diff --git a/.gitignore b/.gitignore index 14f884a..ea1a7b4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,20 @@ +# Talos / Kubernetes credentials +talos/talosconfig +talos/kubeconfig +talos/controlplane.yaml +talos/worker.yaml +talos/*.pem +talos/*.key +talos/*.crt +talos/*.csr +talos/support-*.zip +talos_backup_*/talos_backup_*/talos_backup_*/ + +# Local Kubectl +.kube/ +*.log + + # Terraform .terraform/ *.tfstate* @@ -5,13 +22,31 @@ *.lock.hcl *.tfstate.backup .terraform.lock.hcl - +crash.log +*.tfvars +*.tfvars.json # AWS credentials *.pem *.key -# Editor files +# file editors .DS_Store .idea/ .vscode/ +*.swp + + +kubeconfig* +cilium-quick-install.yaml +talos_backup_*/ +*.backup +*.tfstate +*.tfstate.* + +# Terraform local state (bootstrap) +backend/ +*.tfstate +*.tfstate.backup +.terraform/ +.terraform.lock.hcl diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..ae99059 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,24 @@ +default_stages: [pre-commit] + +repos: + - repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.96.3 + hooks: + - id: terraform_fmt + args: + - --args=-recursive + + - id: terraform_validate + + - id: terraform_tflint + + - id: terraform_trivy + args: + - --hook-config=--parallelism-limit=1 + - "--args=--severity=CRITICAL" + - "--args=--skip-dirs=**/.terraform" + + - id: terraform_docs + args: + - --hook-config=--create-file-if-not-exist=true + - "--args=--lockfile=false" diff --git a/ARCHITECTURE_OVERVIEW.png b/ARCHITECTURE_OVERVIEW.png new file mode 100644 index 0000000..6e98175 Binary files /dev/null and b/ARCHITECTURE_OVERVIEW.png differ diff --git a/core/backend/README.md b/core/backend/README.md new file mode 100644 index 0000000..98d46b1 --- /dev/null +++ b/core/backend/README.md @@ -0,0 +1,42 @@ +# backend + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.6.0 | +| [aws](#requirement\_aws) | ~> 5.60 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | ~> 5.60 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_dynamodb_table.lock](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource | +| [aws_s3_bucket.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_lifecycle_configuration.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | +| [aws_s3_bucket_public_access_block.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_s3_bucket_server_side_encryption_configuration.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | +| [aws_s3_bucket_versioning.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | + +## Inputs + +No inputs. + +## Outputs + +| Name | Description | +|------|-------------| +| [tflock\_table](#output\_tflock\_table) | n/a | +| [tfstate\_bucket](#output\_tfstate\_bucket) | n/a | + diff --git a/backend/backend.hcl b/core/backend/backend.hcl similarity index 100% rename from backend/backend.hcl rename to core/backend/backend.hcl diff --git a/backend/main.tf b/core/backend/main.tf similarity index 100% rename from backend/main.tf rename to core/backend/main.tf diff --git a/backend/versions.tf b/core/backend/versions.tf similarity index 91% rename from backend/versions.tf rename to core/backend/versions.tf index 4e11ac4..88ee241 100644 --- a/backend/versions.tf +++ b/core/backend/versions.tf @@ -6,7 +6,6 @@ terraform { version = "~> 5.60" } } - backend "s3" {} } provider "aws" { region = "us-east-1" diff --git a/core/vpc/README.md b/core/vpc/README.md new file mode 100644 index 0000000..9d4ea3b --- /dev/null +++ b/core/vpc/README.md @@ -0,0 +1,49 @@ +> [!NOTE] +> Experimental VPC module. +> Not used by any environment in infra v1. +> Reserved for future refactors (infra v2). + +# vpc + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.6.0 | +| [aws](#requirement\_aws) | ~> 5.60 | + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.8.1 | + +## Resources + +No resources. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [azs](#input\_azs) | n/a | `list(string)` | 
[
  "us-east-1a",
  "us-east-1b"
]
