMoYymQSpxMAAr7O6i5cF4XaehYxiNhP1YfveW34Uit/VCMG8qyVi03YBnxsgUKdMeb8krAL2p5zH15ELSd6CprfYdkB8xTZkFYXxEctKyYywsI6ZEC3G0f2R+lcJ46e19wEEZSaCvT1Nviij/jdt4zafHjdQ+U3ZH69Sc83KwNxKJ3hDRdhM2Nl6wDrftl5IFtMFyk2fwOOPPxd8i096dmMBKzljgNgUYzbH4E3f4LBBjaoW0Nrdgkg0wEJplolfpiZVEOtlCm+Jm9tCxEWGEIkrysuZCv90kmd41fJb+k43/J5oY25gMMzUgqEryjR1fXXexgTQoNd1YKOft6DvWy6jZw/RjZWpwxmBHjtxKx9tbr0kwIx/ZCGAQhZ/4LjYCvmP9axV5h7anBbBgiVMA36BJq6nxg//wJ2GMy4CXlIs1oFpob0zTWOg/aCPwzTfK2GrzYXH6xLFqN1ueTdXSxNjb6qi4aOwOFtmZ9z53ffT/XeKyHVgXsLCt6THc1TJVzaqeHL7eM93RtPWlSezdSf84MfzewokisJd3TD3dDoSzhob43ckHlbFV7lbclzPBUAdw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: searxng-secret
+      namespace: public-services
+    type: Opaque

kubernetes/apps/disabled/searxng/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng-service
+  namespace: public-services
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: 8080
+  selector:
+    app: searxng

kubernetes/apps/production/flyimg/config.yaml

@@ -1,154 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: flyimg-config
-  namespace: public-services
-data:
-  parameters.yml: |
-    ---
-    # Debug
-    debug: false
-
-    # Home page title
-    home_page_title: Flyimg
-
-    # Number of days for header cache expires `max_age`
-    header_cache_days: 365
-
-    # To enable the Cleanup Cronjob to purge the var/tmp folder
-    enable_cronjob_cleanup: true
-
-    # The cronjob interval to cleanup the var/tmp folder
-    cronjob_cleanup_interval: "0 */5 * * *"
-
-    # Options separator
-    # When changing this value, you should change the OPTIONS_SEPARATOR value in web/js/main.js!
-    options_separator: ','
-
-    # Security: Signature generation
-    # Security key
-    security_key: ''
-    # Secret Initialization vector(IV)
-    security_iv: ''
-
-    # Restrict domains, false by default
-    restricted_domains: false
-
-    # If restricted_domains is enabled, put whitelist domains here
-    whitelist_domains:
-      - domain-1.com
-      - domain-2.com
-
-    # Default storage system is local, to use AWS S3, change this param to s3
-    storage_system: local
-
-    # In case storage_system: s3, you need to add those AWS S3 parameters:
-    aws_s3:
-      access_id: ''
-      secret_key: ''
-      region: 'eu-central-1'
-      bucket_name: ''
-
-    # Number of threads for Imagemagick to use
-    thread: 1
-
-    # For Avif format: conversion speed parameter for the HEIF library.
-    heic_speed: 8
-
-    # Read source image timeout in seconds
-    source_image_request_timeout: 5
-
-    # When set to true the generated image will be deleted from the cache in web/upload and served directly in the response
-    disable_cache: false
-
-    # When supported by the browser, AVIF format will be served as default output
-    enable_avif: true
-
-    # When supported by the browser, Webp format will be served as default output (after checking AVIF support)
-    enable_webp: true
-
-    # Extra options for the header sent to source image server, as some servers requires the User-Agent.
-    header_extra_options:
-      - 'User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201'
-
-    # List of request header to forward to source image server (example Authorization)
-    forward_request_headers: []
-
-    # Keys used in url to match options. Ex: q_80,w_200,h_100
-    options_keys:
-      q: quality
-      o: output
-      unsh: unsharp
-      sh: sharpen
-      blr: blur
-      fc: face-crop
-      fcp: face-crop-position
-      fb: face-blur
-      w: width
-      h: height
-      c: crop
-      bg: background
-      st: strip
-      ao: auto-orient
-      rz: resize
-      g: gravity
-      f: filter
-      r: rotate
-      sc: scale
-      sf: sampling-factor
-      rf: refresh
-      smc: smart-crop
-      ett: extent
-      par: preserve-aspect-ratio
-      pns: preserve-natural-size
-      webpl: webp-lossless
-      gf: gif-frame
-      e: extract
-      p1x: extract-top-x
-      p1y: extract-top-y
-      p2x: extract-bottom-x
-      p2y: extract-bottom-y
-      pdfp: pdf-page-number
-      tm: time
-      clsp: colorspace
-      mnchr: monochrome
-
-    # Default options values
-    default_options:
-      quality: 70
-      output: webp
-      unsharp: null
-      sharpen: null
-      blur: null
-      face-crop: 0
-      face-crop-position: 0
-      face-blur: 0
-      width: null
-      height: null
-      crop: null
-      background: null
-      strip: 1
-      auto-orient: 0
-      resize: null
-      gravity: Center
-      filter: Lanczos
-      rotate: null
-      scale: null
-      sampling-factor: 1x1
-      refresh: false
-      smart-crop: false
-      extent: null
-      preserve-aspect-ratio: 1
-      preserve-natural-size: 1
-      webp-lossless: 0
-      gif-frame: 0
-      extract: null
-      extract-top-x: null
-      extract-top-y: null
-      extract-bottom-x: null
-      extract-bottom-y: null
-      pdf-page-number: 1
-      time: '00:00:01'
-      colorspace: 'sRGB'
-      monochrome: null

kubernetes/apps/production/flyimg/deployment.yaml

@@ -16,11 +16,9 @@ spec:
     spec:
       containers:
         - name: flyimg-container
-          image: flyimg/flyimg:1.4.12
+          image: flyimg/flyimg:1.4.13
           securityContext:
             allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
           ports:
             - containerPort: 80
           resources:
@@ -33,13 +31,7 @@ spec:
           volumeMounts:
             - name: flyimg-storage
               mountPath: /var/www/html/web/uploads
-            - name: config-volume
-              mountPath: /var/www/html/config/parameters.yml
-              subPath: parameters.yml
       volumes:
         - name: flyimg-storage
           persistentVolumeClaim:
             claimName: flyimg-pvc
-        - name: config-volume
-          configMap:
-            name: flyimg-config

kubernetes/apps/production/flyimg/ingress.yaml

@@ -1,7 +1,7 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: capacitor-external-ingress
+  name: capacitor-ingress
   namespace: public-services
   annotations:
     kubernetes.io/ingress.class: traefik-external

kubernetes/apps/production/flyimg/kustomization.yaml

@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: public-services
 resources:
-  - config.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml

kubernetes/clusters/production/apps.yaml

@@ -5,7 +5,7 @@ metadata:
   name: apps
   namespace: flux-system
 spec:
-  interval: 10m0s
+  interval: 5m0s
   dependsOn:
     - name: infrastructure
   sourceRef:

kubernetes/clusters/production/flux-system/gotk-components.yaml

@@ -12331,7 +12331,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.3.0
+        image: ghcr.io/fluxcd/notification-controller:v1.4.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:

kubernetes/clusters/production/infrastructure.yaml

@@ -5,7 +5,7 @@ metadata:
   name: infrastructure
   namespace: flux-system
 spec:
-  interval: 10m0s
+  interval: 5m0s
   sourceRef:
     kind: GitRepository
     name: flux-system

kubernetes/infrastructure/backup/volsync.yaml

@@ -5,7 +5,7 @@ metadata:
   name: volsync-repository
   namespace: backups
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://backube.github.io/helm-charts/
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2

kubernetes/infrastructure/cert-manager/cert-manager.yaml

@@ -5,7 +5,7 @@ metadata:
   name: cert-manager
   namespace: cert-manager
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://charts.jetstack.io
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2

kubernetes/infrastructure/crds/traefik.crds.yaml

@@ -8,7 +8,7 @@ spec:
   interval: 30m
   url: https://github.com/traefik/traefik-helm-chart.git
   ref:
-    tag: v31.1.1
+    tag: v32.0.0
   ignore: |
     # exclude all
     /*