| no | +| [env](#input\_env) | n/a | `string` | `"dev"` | no | +| [private\_subnet\_cidrs](#input\_private\_subnet\_cidrs) | n/a | `list(string)` | 
[
  "10.0.10.0/24",
  "10.0.11.0/24"
]
| no | +| [project](#input\_project) | n/a | `string` | `"shopstack"` | no | +| [public\_subnet\_cidrs](#input\_public\_subnet\_cidrs) | n/a | `list(string)` | 
[
  "10.0.0.0/24",
  "10.0.1.0/24"
]
| no | +| [region](#input\_region) | AWS region (currently unused in this module) | `string` | n/a | yes | +| [vpc\_cidr](#input\_vpc\_cidr) | n/a | `string` | `"10.0.0.0/16"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [private\_subnet\_ids](#output\_private\_subnet\_ids) | n/a | +| [public\_subnet\_ids](#output\_public\_subnet\_ids) | n/a | +| [vpc\_id](#output\_vpc\_id) | Output VPC and subnet identifiers | + diff --git a/core/vpc/main.tf b/core/vpc/main.tf new file mode 100644 index 0000000..2fe0f66 --- /dev/null +++ b/core/vpc/main.tf @@ -0,0 +1,41 @@ +module "vpc" { + # Use the official AWS VPC module from the Terraform Registry + source = "terraform-aws-modules/vpc/aws" + version = "5.8.1" + + # Define VPC name based on project and environment + name = "${var.project}-${var.env}" + + # Set the CIDR block for the VPC + cidr = var.vpc_cidr + + # Define the Availability Zones to use + azs = var.azs + + # Define CIDR blocks for public and private subnets + public_subnets = var.public_subnet_cidrs + private_subnets = var.private_subnet_cidrs + + # Enable NAT Gateway for outbound traffic from private subnets + enable_nat_gateway = false + + # Create one NAT Gateway per AZ for high availability + single_nat_gateway = false + one_nat_gateway_per_az = false + + # Enable DNS hostnames and DNS resolution support within the VPC + enable_dns_hostnames = true + enable_dns_support = true + + # Common tags for resource identification and management + tags = { + Project = var.project + Env = var.env + Managed = "terraform" + } +} + +# Output VPC and subnet identifiers +output "vpc_id" { value = module.vpc.vpc_id } +output "public_subnet_ids" { value = module.vpc.public_subnets } +output "private_subnet_ids" { value = module.vpc.private_subnets } diff --git a/core/vpc/variables.tf b/core/vpc/variables.tf new file mode 100644 index 0000000..5d48ce2 --- /dev/null +++ b/core/vpc/variables.tf @@ -0,0 +1,35 @@ +variable "project" { + type = string + default = "shopstack" +} + +variable "env" { + type = string + default = "dev" +} + +# tflint-ignore: terraform_unused_declarations +variable "region" { + type = string + description = "AWS region (currently unused in this module)" +} + +variable "vpc_cidr" { + type = string + default = "10.0.0.0/16" +} + +variable "azs" { + type = list(string) + default = ["us-east-1a", "us-east-1b"] +} + +variable "public_subnet_cidrs" { + type = list(string) + default = ["10.0.0.0/24", "10.0.1.0/24"] +} + +variable "private_subnet_cidrs" { + type = list(string) + default = ["10.0.10.0/24", "10.0.11.0/24"] +} diff --git a/core/vpc/versions.tf b/core/vpc/versions.tf new file mode 100644 index 0000000..fb6e4bf --- /dev/null +++ b/core/vpc/versions.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.6.0" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.60" + } + } +} diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 2abe19a..9d8b5c5 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -7,10 +7,48 @@ A complete overview of the **ShopStack** project architecture and repository rel ## 📦 **Repositories Overview** | Repository | Purpose | Main Technologies | -|-------------|----------|-------------------| -| **infra-terraform** | Defines and provisions the foundational infrastructure (S3 backend, DynamoDB for locks, Terraform remote state). | Terraform, AWS | -| **cluster-gitops** | Manages cluster provisioning, configuration, and repeatability testing using Kind and GitOps workflows. | Kind, Kubectl, Makefile | -| **apps-sre** | Hosts applications and observability stacks that run inside the Kubernetes cluster. | Docker, Helm, ArgoCD *(future)* | +|-----------|---------|-------------------| +| **infra-terraform** | Defines and provisions the foundational AWS infrastructure (Terraform remote state backend, IAM/OIDC integration, ECR, Secrets Manager, and build hooks). | Terraform, AWS (S3, DynamoDB, IAM, ECR, Secrets Manager) | +| **cluster-gitops** | Manages cluster provisioning, configuration, and repeatability testing using Kind and GitOps workflows. | Kind, kubectl, Makefile | +| **apps-sre** | Hosts applications and observability stacks that run inside the Kubernetes cluster. | Docker, Helm, Argo CD *(future)* | + +--- + +## ☁️ **AWS Integration Scope (infra v1)** + +This section defines the AWS integration scope for **infra v1** of ShopStack. + +- **Terraform remote state backend** + - `core/backend` module creates: + - An S3 bucket to store Terraform remote state. + - A DynamoDB table to provide state locking. + - Used by `envs/dev` to safely manage infrastructure changes. + +- **Secrets Manager** + - AWS Secrets Manager will store runtime secrets for ShopStack (API keys, database credentials, etc.). + - `core/secrets` module (infra-terraform) manages the secret metadata and naming convention (e.g. `shopstack/dev/app-config`). + - Secret values can be injected later into workloads (Kubernetes manifests or app configs) in future sprints. + +- **ECR (Elastic Container Registry)** + - `core/ecr` module provisions an ECR repository per environment (e.g. `shopstack-dev`). + - Used to store container images built for ShopStack applications. + - Images are pushed from CI (GitHub Actions / CodeBuild) and later pulled by the runtime environment (Kind/Talos/EKS). + +- **CodeBuild (build integration)** + - A CodeBuild project will be used as a managed build step to: + - Build Docker images from application repositories. + - Push images to the ECR repository created by `core/ecr`. + - CodeBuild will be triggered via GitHub Actions or future CI workflows using IAM roles instead of long-lived credentials. + +- **GitHub OIDC (federated IAM access)** + - `core/github-oidc` module defines: + - An IAM OIDC provider for `token.actions.githubusercontent.com`. + - An IAM role that can be assumed only by specific GitHub repositories/branches (e.g. `repo:/:ref:refs/heads/main`). + - This role will grant least-privilege access to: + - Read/write the Terraform remote state in S3/DynamoDB. + - Push images to ECR. + - Interact with CodeBuild when needed. + - This removes the need for static AWS keys in GitHub and aligns with AWS recommended security practices. --- @@ -21,7 +59,10 @@ Developer │ ├── infra-terraform │ ├── S3 bucket (Terraform backend) -│ └── DynamoDB table (state lock) +│ ├── DynamoDB table (Terraform state lock) +│ ├── AWS Secrets Manager (app secrets skeleton) +│ ├── ECR repository (container images per env) +│ └── IAM + OIDC role (GitHub Actions / CI access) │ ├── cluster-gitops │ ├── Kind cluster (shopstack) @@ -76,33 +117,44 @@ Results are saved to repeat.log. ```plaintext chmod 600 ~/.kube/config ``` -Docker daemon restricted to local use. -Terraform state secured in private AWS S3 bucket with DynamoDB locking. + - Terraform state stored in a private AWS S3 bucket with DynamoDB locking. + - GitHub CI uses federated IAM access via OIDC instead of static AWS credentials (infra v1 scope). --- ## 🧩 **Future Improvements** - - Add CI/CD pipeline for infrastructure changes. - - Integrate EKS managed cluster for cloud testing. - - Enable security scanning tools (Trivy, kube-bench). - - Automate bootstrap across all repositories with a unified Makefile. + - Add CI/CD pipeline for infrastructurechanges using GitHub Actions + OIDC. + - Integrate EKS managed cluster for cloud testing. + - Enable additional security scanning tools (Trivy, kube-bench, tfsec/Trivy for Terraform). + - Automate bootstrap across all repositories with a unified Makefile and shared scripts. --- ## 🗂️ **Folder Structure** ```bash infra-terraform/ +├── core/ +│ ├── backend/ # S3 + DynamoDB for Terraform remote state +│ ├── vpc/ # Experimental VPC module (not used in infra v1) +│ ├── github-oidc/ # IAM OIDC provider + role for GitHub Actions (planned) +│ ├── ecr/ # ECR repository definitions (planned) +│ └── secrets/ # Secrets Manager layout (planned) ├── envs/ │ └── dev/ -│ ├── backend.tf -│ ├── main.tf +│ ├── backend.tf # Backend configuration using S3/DynamoDB +│ ├── main.tf # Environment stack (modules wiring) +│ ├── outputs.tf │ └── versions.tf -├── .github/ -│ └── workflows/terraform-ci.yml +├── talos/ # Talos cluster configuration files (local cluster) +├── backend/ # Local bootstrap state (not used in normal flows) ├── Makefile └── docs/ └── ARCHITECTURE.md ``` +# Architecture Overview + +![Architecture Overview](ARCHITECTURE_OVERVIEW.png) + --- ## 🧭 **Additional Documentation** diff --git a/docs/ARCHITECTURE_OVERVIEW.png b/docs/ARCHITECTURE_OVERVIEW.png new file mode 100644 index 0000000..6e98175 Binary files /dev/null and b/docs/ARCHITECTURE_OVERVIEW.png differ diff --git a/eks/aws-auth-patch.yaml b/eks/aws-auth-patch.yaml deleted file mode 100644 index 776e977..0000000 --- a/eks/aws-auth-patch.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: aws-auth - namespace: kube-system -data: - mapUsers: | - - userarn: arn:aws:iam::770132776547:user/terraform-shopstack - username: terraform-shopstack - groups: - - system:masters - mapRoles: | - - rolearn: arn:aws:iam::770132776547:role/YOUR_NODE_INSTANCE_ROLE - username: system:node:{{EC2PrivateDNSName}} - groups: - - system:bootstrappers - - system:nodes diff --git a/eks/main.tf b/eks/main.tf deleted file mode 100644 index c292e3d..0000000 --- a/eks/main.tf +++ /dev/null @@ -1,44 +0,0 @@ -terraform { - required_version = ">= 1.6.0" - - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.60" - } - } -} - -provider "aws" { - region = var.region -} - -module "eks" { - source = "terraform-aws-modules/eks/aws" - version = "20.24.1" - - cluster_name = "${var.project}-${var.env}-eks" - cluster_version = var.cluster_version - - vpc_id = var.vpc_id - subnet_ids = ["subnet-0ad21afa719ea0f5f", "subnet-02e577a76ce593e6d"] - - enable_irsa = true - - eks_managed_node_groups = { - default = { - instance_types = [var.node_instance_type] - desired_size = 1 - min_size = 1 - max_size = 2 - ami_type = "AL2_x86_64" - subnet_ids = ["subnet-0ad21afa719ea0f5f", "subnet-02e577a76ce593e6d"] - } - } - - tags = { - Project = var.project - Env = var.env - Managed = "terraform" - } -} diff --git a/eks/outputs.tf b/eks/outputs.tf deleted file mode 100644 index 4afc7a8..0000000 --- a/eks/outputs.tf +++ /dev/null @@ -1,15 +0,0 @@ -output "cluster_name" { - value = module.eks.cluster_name -} - -output "cluster_endpoint" { - value = module.eks.cluster_endpoint -} - -output "cluster_arn" { - value = module.eks.cluster_arn -} - -output "kubeconfig_update_cmd" { - value = "aws eks update-kubeconfig --name ${module.eks.cluster_name} --region ${var.region}" -} diff --git a/eks/variables.tf b/eks/variables.tf deleted file mode 100644 index 29b2c4b..0000000 --- a/eks/variables.tf +++ /dev/null @@ -1,30 +0,0 @@ -variable "project" { - type = string - default = "shopstack" -} - -variable "env" { - type = string - default = "dev" -} - -variable "region" { - type = string - default = "us-east-1" -} - -variable "cluster_version" { - type = string - default = "1.31" -} - -variable "node_instance_type" { - type = string - default = "t3.small" -} - -variable "vpc_id" { - type = string - default = "vpc-00154233cd16a656b" -} - diff --git a/envs/dev/README.md b/envs/dev/README.md new file mode 100644 index 0000000..76fd619 --- /dev/null +++ b/envs/dev/README.md @@ -0,0 +1,32 @@ +# dev + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.6.0 | +| [aws](#requirement\_aws) | ~> 5.60 | + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [network](#module\_network) | ../../vpc | n/a | + +## Resources + +No resources. + +## Inputs + +No inputs. + +## Outputs + +No outputs. + diff --git a/envs/dev/backend.tf b/envs/dev/backend.tf index 