kubernetes/infrastructure/eraser/eraser.yaml

@@ -0,0 +1,549 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: eraser-system
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.0
+  creationTimestamp: null
+  name: imagejobs.eraser.sh
+spec:
+  group: eraser.sh
+  names:
+    kind: ImageJob
+    listKind: ImageJobList
+    plural: imagejobs
+    singular: imagejob
+  scope: Cluster
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: ImageJob is the Schema for the imagejobs API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            status:
+              description: ImageJobStatus defines the observed state of ImageJob.
+              properties:
+                deleteAfter:
+                  description: Time to delay deletion until
+                  format: date-time
+                  type: string
+                desired:
+                  description: desired number of pods
+                  type: integer
+                failed:
+                  description: number of pods that failed
+                  type: integer
+                phase:
+                  description: job running, successfully completed, or failed
+                  type: string
+                skipped:
+                  description: number of nodes that were skipped e.g. because they are not a linux node
+                  type: integer
+                succeeded:
+                  description: number of pods that completed successfully
+                  type: integer
+              required:
+                - desired
+                - failed
+                - phase
+                - skipped
+                - succeeded
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+    - deprecated: true
+      deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ImageJob is the Schema for the imagejobs API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            status:
+              description: ImageJobStatus defines the observed state of ImageJob.
+              properties:
+                deleteAfter:
+                  description: Time to delay deletion until
+                  format: date-time
+                  type: string
+                desired:
+                  description: desired number of pods
+                  type: integer
+                failed:
+                  description: number of pods that failed
+                  type: integer
+                phase:
+                  description: job running, successfully completed, or failed
+                  type: string
+                skipped:
+                  description: number of nodes that were skipped e.g. because they are not a linux node
+                  type: integer
+                succeeded:
+                  description: number of pods that completed successfully
+                  type: integer
+              required:
+                - desired
+                - failed
+                - phase
+                - skipped
+                - succeeded
+              type: object
+          type: object
+      served: true
+      storage: false
+      subresources:
+        status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.0
+  creationTimestamp: null
+  name: imagelists.eraser.sh
+spec:
+  group: eraser.sh
+  names:
+    kind: ImageList
+    listKind: ImageListList
+    plural: imagelists
+    singular: imagelist
+  scope: Cluster
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: ImageList is the Schema for the imagelists API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ImageListSpec defines the desired state of ImageList.
+              properties:
+                images:
+                  description: The list of non-compliant images to delete if non-running.
+                  items:
+                    type: string
+                  type: array
+              required:
+                - images
+              type: object
+            status:
+              description: ImageListStatus defines the observed state of ImageList.
+              properties:
+                failed:
+                  description: Number of nodes that failed to run the job
+                  format: int64
+                  type: integer
+                skipped:
+                  description: Number of nodes that were skipped due to a skip selector
+                  format: int64
+                  type: integer
+                success:
+                  description: Number of nodes that successfully ran the job
+                  format: int64
+                  type: integer
+                timestamp:
+                  description: Information when the job was completed.
+                  format: date-time
+                  type: string
+              required:
+                - failed
+                - skipped
+                - success
+                - timestamp
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+    - deprecated: true
+      deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ImageList is the Schema for the imagelists API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ImageListSpec defines the desired state of ImageList.
+              properties:
+                images:
+                  description: The list of non-compliant images to delete if non-running.
+                  items:
+                    type: string
+                  type: array
+              required:
+                - images
+              type: object
+            status:
+              description: ImageListStatus defines the observed state of ImageList.
+              properties:
+                failed:
+                  description: Number of nodes that failed to run the job
+                  format: int64
+                  type: integer
+                skipped:
+                  description: Number of nodes that were skipped due to a skip selector
+                  format: int64
+                  type: integer
+                success:
+                  description: Number of nodes that successfully ran the job
+                  format: int64
+                  type: integer
+                timestamp:
+                  description: Information when the job was completed.
+                  format: date-time
+                  type: string
+              required:
+                - failed
+                - skipped
+                - success
+                - timestamp
+              type: object
+          type: object
+      served: true
+      storage: false
+      subresources:
+        status: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eraser-controller-manager
+  namespace: eraser-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eraser-imagejob-pods
+  namespace: eraser-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: eraser-imagejob-pods-cluster-role
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: eraser-manager-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - podtemplates
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagejobs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagejobs/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagelists
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagelists/status
+    verbs:
+      - get
+      - patch
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eraser-imagejob-pods-cluster-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eraser-imagejob-pods-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: eraser-imagejob-pods
+    namespace: eraser-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eraser-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eraser-manager-role
+subjects:
+  - kind: ServiceAccount
+    name: eraser-controller-manager
+    namespace: eraser-system
+---
+apiVersion: v1
+data:
+  controller_manager_config.yaml: |
+    apiVersion: eraser.sh/v1alpha3
+    kind: EraserConfig
+    manager:
+      runtime:
+        name: containerd
+        address: unix:///run/containerd/containerd.sock
+      otlpEndpoint: ""
+      logLevel: info
+      scheduling:
+        repeatInterval: 24h
+        beginImmediately: true
+      profile:
+        enabled: false
+        port: 6060
+      imageJob:
+        successRatio: 1.0
+        cleanup:
+          delayOnSuccess: 0s
+          delayOnFailure: 24h
+      pullSecrets: [] # image pull secrets for collector/scanner/eraser
+      priorityClassName: "" # priority class name for collector/scanner/eraser
+      nodeFilter:
+        type: exclude # must be either exclude|include
+        selectors:
+          - eraser.sh/cleanup.filter
+          - kubernetes.io/os=windows
+    components:
+      collector:
+        enabled: true
+        image:
+          repo: ghcr.io/eraser-dev/collector
+          tag: v1.4.0-beta.0
+        request:
+          mem: 25Mi
+          cpu: 7m
+        limit:
+          mem: 500Mi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+      scanner:
+        enabled: true
+        image:
+          repo: ghcr.io/eraser-dev/eraser-trivy-scanner # supply custom image for custom scanner
+          tag: v1.4.0-beta.0
+        request:
+          mem: 500Mi
+          cpu: 1000m
+        limit:
+          mem: 2Gi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+        # The config needs to be passed through to the scanner as yaml, as a
+        # single string. Because we allow custom scanner images, the scanner is
+        # responsible for defining a schema, parsing, and validating.
+        config: |
+          # this is the schema for the provided 'trivy-scanner'. custom scanners
+          # will define their own configuration.
+          cacheDir: /var/lib/trivy
+          dbRepo: ghcr.io/aquasecurity/trivy-db
+          deleteFailedImages: true
+          deleteEOLImages: true
+          vulnerabilities:
+            ignoreUnfixed: true
+            types:
+              - os
+              - library
+            securityChecks:
+              - vuln
+            severities:
+              - CRITICAL
+              - HIGH
+              - MEDIUM
+              - LOW
+            ignoredStatuses:
+          timeout:
+            total: 23h
+            perImage: 1h
+      remover:
+        image:
+          repo: ghcr.io/eraser-dev/remover
+          tag: v1.4.0-beta.0
+        request:
+          mem: 25Mi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+        limit:
+          mem: 30Mi
+          cpu: 0
+kind: ConfigMap
+metadata:
+  name: eraser-manager-config
+  namespace: eraser-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: eraser-controller-manager
+  namespace: eraser-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+    spec:
+      containers:
+        - args:
+            - --config=/config/controller_manager_config.yaml
+          command:
+            - /manager
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: OTEL_SERVICE_NAME
+              value: eraser-manager
+          image: ghcr.io/eraser-dev/eraser-manager:v1.5.0-beta.0
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          name: manager
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              memory: 30Mi
+            requests:
+              cpu: 100m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsGroup: 65532
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /config
+              name: manager-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      serviceAccountName: eraser-controller-manager
+      terminationGracePeriodSeconds: 10
+      volumes:
+        - configMap:
+            name: eraser-manager-config
+          name: manager-config

kubernetes/infrastructure/eraser/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eraser-system
+resources:
+  - eraser.yaml

kubernetes/infrastructure/fluxci/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - ./notification/sealed-secrets.yaml
+  - ./notification/reciever.yaml
+  - ./notification/ingress.yaml

kubernetes/infrastructure/fluxci/notification/ingress.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: flux-notifications-ingress
+  namespace: flux-system
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`flux-notifications.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: notification-controller
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/infrastructure/fluxci/notification/reciever.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  name: webapp
+  namespace: flux-system
+spec:
+  type: github
+  events:
+    - "ping"
+    - "push"
+  secretRef:
+    name: notification-secret
+  resources:
+    - kind: GitRepository
+      name: webapp

kubernetes/infrastructure/fluxci/notification/sealed-secrets.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: notification-secret
+  namespace: flux-system
+spec:
+  encryptedData:
+    token: AgB9gxfRBYdK3njhBAyXkKsFDSxncYLfO33bvV4Rq7hu4H6OM43xseXveMoSN5+Bw9gvjoaIkn/2Z7pUXNCIUwzG+JAtkDDyY25Xkmu53FN96f3ZUFBQyvtPcB3WTai3spki8GABqLUUkRFX3j7j+hBKLLdryKpkv77OSs/rh0K6V+LhtDjedSW+dKaywPA2kwf1jaX4T675fZpe0h5xpiV1KWO+mHyAmF03CgCC2LvnpCze1/6ZToU6EC+hETe2W6r3fDMxffnkggDgDO0hGy6py4ID00TFXd23dMHu/72caUUgFZGgKTkCF5/+AvOPNoVAaZSrs1V9xPPljYyCzDTucV8O7TfrG6tvsyPG74wU+y9R1OAbq/ZWBh8grMB8zfRHNKMbpGnCphcnB98vkZLQXAnlWYpCJOmerkQYBxiMs3l6XBbDPURuyO2/xOJe70XXDQ7BPA7ZsCilNQNSm+xY9U0Uf8g9oycNBhFoy96+b3VMy7VvAl0smsBPu4VuUwGxAJTftAmqT6lBFoordynEcUiL+q/xph7gKEZj6JQtNibrw5p8k1V8MreoWZe2DmeelgDvZcT7QpPgrHDvbCKNeHM2xFlOzgemBK8+/+Qcr9gZAJGQKE8ppUssD5zDECzk76A2mZ7/tJkGQFaFrC5zh7WDnpMfdXDkQac5e6hKFDAvuBckfgcLok8AAMlCeQgDcdwjlnrGXs1ZFYbvf73gIoAJknB9WZ44tM0I7Um3nzlqGXn5GF2S
+  template:
+    metadata:
+      creationTimestamp: null
+      name: notification-secret
+      namespace: flux-system
+    type: Opaque

kubernetes/infrastructure/kustomization.yaml

@@ -3,12 +3,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespaces
+  - sealed-secrets
   - cert-manager
   - crds
   - metallb
+  - fluxci
   - nfs
   - traefik
   - capacitor
   - monitoring
   - alerting/flux
+  - eraser
+  - spegel
   #- backup

kubernetes/infrastructure/monitoring/kube-prometheus-stack.yaml

@@ -5,7 +5,7 @@ metadata:
   name: monitoring
   namespace: monitoring
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://prometheus-community.github.io/helm-charts
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "62.7.0"
+      version: "63.1.0"
       sourceRef:
         kind: HelmRepository
         name: monitoring
@@ -56,3 +56,20 @@ spec:
               resources:
                 requests:
                   storage: 50Gi
+
+    # ServiceMonitor configurations
+    serviceMonitors:
+      node-exporter:
+        metricRelabelings:
+          - action: replace
+            regex: (.*)
+            replacement: $1
+            sourceLabels:
+              - __meta_kubernetes_pod_node_name
+            targetLabel: kubernetes_node
+      kubelet:
+        metricRelabelings:
+          - action: replace
+            sourceLabels:
+              - node
+            targetLabel: instance

kubernetes/infrastructure/nfs/nfs-driver.yaml

@@ -5,7 +5,7 @@ metadata:
   name: csi-driver-nfs
   namespace: kube-system
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2

kubernetes/infrastructure/sealed-secrets/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - sealed-secrets.yaml

kubernetes/infrastructure/sealed-secrets/sealed-secrets.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 5m0s
+  url: https://bitnami-labs.github.io/sealed-secrets
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: sealed-secrets
+      version: "2.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: sealed-secrets
+        namespace: kube-system
+      interval: 12h
+  values:
+    fullnameOverride: "sealed-secrets-controller"

kubernetes/infrastructure/spegel/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: spegel
+resources:
+  - namespace.yaml
+  - spegel.yaml

kubernetes/infrastructure/spegel/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spegel
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/infrastructure/spegel/spegel.yaml