15e3a51..4bc9183 100644 --- a/envs/dev/backend.tf +++ b/envs/dev/backend.tf @@ -1,9 +1,9 @@ terraform { backend "s3" { - bucket = "terraform-state-shopstack-770132776547" + bucket = "shopstack-dev-tfstate" key = "envs/dev/terraform.tfstate" region = "us-east-1" - dynamodb_table = "terraform-locks" encrypt = true + dynamodb_table = "terraform-locks" } } diff --git a/envs/dev/main.tf b/envs/dev/main.tf index a797f50..82d2a40 100644 --- a/envs/dev/main.tf +++ b/envs/dev/main.tf @@ -1 +1,18 @@ -locals { tags = { Project = "ShopStack", Env = "dev" } } +locals { + project = "shopstack" + env = "dev" +} + +module "network" { + source = "../../vpc" + + project = local.project + env = local.env + region = "us-east-1" + vpc_cidr = "10.0.0.0/16" + azs = ["us-east-1a", "us-east-1b"] + public_subnet_cidrs = ["10.0.0.0/24", "10.0.1.0/24"] + private_subnet_cidrs = ["10.0.10.0/24", "10.0.11.0/24"] +} + + diff --git a/envs/dev/outputs.tf b/envs/dev/outputs.tf new file mode 100644 index 0000000..1b145ae --- /dev/null +++ b/envs/dev/outputs.tf @@ -0,0 +1 @@ +# no outputs yet diff --git a/envs/dev/versions.tf b/envs/dev/versions.tf index 47d698b..db3ea82 100644 --- a/envs/dev/versions.tf +++ b/envs/dev/versions.tf @@ -1,7 +1,14 @@ terraform { required_version = ">= 1.6.0" + required_providers { - aws = { source = "hashicorp/aws", version = "~> 5.0" } + aws = { + source = "hashicorp/aws" + version = "~> 5.60" + } } } -provider "aws" { region = "us-east-1" } + +provider "aws" { + region = "us-east-1" +} diff --git a/providers.tf b/providers.tf new file mode 100644 index 0000000..3d4114b --- /dev/null +++ b/providers.tf @@ -0,0 +1,15 @@ +terraform { + required_version = ">= 1.5.0" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } +} + +provider "aws" { + region = "us-east-1" + profile = "terraform-shopstack" +} diff --git a/talos/etcd_snapshot.db b/talos/etcd_snapshot.db new file mode 100644 index 0000000..7f6525b Binary files /dev/null and b/talos/etcd_snapshot.db differ diff --git a/talos/machineconfig_export.yaml b/talos/machineconfig_export.yaml new file mode 100644 index 0000000..b9c25c2 --- /dev/null +++ b/talos/machineconfig_export.yaml @@ -0,0 +1,11 @@ +node: 192.168.100.82 +metadata: + namespace: config + type: MachineConfigs.config.talos.dev + id: v1alpha1 + version: 1 + owner: + phase: running + created: 2025-11-15T08:21:05Z + updated: 2025-11-15T08:21:05Z +spec: "version: v1alpha1 # Indicates the schema used to decode the contents.\ndebug: false # Enable verbose logging to the console.\npersist: true\n# Provides machine specific configuration options.\nmachine:\n type: controlplane # Defines the role of the machine within the cluster.\n token: u1azvb.zaab5mamgzdeazc3 # The `token` is used by a machine to join the PKI of the cluster.\n # The root certificate authority of the PKI.\n ca:\n crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBcGVuNjh1dHNTUUc2SFVOaStQSWd4ekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qVXhNVEUxTURjek9UQXlXaGNOTXpVeE1URXpNRGN6T1RBeVdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUxNeXFTR01tUWd3ZS9yd3FvSCtpZXN3ekxyY3lDdG82STFMClhkdkRRaGt6bzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkYzUW4rdjJDTWZGeHpySwpMaTdURmNDbDBtbEZNQVVHQXl0bGNBTkJBREdwZnhLekozSmF5blJ0WUY4MTdnK3prUkl2U0RTV3BsSHhSOVl3ClJxcUNzNXVHV1JucGlrbU1Fdm92Sm02cGg4TU5CK2tpTHlBWG1YVWN3RTRxVGdjPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSndjb3VrZFFYMlE0Q2pjN1hSbW85cG5JbFFQVUJpM2RQSzZ1V21CRkVLSwotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K\n # Extra certificate subject alternative names for the machine's certificate.\n certSANs: []\n # # Uncomment this to enable SANs.\n # - 10.0.0.10\n # - 172.16.0.10\n # - 192.168.0.10\n\n # Used to provide additional options to the kubelet.\n kubelet:\n image: ghcr.io/siderolabs/kubelet:v1.34.1 # The `image` field is an optional reference to an alternative kubelet image.\n defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.\n disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\n \n # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.\n # clusterDNS:\n # - 10.96.0.10\n # - 169.254.2.53\n\n # # The `extraArgs` field is used to provide additional flags to the kubelet.\n # extraArgs:\n # key: value\n\n # # The `extraMounts` field is used to add additional mounts to the kubelet container.\n # extraMounts:\n # - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.\n # type: bind # Type specifies the mount kind.\n # source: /var/lib/example # Source specifies the source path of the mount.\n # # Options are fstab style mount options.\n # options:\n # - bind\n # - rshared\n # - rw\n\n # # The `extraConfig` field is used to provide kubelet configuration overrides.\n # extraConfig:\n # serverTLSBootstrap: true\n\n # # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.\n # credentialProviderConfig:\n # apiVersion: kubelet.config.k8s.io/v1\n # kind: CredentialProviderConfig\n # providers:\n # - apiVersion: credentialprovider.kubelet.k8s.io/v1\n # defaultCacheDuration: 12h\n # matchImages:\n # - '*.dkr.ecr.*.amazonaws.com'\n # - '*.dkr.ecr.*.amazonaws.com.cn'\n # - '*.dkr.ecr-fips.*.amazonaws.com'\n # - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'\n # - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'\n # name: ecr-credential-provider\n\n # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.\n # nodeIP:\n # # The `validSubnets` field configures the networks to pick kubelet node IP from.\n # validSubnets:\n # - 10.0.0.0/8\n # - '!10.0.0.3/32'\n # - fdc7::/16\n # Provides machine specific network configuration options.\n network: {}\n # # `interfaces` is used to define the network interface configuration.\n # interfaces:\n # - interface: enp0s1 # The interface name.\n # # Assigns static IP addresses to the interface.\n # addresses:\n # - 192.168.2.0/24\n # # A list of routes associated with the interface.\n # routes:\n # - network: 0.0.0.0/0 # The route's network (destination).\n # gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).\n # metric: 1024 # The optional metric for the route.\n # mtu: 1500 # The interface's MTU.\n # \n # # # Picks a network device using the selector.\n\n # # # select a device with bus prefix 00:*.\n # # deviceSelector:\n # # busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.\n # # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.\n # # deviceSelector:\n # # hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.\n # # driver: virtio_net # Kernel driver, supports matching by wildcard.\n # # # select a device with bus prefix 00:*, a device with mac address matching `*:f0:ab` and `virtio` kernel driver.\n # # deviceSelector:\n # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.\n # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.\n # # driver: virtio_net # Kernel driver, supports matching by wildcard.\n\n # # # Bond specific options.\n # # bond:\n # # # The interfaces that make up the bond.\n # # interfaces:\n # # - enp2s0\n # # - enp2s1\n # # # Picks a network device using the selector.\n # # deviceSelectors:\n # # - busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.\n # # - hardwareAddr: '*:f0:ab' # Device hardware (MAC) address, supports matching by wildcard.\n # # driver: virtio_net # Kernel driver, supports matching by wildcard.\n # # mode: 802.3ad # A bond option.\n # # lacpRate: fast # A bond option.\n\n # # # Bridge specific options.\n # # bridge:\n # # # The interfaces that make up the bridge.\n # # interfaces:\n # # - enxda4042ca9a51\n # # - enxae2a6774c259\n # # # Enable STP on this bridge.\n # # stp:\n # # enabled: true # Whether Spanning Tree Protocol (STP) is enabled.\n\n # # # Configure this device as a bridge port.\n # # bridgePort:\n # # master: br0 # The name of the bridge master interface\n\n # # # Indicates if DHCP should be used to configure the interface.\n # # dhcp: true\n\n # # # DHCP specific options.\n # # dhcpOptions:\n # # routeMetric: 1024 # The priority of all routes received via DHCP.