@@ -0,0 +1,42 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  type: "oci"
+  interval: 5m0s
+  url: oci://ghcr.io/spegel-org/helm-charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  interval: 1m
+  chart:
+    spec:
+      chart: spegel
+      version: "v0.0.24"
+      interval: 5m
+      sourceRef:
+        kind: HelmRepository
+        name: spegel
+  values:
+    spegel:
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
+      registries:
+        [
+          "https://cgr.dev",
+          "https://docker.io",
+          "https://ghcr.io",
+          "https://quay.io",
+          "https://mcr.microsoft.com",
+          "https://public.ecr.aws",
+          "https://gcr.io",
+          "https://registry.k8s.io",
+          "https://k8s.gcr.io",
+          "https://lscr.io",
+          "https://git.fascinated.cc",
+        ]

kubernetes/infrastructure/traefik/traefik.yaml

@@ -5,7 +5,7 @@ metadata:
   name: traefik
   namespace: traefik
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://helm.traefik.io/traefik
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
@@ -18,7 +18,7 @@ spec:
   chart:
     spec:
       chart: traefik
-      version: "31.1.1"
+      version: "32.0.0"
       sourceRef:
         kind: HelmRepository
         name: traefik
@@ -31,17 +31,21 @@ spec:
 
     additionalArguments:
       - "--serversTransport.insecureSkipVerify=true"
-      - "--log.level=INFO"
       - "--providers.kubernetescrd.allowCrossNamespace=true"
-      - "--accesslog=true"
+      - "--log.level=INFO"
+      #- "--accesslog=true"
 
     resources:
       requests:
-        cpu: 100m
-        memory: 128Mi
+        cpu: 50m
+        memory: 256Mi
       limits:
-        cpu: 1000m # 1 vCPU
-        memory: 1024Mi # Update when traefik fixes their shitty mem leak
+        cpu: 200m
+        memory: 512Mi # Update when traefik fixes their shitty mem leak
+
+    # Disable metrics
+    metrics:
+      prometheus: null
 