\n\n # # # Wireguard specific configuration.\n\n # # # wireguard server example\n # # wireguard:\n # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).\n # # listenPort: 51111 # Specifies a device's listening port.\n # # # Specifies a list of peer configurations to apply to a device.\n # # peers:\n # # - publicKey: ABCDEF... # Specifies the public key of this peer.\n # # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.\n # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n # # allowedIPs:\n # # - 192.168.1.0/24\n # # # wireguard peer example\n # # wireguard:\n # # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).\n # # # Specifies a list of peer configurations to apply to a device.\n # # peers:\n # # - publicKey: ABCDEF... # Specifies the public key of this peer.\n # # endpoint: 192.168.1.2:51822 # Specifies the endpoint of this peer entry.\n # # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.\n # # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n # # allowedIPs:\n # # - 192.168.1.0/24\n\n # # # Virtual (shared) IP address configuration.\n\n # # # layer2 vip example\n # # vip:\n # # ip: 172.16.199.55 # Specifies the IP address to be used.\n\n # # Used to statically set the nameservers for the machine.\n # nameservers:\n # - 8.8.8.8\n # - 1.1.1.1\n\n # # Used to statically set arbitrary search domains.\n # searchDomains:\n # - example.org\n # - example.com\n\n # # Allows for extra entries to be added to the `/etc/hosts` file\n # extraHostEntries:\n # - ip: 192.168.1.100 # The IP of the host.\n # # The host alias.\n # aliases:\n # - example\n # - example.domain.tld\n\n # # Configures KubeSpan feature.\n # kubespan:\n # enabled: true # Enable the KubeSpan feature.\n\n # Used to provide instructions for installations.\n install:\n disk: /dev/nvme0n1 # The disk used for installations.\n image: ghcr.io/siderolabs/installer:v1.11.3 # Allows for supplying the image used to perform the installation.\n wipe: true # Indicates if the installation disk should be wiped at installation time.\n \n # # Look up disk using disk attributes like model, size, serial and others.\n # diskSelector:\n # size: 4GB # Disk size.\n # model: WDC* # Disk model `/sys/block//device/model`.\n # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.\n\n # # Allows for supplying extra kernel args via the bootloader.\n # extraKernelArgs:\n # - talos.platform=metal\n # - reboot=k\n # Used to configure the machine's container image registry mirrors.\n registries: {}\n # # Specifies mirror configuration for each registry host namespace.\n # mirrors:\n # ghcr.io:\n # # List of endpoints (URLs) for registry mirrors to use.\n # endpoints:\n # - https://registry.insecure\n # - https://ghcr.io/v2/\n\n # # Specifies TLS & auth configuration for HTTPS image registries.\n # config:\n # registry.insecure:\n # # The TLS configuration for the registry.\n # tls:\n # insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).\n # \n # # # Enable mutual TLS authentication with the registry.\n # # clientIdentity:\n # # crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t\n # # key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==\n # \n # # # The auth configuration for this registry.\n # # auth:\n # # username: username # Optional registry authentication.\n # # password: password # Optional registry authentication.\n\n # Features describe individual Talos features that can be switched on or off.\n features:\n rbac: true # Enable role-based access control (RBAC).\n stableHostname: true # Enable stable default hostname.\n apidCheckExtKeyUsage: true # Enable checks for extended key usage of client certificates in apid.\n diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.\n # KubePrism - local proxy/load balancer on defined port that will distribute\n kubePrism:\n enabled: true # Enable KubePrism support - will start local load balancing proxy.\n port: 7445 # KubePrism port.\n # Configures host DNS caching resolver.\n hostDNS:\n enabled: true # Enable host DNS caching resolver.