     deployment:
       enabled: true

talos-cluster/controlplane.yaml

@@ -1,547 +0,0 @@
-version: v1alpha1 # Indicates the schema used to decode the contents.
-debug: false # Enable verbose logging to the console.
-persist: true
-# Provides machine specific configuration options.
-machine:
-  type: controlplane # Defines the role of the machine within the cluster.
-  token: 5ab53f.syav4oqxxfjhkgvt # The `token` is used by a machine to join the PKI of the cluster.
-  # The root certificate authority of the PKI.
-  ca:
-    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEExa1dmcVNjNVNxRWZjSENObXRCb2ZNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5EQTVNakV4T1RRNU1qUmFGdzB6TkRBNU1Ua3hPVFE1TWpSYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBcDdCcExBbUEwWlMrYXJINWJHek1kRHRLTlVnQWVuZ2p4TmliCkw5Mm0zbkdqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVSXZhb2FvRTRscFNDOUNqZApmV1k3TE5OZkh3Y3dCUVlESzJWd0EwRUFEQnFRSmZiOTVlbWJjSTVzNW52NW9lblRqc3RpOEpjaVYrbUppellUCjFYU1FsTm1uTngyVjJqSVhaclB2cCtXQWNkU1dVKzdnM3kvbUJITjlGL2hRQkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJQWUzUUQ0OWM1bnZycjNWeGd4dklDc25yQ29JM3ZiMWRmV0JEbnlYcjhKNwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
-  # Extra certificate subject alternative names for the machine's certificate.
-  certSANs: []
-  #   # Uncomment this to enable SANs.
-  #   - 10.0.0.10
-  #   - 172.16.0.10
-  #   - 192.168.0.10
-
-  # Used to provide additional options to the kubelet.
-  kubelet:
-    image: ghcr.io/siderolabs/kubelet:v1.30.3 # The `image` field is an optional reference to an alternative kubelet image.
-    defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
-    disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
-
-    # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
-    # clusterDNS:
-    #     - 10.96.0.10
-    #     - 169.254.2.53
-
-    # # The `extraArgs` field is used to provide additional flags to the kubelet.
-    # extraArgs:
-    #     key: value
-
-    # # The `extraMounts` field is used to add additional mounts to the kubelet container.
-    # extraMounts:
-    #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
-    #       type: bind # Type specifies the mount kind.
-    #       source: /var/lib/example # Source specifies the source path of the mount.
-    #       # Options are fstab style mount options.
-    #       options:
-    #         - bind
-    #         - rshared
-    #         - rw
-
-    # # The `extraConfig` field is used to provide kubelet configuration overrides.
-    # extraConfig:
-    #     serverTLSBootstrap: true
-
-    # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
-    # credentialProviderConfig:
-    #     apiVersion: kubelet.config.k8s.io/v1
-    #     kind: CredentialProviderConfig
-    #     providers:
-    #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
-    #           defaultCacheDuration: 12h
-    #           matchImages:
-    #             - '*.dkr.ecr.*.amazonaws.com'
-    #             - '*.dkr.ecr.*.amazonaws.com.cn'
-    #             - '*.dkr.ecr-fips.*.amazonaws.com'
-    #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
-    #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
-    #           name: ecr-credential-provider
-
-    # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
-    # nodeIP:
-    #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
-    #     validSubnets:
-    #         - 10.0.0.0/8
-    #         - '!10.0.0.3/32'
-    #         - fdc7::/16
-  # Provides machine specific network configuration options.
-  network: {}
-  # # `interfaces` is used to define the network interface configuration.
-  # interfaces:
-  #     - interface: enp0s1 # The interface name.
-  #       # Assigns static IP addresses to the interface.
-  #       addresses:
-  #         - 192.168.2.0/24
-  #       # A list of routes associated with the interface.
-  #       routes:
-  #         - network: 0.0.0.0/0 # The route's network (destination).
-  #           gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
-  #           metric: 1024 # The optional metric for the route.
-  #       mtu: 1500 # The interface's MTU.
-  #
-  #       # # Picks a network device using the selector.
-
-  #       # # select a device with bus prefix 00:*.
-  #       # deviceSelector:
-  #       #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
-  #       # deviceSelector:
-  #       #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #     driver: virtio # Kernel driver, supports matching by wildcard.
-  #       # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
-  #       # deviceSelector:
-  #       #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #       driver: virtio # Kernel driver, supports matching by wildcard.
-
-  #       # # Bond specific options.
-  #       # bond:
-  #       #     # The interfaces that make up the bond.
-  #       #     interfaces:
-  #       #         - enp2s0
-  #       #         - enp2s1
-  #       #     # Picks a network device using the selector.
-  #       #     deviceSelectors:
-  #       #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #           driver: virtio # Kernel driver, supports matching by wildcard.
-  #       #     mode: 802.3ad # A bond option.
-  #       #     lacpRate: fast # A bond option.
-
-  #       # # Bridge specific options.
-  #       # bridge:
-  #       #     # The interfaces that make up the bridge.
-  #       #     interfaces:
-  #       #         - enxda4042ca9a51
-  #       #         - enxae2a6774c259
-  #       #     # A bridge option.
-  #       #     stp:
-  #       #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
-
-  #       # # Indicates if DHCP should be used to configure the interface.
-  #       # dhcp: true
-
-  #       # # DHCP specific options.
-  #       # dhcpOptions:
-  #       #     routeMetric: 1024 # The priority of all routes received via DHCP.
-
-  #       # # Wireguard specific configuration.
-
-  #       # # wireguard server example
-  #       # wireguard:
-  #       #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
-  #       #     listenPort: 51111 # Specifies a device's listening port.
-  #       #     # Specifies a list of peer configurations to apply to a device.
-  #       #     peers:
-  #       #         - publicKey: ABCDEF... # Specifies the public key of this peer.
-  #       #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
-  #       #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
-  #       #           allowedIPs:
-  #       #             - 192.168.1.0/24
-  #       # # wireguard peer example
-  #       # wireguard:
-  #       #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
-  #       #     # Specifies a list of peer configurations to apply to a device.
-  #       #     peers:
-  #       #         - publicKey: ABCDEF... # Specifies the public key of this peer.
-  #       #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
-  #       #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
-  #       #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
-  #       #           allowedIPs:
-  #       #             - 192.168.1.0/24
-
-  #       # # Virtual (shared) IP address configuration.
-
-  #       # # layer2 vip example
-  #       # vip:
-  #       #     ip: 172.16.199.55 # Specifies the IP address to be used.
-
-  # # Used to statically set the nameservers for the machine.
-  # nameservers:
-  #     - 8.8.8.8
-  #     - 1.1.1.1
-
-  # # Allows for extra entries to be added to the `/etc/hosts` file
-  # extraHostEntries:
-  #     - ip: 192.168.1.100 # The IP of the host.
-  #       # The host alias.
-  #       aliases:
-  #         - example
-  #         - example.domain.tld
-
-  # # Configures KubeSpan feature.
-  # kubespan:
-  #     enabled: true # Enable the KubeSpan feature.
-
-  # Used to provide instructions for installations.
-  install:
-    disk: /dev/sda # The disk used for installations.
-    image: ghcr.io/siderolabs/installer:v1.7.6 # Allows for supplying the image used to perform the installation.
-    wipe: false # Indicates if the installation disk should be wiped at installation time.
-
-    # # Look up disk using disk attributes like model, size, serial and others.
-    # diskSelector:
-    #     size: 4GB # Disk size.
-    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
-    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
-
-    # # Allows for supplying extra kernel args via the bootloader.
-    # extraKernelArgs:
-    #     - talos.platform=metal
-    #     - reboot=k
-
-    # # Allows for supplying additional system extension images to install on top of base Talos image.
-    # extensions:
-    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
-  # Used to configure the machine's container image registry mirrors.
-  registries: {}
-  # # Specifies mirror configuration for each registry host namespace.
-  # mirrors:
-  #     ghcr.io:
-  #         # List of endpoints (URLs) for registry mirrors to use.
-  #         endpoints:
-  #             - https://registry.insecure
-  #             - https://ghcr.io/v2/
-
-  # # Specifies TLS & auth configuration for HTTPS image registries.
-  # config:
-  #     registry.insecure:
-  #         # The TLS configuration for the registry.
-  #         tls:
-  #             insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
-  #
-  #             # # Enable mutual TLS authentication with the registry.
-  #             # clientIdentity:
-  #             #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
-  #             #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
-  #
-  #         # # The auth configuration for this registry.
-  #         # auth:
-  #         #     username: username # Optional registry authentication.
-  #         #     password: password # Optional registry authentication.
-
-  # Features describe individual Talos features that can be switched on or off.
-  features:
-    rbac: true # Enable role-based access control (RBAC).
-    stableHostname: true # Enable stable default hostname.
-    apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
-    diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
-    # KubePrism - local proxy/load balancer on defined port that will distribute
-    kubePrism:
-      enabled: true # Enable KubePrism support - will start local load balancing proxy.
-      port: 7445 # KubePrism port.
-    # Configures host DNS caching resolver.
-    hostDNS:
-      enabled: true # Enable host DNS caching resolver.
-
-    # # Configure Talos API access from Kubernetes pods.
-    # kubernetesTalosAPIAccess:
-    #     enabled: true # Enable Talos API access from Kubernetes pods.
-    #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
-    #     allowedRoles:
-    #         - os:reader
-    #     # The list of Kubernetes namespaces Talos API access is available from.
-    #     allowedKubernetesNamespaces:
-    #         - kube-system
-
-  # # Provides machine specific control plane configuration options.
-
-  # # ControlPlane definition example.
-  # controlPlane:
-  #     # Controller manager machine specific configuration options.
-  #     controllerManager:
-  #         disabled: false # Disable kube-controller-manager on the node.
-  #     # Scheduler machine specific configuration options.
-  #     scheduler:
-  #         disabled: true # Disable kube-scheduler on the node.
-
-  # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
-
-  # # nginx static pod.
-  # pods:
-  #     - apiVersion: v1
-  #       kind: pod
-  #       metadata:
-  #         name: nginx
-  #       spec:
-  #         containers:
-  #             - image: nginx
-  #               name: nginx
-
-  # # Used to partition, format and mount additional disks.
-
-  # # MachineDisks list example.
-  # disks:
-  #     - device: /dev/sdb # The name of the disk to use.
-  #       # A list of partitions to create on the disk.
-  #       partitions:
-  #         - mountpoint: /var/mnt/extra # Where to mount the partition.
-  #
-  #           # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
-
-  #           # # Human readable representation.
-  #           # size: 100 MB
-  #           # # Precise value in bytes.
-  #           # size: 1073741824
-
-  # # Allows the addition of user specified files.
-
-  # # MachineFiles usage example.
-  # files:
-  #     - content: '...' # The contents of the file.
-  #       permissions: 0o666 # The file's permissions in octal.
-  #       path: /tmp/file.txt # The path of the file.
-  #       op: append # The operation to use
-
-  # # The `env` field allows for the addition of environment variables.
-
-  # # Environment variables definition examples.
-  # env:
-  #     GRPC_GO_LOG_SEVERITY_LEVEL: info
-  #     GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
-  #     https_proxy: http://SERVER:PORT/
-  # env:
-  #     GRPC_GO_LOG_SEVERITY_LEVEL: error
-  #     https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
-  # env:
-  #     https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
-
-  # # Used to configure the machine's time settings.
-
-  # # Example configuration for cloudflare ntp server.
-  # time:
-  #     disabled: false # Indicates if the time service is disabled for the machine.
-  #     # description: |
-  #     servers:
-  #         - time.cloudflare.com
-  #     bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
-
-  # # Used to configure the machine's sysctls.
-
-  # # MachineSysctls usage example.
-  # sysctls:
-  #     kernel.domainname: talos.dev
-  #     net.ipv4.ip_forward: "0"
-  #     net/ipv6/conf/eth0.100/disable_ipv6: "1"
-
-  # # Used to configure the machine's sysfs.
-
-  # # MachineSysfs usage example.
-  # sysfs:
-  #     devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
-
-  # # Machine system disk encryption configuration.
-  # systemDiskEncryption:
-  #     # Ephemeral partition encryption.
-  #     ephemeral:
-  #         provider: luks2 # Encryption provider to use for the encryption.
-  #         # Defines the encryption keys generation and storage method.
-  #         keys:
-  #             - # Deterministically generated key from the node UUID and PartitionLabel.
-  #               nodeID: {}
-  #               slot: 0 # Key slot number for LUKS2 encryption.
-  #
-  #               # # KMS managed encryption key.
-  #               # kms:
-  #               #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
-  #
-  #         # # Cipher kind to use for the encryption. Depends on the encryption provider.
-  #         # cipher: aes-xts-plain64
-
-  #         # # Defines the encryption sector size.
-  #         # blockSize: 4096
-
-  #         # # Additional --perf parameters for the LUKS2 encryption.
-  #         # options:
-  #         #     - no_read_workqueue
-  #         #     - no_write_workqueue
-
-  # # Configures the udev system.
-  # udev:
-  #     # List of udev rules to apply to the udev system
-  #     rules:
-  #         - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
-
-  # # Configures the logging system.
-  # logging:
-  #     # Logging destination.
-  #     destinations:
-  #         - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
-  #           format: json_lines # Logs format.
-
-  # # Configures the kernel.
-  # kernel:
-  #     # Kernel modules to load.
-  #     modules:
-  #         - name: brtfs # Module name.
-
-  # # Configures the seccomp profiles for the machine.
-  # seccompProfiles:
-  #     - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
-  #       # The `value` field is used to provide the seccomp profile.
-  #       value:
-  #         defaultAction: SCMP_ACT_LOG
-
-  # # Configures the node labels for the machine.
-
-  # # node labels example.
-  # nodeLabels:
-  #     exampleLabel: exampleLabelValue
-
-  # # Configures the node taints for the machine. Effect is optional.
-
-  # # node taints example.
-  # nodeTaints:
-  #     exampleTaint: exampleTaintValue:NoSchedule
-# Provides cluster specific configuration options.
-cluster:
-  id: 5wojSDc7TVbIkS2ard2EyFd9450s1asuoPU6BkDHVmA= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
-  secret: T+H+CyyVS3nYAyPl45PsRGWOzdnvRoHmjp57l2FOcV0= # Shared secret of cluster (base64 encoded random 32 bytes).
-  # Provides control plane specific configuration options.
-  controlPlane:
-    endpoint: https://10.0.69.162:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
-  clusterName: hl-cluster # Configures the cluster's name.
-  # Provides cluster specific network configuration options.
-  network:
-    dnsDomain: cluster.local # The domain used by Kubernetes DNS.
-    # The pod subnet CIDR.
-    podSubnets:
-      - 10.244.0.0/16
-    # The service subnet CIDR.
-    serviceSubnets:
-      - 10.96.0.0/12
-
-    # # The CNI used.
-    # cni:
-    #     name: custom # Name of CNI to use.
-    #     # URLs containing manifests to apply for the CNI.
-    #     urls:
-    #         - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
-  token: 3t3mw0.htvvap2rultkiu6l # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
-  secretboxEncryptionSecret: uW0Dpxwyi9X6KxDpCx2+fcLFN5dt/HQPJwXRBRAAdYk= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
-  # The base64 encoded root certificate authority used by Kubernetes.
-  ca:
-    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQUp1QVZTajlKMDdWdFkxaExGNU5GcVF3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOREE1TWpFeE9UUTVNalJhRncwek5EQTVNVGt4T1RRNQpNalJhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNXYndSa3BEakdOTnlvTlpvbEFnQStoVzJFU3B6MWpGMzZiSCtLQnpZVTROZUFDcGxNbzN0THBrWjEKMi9IQUVwN2VYWDI3L21WbWR4eE1jemY0OHNiT28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTDFJSG9MRnc2Q0hkZ3JPazhyVys2MTR4cC9HTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDZUFXeWgKZldrM0V2SXh4bU1DQ2tGT1d2ZFptWlVhTkpndElmKzQyTGVhZkFJaEFOSHVvMWJ0cnRRTkhnNlM1NHhwVDhELwpyR1J4L015dDNjZHFKK0JCRnhMQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUorU2hHVjVnZEdzc3F5dDBFbGlOSWI1TkxkaVAwMXcxUVFmM0xEdUYxTDhvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbG04RVpLUTR4alRjcURXYUpRSUFQb1Z0aEVxYzlZeGQrbXgvaWdjMkZPRFhnQXFaVEtONwpTNlpHZGR2eHdCS2UzbDE5dS81bFpuY2NUSE0zK1BMR3pnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
-  # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
-  aggregatorCA:
-    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYakNDQVFXZ0F3SUJBZ0lRWUp0bG54dkdRRkZhQndpaUVvTHlWVEFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJME1Ea3lNVEU1TkRreU5Gb1hEVE0wTURreE9URTVORGt5TkZvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCSmJOVzFaS0ZRNWpZdXQ5WGhaMVZIUUdKdUI1ME5ERzFiV0ozeE4vcjF4RHdoNWNTWFRnCkxiTTZIWDlBS2hmeDZCY2VISXJZU0NTQVBZZGlwVlc3QTRTallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVzc2FaVWZoeTlDS0ppSHVYWVhkK3BXZlhXMXN3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnCkNnQW5oRy9EZnFmSG9CbVA4YTBOR1RmZEFYdE1lRTVWNGtRNkZzbWtJaVFDSUNBTUtiRE8xUVNJNzdjZll0dzcKYTRlM1dpbXhPWS9VUlphQ2RpcVpDN25mCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-    key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJ3YkNCMU52dkZrNWNIUmsxRVFWZFFUcjkzUkwrZytrOFl1N2QyOVVXVE1vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbHMxYlZrb1ZEbU5pNjMxZUZuVlVkQVltNEhuUTBNYlZ0WW5mRTMrdlhFUENIbHhKZE9BdApzem9kZjBBcUYvSG9GeDRjaXRoSUpJQTloMktsVmJzRGhBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
-  # The base64 encoded private key for service account token generation.
-  serviceAccount:
-    key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBeHVBM05kMDZBT2xET250QWJJbmpYWUU2ak43NFRYVklUcWlOV3UxcmwzMEJJWEExCndob2ttN25oL3VMb1JXRTIweWg0SkRYa2tTMjI5THI3THRCOUE1NG5ETkc4V1NhTW5ldlFacU1oK1VkWXpNOWcKanNjbTBUdUxISWRTdUtXdlgrSlpaWTMwSmxVZ2Y0aDIzUDhMQUg4WnN3b0t1RTFwWHZGZ0gva01WclVrZUtmawppT0VyT2VDWjlnNWIrMEJqd1UxMUQxaHhZdU1iaUJ2azJYVGVmdjFDSnRZcm05WHA0UEo2RFRHQzBOTFh5L0tUCkg0QUR2S1lOdkorZWJDemIza2pRZlc0TW8vd3FFeDI5Zi93eC8xVFV3UGttSWl1WXdYRVBKY3hDb1VOTHhIUnMKRnNhYzlWc1NBWjA2YUFsL1o2a1NJa2VnM0pteUp1OFhBUm5xcS9UOHNSYmsvdEdCNmsrTTltZnh6c2Q0bVJ0UQpuTTJJaU5RaEkrRjY3ZVZLY0NCS21VODlsVnJnTUx0MUJJQzJvUHRlNytlaFVYSUJoQldVd0pFTHlVTDhyZ0dxCmJOczRzTmJSY0F4UnY2a1FwdFh0S241WWpEVlBLOXREOElpZUdJbFA5dFZMYzVSR1grd1BwbW15ODU1aGVVRGEKV1U3NVJVU29LOHFYdjBWYUJ5U2tNVU1tZTNlbmpkUlRMd1FGU25kOXp6WC9NdHM0ajJ3eEgxeDBKWnhsK09qNQpINU1jbExEeFZpUjY1NWV6VU9xdWtYQWlDTzlhN0ZDN1NsVFV1b2xNMzlCUzBLZVFJV2FEODJNeGZJSVU3V3R3CnQwQjBwLzF5MWpmaCs4N28yZkF2SGtHcXFHS0dqeSttSzZ4dkhRK2luYTNVME1FcG4rQlVEa2RzN1ZzQ0F3RUEKQVFLQ0FnRUFwTzh1MnEwdWZiTDIzbmw1WklxMjFjVm5HWTJSd0N1VVhDZk5rNnR6bjU4OFlNNyt4b3VIOE42bwpYd3N3TnRuNDdnYVNIUFhWS2RJUCtjZFlxZXFldzNGV1VYdGdDVSsvTHZselRLdmVjUzZLcHRFVjgxT1hEYytqCi8zVDdWY2VUT3FJdUlkc29zT0hJb2Z3N0YrMHM0cXlHVThYd1BnbDFhaGdrOEY5THJGMXVjZUpMMW5sbnNBaGwKcDNzaExhNnBESmVBamNsN3Y5YzU3aGUwSStTWTRoaUgxRTJxdlFNYmhFT1VsWHlLVVVXTFVzbEsyc1VBVkdRaQo0RnhBdHRZOVFveUEzSVY0VmtlN1hUODgrZmZlUHpQTGZuOGk4UlBYREJjSHlRRXVBVEFlbGo4M3BXdnlvRWwzCkZYK2dBTWhmc1VpMmtWZDJRWDMyRWZRWDBBSCtiRWZ0ei95bzJxR091d09wTW5pZHg5OGcybDRYVGx3Nm5FSVAKVkdIT1ZhdkprSUxGRkpuZFdoYWxneUNVaVVTdmJIaTV4T2JqOUtSMytqQlJaMmR4b3RuTTB6emcrZ0NuV3FlTApJUVdqWU95Tm01bDJLOEcxTUx4VUR0Q1ZXU0J4c1RzRU15NTBZZ05XUlVlODAybmtmTFpsRzNIcW1Bak5MaEJaClBWMlVkbkVpblVWWWk2QlFFc2Fwcy9zK3lKVElWQlI3aEppbExpSDdWcEh1SkxSaEJIb21Db2hCQkpTWlBoZWwKV1lNcEtqVDdxaWM0MnN4Q1Y0d3BCM2VCQStmaElkR09rY1AvSG5jekIvZ3JpMkt5YllFTDhiYlRwRnhoVmJiMgpRLzNUUlU2a0xTSm9aU0QwMVJaVGk2UU1ldmJoTE1rWFRMRFdPN28zelVQZVF3YXFZSUVDZ2dFQkFPRHZ0UDlLClB0Qk5KT0wwcTVkNG9EOEp1ZHJ0V3pTSzA1QzVpOFlJWE5SWldhZEFpTTNxTWF3djdWYmZUYklUdXZaclgwbEEKcC9wRVRRbjJURFdwZ3dRTVQ1bzVmWCtrS2h3Y2xPTXpEVTFFWnVZa3ZiSUI4Sk5NNGxtMlZ6Q0kvYitYdTBXcwpUczJPVjk2MkllMXRFUjhSQnJCVFVKMWdGV3htV2IxZS80UVZGemdNWFFnaTNaejBzUi9ndDBBcjcvVDRDTjJICm1Yc2hnRVJzRjRzQXhEK2RRbXBGL1ExTHVReldjRGNBa0JMV3pQTW1rdk1RcWliRVhmcENZRy8vKzhIVjl3TVAKQjMxd0syUElPODRkNmxiNXV4RFpRbzdVY2VpeTk4d0ZOR3ZOSFZZSmRzTlQyTFN4ME5sMU83Qm1laGtiakdKaQp2ZGkyVFNIRGdpUXJWMWNDZ2dFQkFPSlhMWHE4eDFkTW1lNExhaFNaSWVNTkFsL2hiVGI2NFRiWEdQZnduQmkxCkhrQ1JZSjVVazVmSDRXVTZHc1JyOUlhSzB5aXlyT1VISm0xT25IdUZNWGZES3BYck5uMlB1YTJrVDlDemdNV0oKSS9IUEx0Q04xZlJ1VFVDU21qaWJLY3piOWtySUl6dVFiVElLVmh0bHV5N2xXZmJEYlNJcG52QWNyYklhSWptVAoyT2JXbVk3cEpvYld3azRyZGNueTd6WWIyYkdTbnlUMmRwQWZOTGloVHY5SmpyWnBoYjhHV2ZEMDZUUVVBN29KCno3RFVMSlhNc3VTZW1qNEQrY0RJOFh2emlrbWJDckxTYXpnU2NNQnJTaTdCSUxUWk1XV1BaVjVTQkU3M0VLRHYKU3pxUVZGT2pXV0s3TDk2T1BSQUZ3VytKbWtNUkdkYk1xbWkvL2Z3QmE1MENnZ0VCQUkyOVh1OXppSXRYNFVPRwphODRoKzlCZFA1azk4amYwdHdZK2RWNVBqTGRlcWtqak9KR1Ezc1lpMlVyaG9hTHlIZUVEbmVLWjlIK1dwSGovCms5eEl1YjlHUnE3blJUYTJhcmFXS0JmVzVxM215WFNDZUdxQUlHbWhqQXgrQXdrWmVkUk9OM3JhN2psSFZnV0gKL1c4UVNEYXNVdXV2UkdBMjJLa2JBYmQ3OGtUM3lVN1BNNXhaNUEzd2Z1Q1lpTURPTHdITmZrQ2lIc3ZoTzJOaQpQWitnMXdsQy9rUGJZRzhOWlVrNm96RjFrRlBldVAwTE5KUW56eUJvb3ROOUdpblpRM3BNYXIrcHE4MldiakVOClR1bytIWm02K2U3UENNcmFBZ0ZoTFJhSnZST2xCN1JjZUZMek5kMy9JcHkwNit6blZrOFY5ZXRWVDA0TTZpTzUKZi90c3VEY0NnZ0VBVVVmN1JodHEvcmU4ZzViSHhwUGpiblVxaUNJZEpXUmM0bVBHVEt1MGNzOEFDVEhyMzVBQgozTHpqL1lVclBhU0RFSm5rRUxaeGptSE44KzBLRnZXUytTNDJLZFpwSUJnd0Z1SnQ0MFhERmEwVkltNURvcE44CjVTV0RTcEFiSC83Z3VQZTQ3OHdGa3d0Zm0xdkk1bGZYSzVVamhKRlRyTFFEcHJpMXk4TEV6YWFCZXd4UDR0bHAKZzN5MkZIcFk5MmZ0YmFIOHdGOG1GWkVJck9MMy9PRzR5OGF2b0dRdXFwWHVVTEN5Mm9maGVycXhRaEEvM3ArLwpFb2krWFV6eU1NQTRzRW1hUEtxWDRmWGNtU3RPSUZ1bkxUa2Z0TEpXb2VFb0J3SXZGK2h6cVVlbDNXY2RVVmZVCjdyYklEd1ZIZW15R3RiWlZsb1lhb0YrcFJxckQyKzdxcFFLQ0FRQXR0YUZ4WHM5MnRQVS8vREEzNFNnQzlEdzEKZHpCbk9JR2xuTnV1cVNma3J4QTI1ejZZMEFqV2Z6bGFHMm11NSthaFdnMnpKRnU5U0gzL3p6Vi8zeXVQaGlUOApqaFVPNS90RjgzcmtrZTVUSE9udW5RVFJVN05sQlFvUlM1bGNkcGZXM3FlQTVaV09WR2daVDdlK3RpQXVJd25MCm9NTFYxVitnUnk3V3FTbHRtZGNkSlNNRXZLbXV2TFFFRWV5N01YZE00c21LS013Y05zNHhJd3YzUDFIZkM0RG8KOVJwTkNKWW9ZK3hHSzYrZHA4b0NhL2k0VUttazduQitvUC9iRXB2Y05ydFB2OTd0Z1JaUjQweEZQM3N0YmhLWgp1TVAyODN4TkkwSk42QThoaEFLRjYwSlJnTnk5R2pyU2dCaEpaUWVBZUx2S0s2RGZYbTBocDRZSEZybWUKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
-  # API server specific configuration options.
-  apiServer:
-    image: registry.k8s.io/kube-apiserver:v1.30.3 # The container image used in the API server manifest.
-    # Extra certificate subject alternative names for the API server's certificate.
-    certSANs:
-      - 10.0.69.162
-    disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests.
-    # Configure the API server admission plugins.
-    admissionControl:
-      - name: PodSecurity # Name is the name of the admission controller.
-        # Configuration is an embedded configuration object to be used as the plugin's
-        configuration:
-          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
-          defaults:
-            audit: restricted
-            audit-version: latest
-            enforce: baseline
-            enforce-version: latest
-            warn: restricted
-            warn-version: latest
-          exemptions:
-            namespaces:
-              - kube-system
-            runtimeClasses: []
-            usernames: []
-          kind: PodSecurityConfiguration
-    # Configure the API server audit policy.
-    auditPolicy:
-      apiVersion: audit.k8s.io/v1
-      kind: Policy
-      rules:
-        - level: Metadata
-  # Controller manager server specific configuration options.
-  controllerManager:
-    image: registry.k8s.io/kube-controller-manager:v1.30.3 # The container image used in the controller manager manifest.
-  # Kube-proxy server-specific configuration options
-  proxy:
-    image: registry.k8s.io/kube-proxy:v1.30.3 # The container image used in the kube-proxy manifest.
-
-    # # Disable kube-proxy deployment on cluster bootstrap.
-    # disabled: false
-  # Scheduler server specific configuration options.
-  scheduler:
-    image: registry.k8s.io/kube-scheduler:v1.30.3 # The container image used in the scheduler manifest.
-  # Configures cluster member discovery.
-  discovery:
-    enabled: true # Enable the cluster membership discovery feature.
-    # Configure registries used for cluster member discovery.
-    registries:
-      # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
-      kubernetes:
-        disabled: true # Disable Kubernetes discovery registry.
-      # Service registry is using an external service to push and pull information about cluster members.
-      service: {}
-      # # External service endpoint.
-      # endpoint: https://discovery.talos.dev/
-  # Etcd specific configuration options.
-  etcd:
-    # The `ca` is the root certificate authority of the PKI.
-    ca:
-      crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmekNDQVNTZ0F3SUJBZ0lSQU9TeDh3YWVUM1N5UXZwQyt1Y1RpZDR3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TkRBNU1qRXhPVFE1TWpSYUZ3MHpOREE1TVRreE9UUTVNalJhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFSWDF0Sk1hcE5UClk4OWFxcnFNVVJVZHF3TjFuNks4SXc4Y2dxeTU0MGZJQktNZUUyVytlL2M5d0o4aklDcXJnek81UWFIOHhpejAKT0lLQmRjMlFIVjd5bzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRklVdDdoSHpSMWJSCkJGanN2c25pZ2wza3lmeU5NQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUUNpejRGb1crVlhnSUl0ZDdYcVplbTIKOU0yTVlzVjMxaVRVKzdaVXFYN3BqUUloQVArOTB5MkVwb1V2bml4Q2tFR3M5V2gwWmxsMy82YTljd2RBSlFWWgozaG5XCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-      key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUkrYWVjNzRJRkxOaXBpMkNjSWZvdXV5bndDank3R0NIUUlYNlNma3VKWmhvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFVjliU1RHcVRVMlBQV3FxNmpGRVZIYXNEZForaXZDTVBISUtzdWVOSHlBU2pIaE5sdm52MwpQY0NmSXlBcXE0TXp1VUdoL01ZczlEaUNnWFhOa0IxZThnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
-
-    # # The container image used to create the etcd service.
-    # image: gcr.io/etcd-development/etcd:v3.5.13
-
-    # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
-    # advertisedSubnets:
-    #     - 10.0.0.0/8
-  # A list of urls that point to additional manifests.
-  extraManifests: []
-  #   - https://www.example.com/manifest1.yaml
-  #   - https://www.example.com/manifest2.yaml
-
-  # A list of inline Kubernetes manifests.
-  inlineManifests: []
-  #   - name: namespace-ci # Name of the manifest.
-  #     contents: |- # Manifest contents as a string.
-  #       apiVersion: v1
-  #       kind: Namespace
-  #       metadata:
-  #       	name: ci
-
-  # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
-
-  # # Decryption secret example (do not use in production!).
-  # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
-
-  # # Core DNS specific configuration options.
-  # coreDNS:
-  #     image: registry.k8s.io/coredns/coredns:v1.11.1 # The `image` field is an override to the default coredns image.
-
-  # # External cloud provider configuration.
-  # externalCloudProvider:
-  #     enabled: true # Enable external cloud provider.
-  #     # A list of urls that point to additional manifests for an external cloud provider.
-  #     manifests:
-  #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
-  #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
-
-  # # A map of key value pairs that will be added while fetching the extraManifests.
-  # extraManifestHeaders:
-  #     Token: "1234567"
-  #     X-ExtraInfo: info
-
-  # # Settings for admin kubeconfig generation.
-  # adminKubeconfig:
-  #     certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
-
-  # # Allows running workload on control-plane nodes.
-  # allowSchedulingOnControlPlanes: true

talos-cluster/talosconfig

@@ -1,10 +0,0 @@
-context: hl-cluster
-contexts:
-    hl-cluster:
-        endpoints:
-            - 10.0.69.162
-        nodes:
-            - 10.0.69.162
-        ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEExa1dmcVNjNVNxRWZjSENObXRCb2ZNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5EQTVNakV4T1RRNU1qUmFGdzB6TkRBNU1Ua3hPVFE1TWpSYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBcDdCcExBbUEwWlMrYXJINWJHek1kRHRLTlVnQWVuZ2p4TmliCkw5Mm0zbkdqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVSXZhb2FvRTRscFNDOUNqZApmV1k3TE5OZkh3Y3dCUVlESzJWd0EwRUFEQnFRSmZiOTVlbWJjSTVzNW52NW9lblRqc3RpOEpjaVYrbUppellUCjFYU1FsTm1uTngyVjJqSVhaclB2cCtXQWNkU1dVKzdnM3kvbUJITjlGL2hRQkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEFWQlpJZUlBVnFIeW8yL0V2SFQ2SHhNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5EQTVNakV4T1RRNU1qUmFGdzB5TlRBNU1qRXhPVFE1TWpSYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQVI1aUJKL2UvTm9pMnhwUDJxSngvR3BoYVdHTUtFY05aCmFJdDd5dzhwWE5lalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCUWk5cWhxZ1RpV2xJTDBLTjE5WmpzczAxOGZCekFGQmdNclpYQURRUUFEUDVOaApDY1d2VUxCejN3TTErQzhDM2pJSk1sM0N2UmdxWW1nbDUxZ3Zqd3hkaWJDT2x4SXJzUEZDbmIzcjZSd2hSNUFqCkwxVTVnZGZFVHpQblNzQU0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJS2dvcWRnZVU0Y0ljNFBIR0N2NGFPaGhUM3M3eHM2RGVKWE9IL05yQTJQcAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K

talos-cluster/worker.yaml

@@ -1,574 +0,0 @@
-version: v1alpha1 # Indicates the schema used to decode the contents.
-debug: false # Enable verbose logging to the console.
-persist: true
-# Provides machine specific configuration options.
-machine:
-  type: worker # Defines the role of the machine within the cluster.
-  token: 5ab53f.syav4oqxxfjhkgvt # The `token` is used by a machine to join the PKI of the cluster.
-  # The root certificate authority of the PKI.
-  ca:
-    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEExa1dmcVNjNVNxRWZjSENObXRCb2ZNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5EQTVNakV4T1RRNU1qUmFGdzB6TkRBNU1Ua3hPVFE1TWpSYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBcDdCcExBbUEwWlMrYXJINWJHek1kRHRLTlVnQWVuZ2p4TmliCkw5Mm0zbkdqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVSXZhb2FvRTRscFNDOUNqZApmV1k3TE5OZkh3Y3dCUVlESzJWd0EwRUFEQnFRSmZiOTVlbWJjSTVzNW52NW9lblRqc3RpOEpjaVYrbUppellUCjFYU1FsTm1uTngyVjJqSVhaclB2cCtXQWNkU1dVKzdnM3kvbUJITjlGL2hRQkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    key: ""
-  # Extra certificate subject alternative names for the machine's certificate.
-  certSANs: []
-  #   # Uncomment this to enable SANs.
-  #   - 10.0.0.10
-  #   - 172.16.0.10
-  #   - 192.168.0.10
-
-  # Used to provide additional options to the kubelet.
-  kubelet:
-    image: ghcr.io/siderolabs/kubelet:v1.30.3 # The `image` field is an optional reference to an alternative kubelet image.
-    defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
-    disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
-
-    # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
-    # clusterDNS:
-    #     - 10.96.0.10
-    #     - 169.254.2.53
-
-    # # The `extraArgs` field is used to provide additional flags to the kubelet.
-    # extraArgs:
-    #     key: value
-
-    # # The `extraMounts` field is used to add additional mounts to the kubelet container.
-    # extraMounts:
-    #     - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
-    #       type: bind # Type specifies the mount kind.
-    #       source: /var/lib/example # Source specifies the source path of the mount.
-    #       # Options are fstab style mount options.
-    #       options:
-    #         - bind
-    #         - rshared
-    #         - rw
-
-    # # The `extraConfig` field is used to provide kubelet configuration overrides.
-    # extraConfig:
-    #     serverTLSBootstrap: true
-
-    # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
-    # credentialProviderConfig:
-    #     apiVersion: kubelet.config.k8s.io/v1
-    #     kind: CredentialProviderConfig
-    #     providers:
-    #         - apiVersion: credentialprovider.kubelet.k8s.io/v1
-    #           defaultCacheDuration: 12h
-    #           matchImages:
-    #             - '*.dkr.ecr.*.amazonaws.com'
-    #             - '*.dkr.ecr.*.amazonaws.com.cn'
-    #             - '*.dkr.ecr-fips.*.amazonaws.com'
-    #             - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
-    #             - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
-    #           name: ecr-credential-provider
-
-    # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
-    # nodeIP:
-    #     # The `validSubnets` field configures the networks to pick kubelet node IP from.
-    #     validSubnets:
-    #         - 10.0.0.0/8
-    #         - '!10.0.0.3/32'
-    #         - fdc7::/16
-  # Provides machine specific network configuration options.
-  network: {}
-  # # `interfaces` is used to define the network interface configuration.
-  # interfaces:
-  #     - interface: enp0s1 # The interface name.
-  #       # Assigns static IP addresses to the interface.
-  #       addresses:
-  #         - 192.168.2.0/24
-  #       # A list of routes associated with the interface.
-  #       routes:
-  #         - network: 0.0.0.0/0 # The route's network (destination).
-  #           gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
-  #           metric: 1024 # The optional metric for the route.
-  #       mtu: 1500 # The interface's MTU.
-  #
-  #       # # Picks a network device using the selector.
-
-  #       # # select a device with bus prefix 00:*.
-  #       # deviceSelector:
-  #       #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
-  #       # deviceSelector:
-  #       #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #     driver: virtio # Kernel driver, supports matching by wildcard.
-  #       # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
-  #       # deviceSelector:
-  #       #     - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       #     - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #       driver: virtio # Kernel driver, supports matching by wildcard.
-
-  #       # # Bond specific options.
-  #       # bond:
-  #       #     # The interfaces that make up the bond.
-  #       #     interfaces:
-  #       #         - enp2s0
-  #       #         - enp2s1
-  #       #     # Picks a network device using the selector.
-  #       #     deviceSelectors:
-  #       #         - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
-  #       #         - hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
-  #       #           driver: virtio # Kernel driver, supports matching by wildcard.
-  #       #     mode: 802.3ad # A bond option.
-  #       #     lacpRate: fast # A bond option.
-
-  #       # # Bridge specific options.
-  #       # bridge:
-  #       #     # The interfaces that make up the bridge.
-  #       #     interfaces:
-  #       #         - enxda4042ca9a51
-  #       #         - enxae2a6774c259
-  #       #     # A bridge option.
-  #       #     stp:
-  #       #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.
-
-  #       # # Indicates if DHCP should be used to configure the interface.
-  #       # dhcp: true
-
-  #       # # DHCP specific options.
-  #       # dhcpOptions:
-  #       #     routeMetric: 1024 # The priority of all routes received via DHCP.
-
-  #       # # Wireguard specific configuration.
-
-  #       # # wireguard server example
-  #       # wireguard:
-  #       #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
-  #       #     listenPort: 51111 # Specifies a device's listening port.
-  #       #     # Specifies a list of peer configurations to apply to a device.
-  #       #     peers:
-  #       #         - publicKey: ABCDEF... # Specifies the public key of this peer.
-  #       #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
-  #       #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
-  #       #           allowedIPs:
-  #       #             - 192.168.1.0/24
-  #       # # wireguard peer example
-  #       # wireguard:
-  #       #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
-  #       #     # Specifies a list of peer configurations to apply to a device.
-  #       #     peers:
-  #       #         - publicKey: ABCDEF... # Specifies the public key of this peer.
-  #       #           endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.
-  #       #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
-  #       #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
-  #       #           allowedIPs:
-  #       #             - 192.168.1.0/24
-
-  #       # # Virtual (shared) IP address configuration.
-
-  #       # # layer2 vip example
-  #       # vip:
-  #       #     ip: 172.16.199.55 # Specifies the IP address to be used.
-
-  # # Used to statically set the nameservers for the machine.
-  # nameservers:
-  #     - 8.8.8.8
-  #     - 1.1.1.1
-
-  # # Allows for extra entries to be added to the `/etc/hosts` file
-  # extraHostEntries:
-  #     - ip: 192.168.1.100 # The IP of the host.
-  #       # The host alias.
-  #       aliases:
-  #         - example
-  #         - example.domain.tld
-
-  # # Configures KubeSpan feature.
-  # kubespan:
-  #     enabled: true # Enable the KubeSpan feature.
-
-  # Used to provide instructions for installations.
-  install:
-    disk: /dev/sda # The disk used for installations.
-    image: ghcr.io/siderolabs/installer:v1.7.6 # Allows for supplying the image used to perform the installation.
-    wipe: false # Indicates if the installation disk should be wiped at installation time.
-
-    # # Look up disk using disk attributes like model, size, serial and others.
-    # diskSelector:
-    #     size: 4GB # Disk size.
-    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
-    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
-
-    # # Allows for supplying extra kernel args via the bootloader.
-    # extraKernelArgs:
-    #     - talos.platform=metal
-    #     - reboot=k
-
-    # # Allows for supplying additional system extension images to install on top of base Talos image.
-    # extensions:
-    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
-  # Used to configure the machine's container image registry mirrors.
-  registries: {}
-  # # Specifies mirror configuration for each registry host namespace.
-  # mirrors:
-  #     ghcr.io:
-  #         # List of endpoints (URLs) for registry mirrors to use.
-  #         endpoints:
-  #             - https://registry.insecure
-  #             - https://ghcr.io/v2/
-
-  # # Specifies TLS & auth configuration for HTTPS image registries.
-  # config:
-  #     registry.insecure:
-  #         # The TLS configuration for the registry.
-  #         tls:
-  #             insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).
-  #
-  #             # # Enable mutual TLS authentication with the registry.
-  #             # clientIdentity:
-  #             #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
-  #             #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
-  #
-  #         # # The auth configuration for this registry.
-  #         # auth:
-  #         #     username: username # Optional registry authentication.
-  #         #     password: password # Optional registry authentication.
-
-  # Features describe individual Talos features that can be switched on or off.
-  features:
-    rbac: true # Enable role-based access control (RBAC).
-    stableHostname: true # Enable stable default hostname.
-    apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.
-    diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
-    # KubePrism - local proxy/load balancer on defined port that will distribute
-    kubePrism:
-      enabled: true # Enable KubePrism support - will start local load balancing proxy.
-      port: 7445 # KubePrism port.
-    # Configures host DNS caching resolver.
-    hostDNS:
-      enabled: true # Enable host DNS caching resolver.
-
-    # # Configure Talos API access from Kubernetes pods.
-    # kubernetesTalosAPIAccess:
-    #     enabled: true # Enable Talos API access from Kubernetes pods.
-    #     # The list of Talos API roles which can be granted for access from Kubernetes pods.
-    #     allowedRoles:
-    #         - os:reader
-    #     # The list of Kubernetes namespaces Talos API access is available from.
-    #     allowedKubernetesNamespaces:
-    #         - kube-system
-
-  # # Provides machine specific control plane configuration options.
-
-  # # ControlPlane definition example.
-  # controlPlane:
-  #     # Controller manager machine specific configuration options.
-  #     controllerManager:
-  #         disabled: false # Disable kube-controller-manager on the node.
-  #     # Scheduler machine specific configuration options.
-  #     scheduler:
-  #         disabled: true # Disable kube-scheduler on the node.
-
-  # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
-
-  # # nginx static pod.
-  # pods:
-  #     - apiVersion: v1
-  #       kind: pod
-  #       metadata:
-  #         name: nginx
-  #       spec:
-  #         containers:
-  #             - image: nginx
-  #               name: nginx
-
-  # # Used to partition, format and mount additional disks.
-
-  # # MachineDisks list example.
-  # disks:
-  #     - device: /dev/sdb # The name of the disk to use.
-  #       # A list of partitions to create on the disk.
-  #       partitions:
-  #         - mountpoint: /var/mnt/extra # Where to mount the partition.
-  #
-  #           # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
-
-  #           # # Human readable representation.
-  #           # size: 100 MB
-  #           # # Precise value in bytes.
-  #           # size: 1073741824
-
-  # # Allows the addition of user specified files.
-
-  # # MachineFiles usage example.
-  # files:
-  #     - content: '...' # The contents of the file.
-  #       permissions: 0o666 # The file's permissions in octal.
-  #       path: /tmp/file.txt # The path of the file.
-  #       op: append # The operation to use
-
-  # # The `env` field allows for the addition of environment variables.
-
-  # # Environment variables definition examples.
-  # env:
-  #     GRPC_GO_LOG_SEVERITY_LEVEL: info
-  #     GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
-  #     https_proxy: http://SERVER:PORT/
-  # env:
-  #     GRPC_GO_LOG_SEVERITY_LEVEL: error
-  #     https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
-  # env:
-  #     https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
-
-  # # Used to configure the machine's time settings.
-
-  # # Example configuration for cloudflare ntp server.
-  # time:
-  #     disabled: false # Indicates if the time service is disabled for the machine.
-  #     # description: |
-  #     servers:
-  #         - time.cloudflare.com
-  #     bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.
-
-  # # Used to configure the machine's sysctls.
-
-  # # MachineSysctls usage example.
-  # sysctls:
-  #     kernel.domainname: talos.dev
-  #     net.ipv4.ip_forward: "0"
-  #     net/ipv6/conf/eth0.100/disable_ipv6: "1"
-
-  # # Used to configure the machine's sysfs.
-
-  # # MachineSysfs usage example.
-  # sysfs:
-  #     devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
-
-  # # Machine system disk encryption configuration.
-  # systemDiskEncryption:
-  #     # Ephemeral partition encryption.
-  #     ephemeral:
-  #         provider: luks2 # Encryption provider to use for the encryption.
-  #         # Defines the encryption keys generation and storage method.
-  #         keys:
-  #             - # Deterministically generated key from the node UUID and PartitionLabel.
-  #               nodeID: {}
-  #               slot: 0 # Key slot number for LUKS2 encryption.
-  #
-  #               # # KMS managed encryption key.
-  #               # kms:
-  #               #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
-  #
-  #         # # Cipher kind to use for the encryption. Depends on the encryption provider.
-  #         # cipher: aes-xts-plain64
-
-  #         # # Defines the encryption sector size.
-  #         # blockSize: 4096
-
-  #         # # Additional --perf parameters for the LUKS2 encryption.
-  #         # options:
-  #         #     - no_read_workqueue
-  #         #     - no_write_workqueue
-
-  # # Configures the udev system.
-  # udev:
-  #     # List of udev rules to apply to the udev system
-  #     rules:
-  #         - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
-
-  # # Configures the logging system.
-  # logging:
-  #     # Logging destination.
-  #     destinations:
-  #         - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
-  #           format: json_lines # Logs format.
-
-  # # Configures the kernel.
-  # kernel:
-  #     # Kernel modules to load.
-  #     modules:
-  #         - name: brtfs # Module name.
-
-  # # Configures the seccomp profiles for the machine.
-  # seccompProfiles:
-  #     - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
-  #       # The `value` field is used to provide the seccomp profile.
-  #       value:
-  #         defaultAction: SCMP_ACT_LOG
-
-  # # Configures the node labels for the machine.
-
-  # # node labels example.
-  # nodeLabels:
-  #     exampleLabel: exampleLabelValue
-
-  # # Configures the node taints for the machine. Effect is optional.
-
-  # # node taints example.
-  # nodeTaints:
-  #     exampleTaint: exampleTaintValue:NoSchedule
-# Provides cluster specific configuration options.
-cluster:
-  id: 5wojSDc7TVbIkS2ard2EyFd9450s1asuoPU6BkDHVmA= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
-  secret: T+H+CyyVS3nYAyPl45PsRGWOzdnvRoHmjp57l2FOcV0= # Shared secret of cluster (base64 encoded random 32 bytes).
-  # Provides control plane specific configuration options.
-  controlPlane:
-    endpoint: https://10.0.69.162:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
-  # Provides cluster specific network configuration options.
-  network:
-    dnsDomain: cluster.local # The domain used by Kubernetes DNS.
-    # The pod subnet CIDR.
-    podSubnets:
-      - 10.244.0.0/16
-    # The service subnet CIDR.
-    serviceSubnets:
-      - 10.96.0.0/12
-
-    # # The CNI used.
-    # cni:
-    #     name: custom # Name of CNI to use.
-    #     # URLs containing manifests to apply for the CNI.
-    #     urls:
-    #         - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
-  token: 3t3mw0.htvvap2rultkiu6l # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
-  # The base64 encoded root certificate authority used by Kubernetes.
-  ca:
-    crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpekNDQVRDZ0F3SUJBZ0lSQUp1QVZTajlKMDdWdFkxaExGNU5GcVF3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOREE1TWpFeE9UUTVNalJhRncwek5EQTVNVGt4T1RRNQpNalJhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVNXYndSa3BEakdOTnlvTlpvbEFnQStoVzJFU3B6MWpGMzZiSCtLQnpZVTROZUFDcGxNbzN0THBrWjEKMi9IQUVwN2VYWDI3L21WbWR4eE1jemY0OHNiT28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGTDFJSG9MRnc2Q0hkZ3JPazhyVys2MTR4cC9HTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDZUFXeWgKZldrM0V2SXh4bU1DQ2tGT1d2ZFptWlVhTkpndElmKzQyTGVhZkFJaEFOSHVvMWJ0cnRRTkhnNlM1NHhwVDhELwpyR1J4L015dDNjZHFKK0JCRnhMQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    key: ""
-  # Configures cluster member discovery.
-  discovery:
-    enabled: true # Enable the cluster membership discovery feature.
-    # Configure registries used for cluster member discovery.
-    registries:
-      # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
-      kubernetes:
-        disabled: true # Disable Kubernetes discovery registry.
-      # Service registry is using an external service to push and pull information about cluster members.
-      service: {}
-      # # External service endpoint.
-      # endpoint: https://discovery.talos.dev/
-
-  # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
-
-  # # Decryption secret example (do not use in production!).
-  # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
-
-  # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
-
-  # # Decryption secret example (do not use in production!).
-  # secretboxEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
-
-  # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
-
-  # # AggregatorCA example.
-  # aggregatorCA:
-  #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
-  #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
-
-  # # The base64 encoded private key for service account token generation.
-
-  # # AggregatorCA example.
-  # serviceAccount:
-  #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
-
-  # # API server specific configuration options.
-  # apiServer:
-  #     image: registry.k8s.io/kube-apiserver:v1.30.3 # The container image used in the API server manifest.
-  #     # Extra arguments to supply to the API server.
-  #     extraArgs:
-  #         feature-gates: ServerSideApply=true
-  #         http2-max-streams-per-connection: "32"
-  #     # Extra certificate subject alternative names for the API server's certificate.
-  #     certSANs:
-  #         - 1.2.3.4
-  #         - 4.5.6.7
-  #     # Configure the API server admission plugins.
-  #     admissionControl:
-  #         - name: PodSecurity # Name is the name of the admission controller.
-  #           # Configuration is an embedded configuration object to be used as the plugin's
-  #           configuration:
-  #             apiVersion: pod-security.admission.config.k8s.io/v1alpha1
-  #             defaults:
-  #                 audit: restricted
-  #                 audit-version: latest
-  #                 enforce: baseline
-  #                 enforce-version: latest
-  #                 warn: restricted
-  #                 warn-version: latest
-  #             exemptions:
-  #                 namespaces:
-  #                     - kube-system
-  #                 runtimeClasses: []
-  #                 usernames: []
-  #             kind: PodSecurityConfiguration
-  #     # Configure the API server audit policy.
-  #     auditPolicy:
-  #         apiVersion: audit.k8s.io/v1
-  #         kind: Policy
-  #         rules:
-  #             - level: Metadata
-
-  # # Controller manager server specific configuration options.
-  # controllerManager:
-  #     image: registry.k8s.io/kube-controller-manager:v1.30.3 # The container image used in the controller manager manifest.
-  #     # Extra arguments to supply to the controller manager.
-  #     extraArgs:
-  #         feature-gates: ServerSideApply=true
-
-  # # Kube-proxy server-specific configuration options
-  # proxy:
-  #     disabled: false # Disable kube-proxy deployment on cluster bootstrap.
-  #     image: registry.k8s.io/kube-proxy:v1.30.3 # The container image used in the kube-proxy manifest.
-  #     mode: ipvs # proxy mode of kube-proxy.
-  #     # Extra arguments to supply to kube-proxy.
-  #     extraArgs:
-  #         proxy-mode: iptables
-
-  # # Scheduler server specific configuration options.
-  # scheduler:
-  #     image: registry.k8s.io/kube-scheduler:v1.30.3 # The container image used in the scheduler manifest.
-  #     # Extra arguments to supply to the scheduler.
-  #     extraArgs:
-  #         feature-gates: AllBeta=true
-
-  # # Etcd specific configuration options.
-  # etcd:
-  #     image: gcr.io/etcd-development/etcd:v3.5.13 # The container image used to create the etcd service.
-  #     # The `ca` is the root certificate authority of the PKI.
-  #     ca:
-  #         crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
-  #         key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
-  #     # Extra arguments to supply to etcd.
-  #     extraArgs:
-  #         election-timeout: "5000"
-  #     # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
-  #     advertisedSubnets:
-  #         - 10.0.0.0/8
-
-  # # Core DNS specific configuration options.
-  # coreDNS:
-  #     image: registry.k8s.io/coredns/coredns:v1.11.1 # The `image` field is an override to the default coredns image.
-
-  # # External cloud provider configuration.
-  # externalCloudProvider:
-  #     enabled: true # Enable external cloud provider.
-  #     # A list of urls that point to additional manifests for an external cloud provider.
-  #     manifests:
-  #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
-  #         - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
-
-  # # A list of urls that point to additional manifests.
-  # extraManifests:
-  #     - https://www.example.com/manifest1.yaml
-  #     - https://www.example.com/manifest2.yaml
-
-  # # A map of key value pairs that will be added while fetching the extraManifests.
-  # extraManifestHeaders:
-  #     Token: "1234567"
-  #     X-ExtraInfo: info
-
-  # # A list of inline Kubernetes manifests.
-  # inlineManifests:
-  #     - name: namespace-ci # Name of the manifest.
-  #       contents: |- # Manifest contents as a string.
-  #         apiVersion: v1
-  #         kind: Namespace
-  #         metadata:
-  #         	name: ci
-
-  # # Settings for admin kubeconfig generation.
-  # adminKubeconfig:
-  #     certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
-
-  # # Allows running workload on control-plane nodes.
-  # allowSchedulingOnControlPlanes: true