\n forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.\n \n # # Configure Talos API access from Kubernetes pods.\n # kubernetesTalosAPIAccess:\n # enabled: true # Enable Talos API access from Kubernetes pods.\n # # The list of Talos API roles which can be granted for access from Kubernetes pods.\n # allowedRoles:\n # - os:reader\n # # The list of Kubernetes namespaces Talos API access is available from.\n # allowedKubernetesNamespaces:\n # - kube-system\n # Configures the node labels for the machine.\n nodeLabels:\n node.kubernetes.io/exclude-from-external-load-balancers: \"\"\n \n # # Provides machine specific control plane configuration options.\n\n # # ControlPlane definition example.\n # controlPlane:\n # # Controller manager machine specific configuration options.\n # controllerManager:\n # disabled: false # Disable kube-controller-manager on the node.\n # # Scheduler machine specific configuration options.\n # scheduler:\n # disabled: true # Disable kube-scheduler on the node.\n\n # # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\n # # nginx static pod.\n # pods:\n # - apiVersion: v1\n # kind: pod\n # metadata:\n # name: nginx\n # spec:\n # containers:\n # - image: nginx\n # name: nginx\n\n # # Allows the addition of user specified files.\n\n # # MachineFiles usage example.\n # files:\n # - content: '...' # The contents of the file.\n # permissions: 0o666 # The file's permissions in octal.\n # path: /tmp/file.txt # The path of the file.\n # op: append # The operation to use\n\n # # The `env` field allows for the addition of environment variables.\n\n # # Environment variables definition examples.\n # env:\n # GRPC_GO_LOG_SEVERITY_LEVEL: info\n # GRPC_GO_LOG_VERBOSITY_LEVEL: \"99\"\n # https_proxy: http://SERVER:PORT/\n # env:\n # GRPC_GO_LOG_SEVERITY_LEVEL: error\n # https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/\n # env:\n # https_proxy: http://DOMAIN\\USERNAME:PASSWORD@SERVER:PORT/\n\n # # Used to configure the machine's time settings.\n\n # # Example configuration for cloudflare ntp server.\n # time:\n # disabled: false # Indicates if the time service is disabled for the machine.\n # # description: |\n # servers:\n # - time.cloudflare.com\n # bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\n\n # # Used to configure the machine's sysctls.\n\n # # MachineSysctls usage example.\n # sysctls:\n # kernel.domainname: talos.dev\n # net.ipv4.ip_forward: \"0\"\n # net/ipv6/conf/eth0.100/disable_ipv6: \"1\"\n\n # # Used to configure the machine's sysfs.\n\n # # MachineSysfs usage example.\n # sysfs:\n # devices.system.cpu.cpu0.cpufreq.scaling_governor: performance\n\n # # Configures the udev system.\n # udev:\n # # List of udev rules to apply to the udev system\n # rules:\n # - SUBSYSTEM==\"drm\", KERNEL==\"renderD*\", GROUP=\"44\", MODE=\"0660\"\n\n # # Configures the logging system.\n # logging:\n # # Logging destination.\n # destinations:\n # - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are \"tcp\" and \"udp\".\n # format: json_lines # Logs format.\n\n # # Configures the kernel.\n # kernel:\n # # Kernel modules to load.\n # modules:\n # - name: brtfs # Module name.\n\n # # Configures the seccomp profiles for the machine.\n # seccompProfiles:\n # - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.\n # # The `value` field is used to provide the seccomp profile.\n # value:\n # defaultAction: SCMP_ACT_LOG\n\n # # Override (patch) settings in the default OCI runtime spec for CRI containers.\n\n # # override default open file limit\n # baseRuntimeSpecOverrides:\n # process:\n # rlimits:\n # - hard: 1024\n # soft: 1024\n # type: RLIMIT_NOFILE\n\n # # Configures the node annotations for the machine.\n\n # # node annotations example.\n # nodeAnnotations:\n # customer.io/rack: r13a25\n\n # # Configures the node taints for the machine. Effect is optional.\n\n # # node taints example.\n # nodeTaints:\n # exampleTaint: exampleTaintValue:NoSchedule\n# Provides cluster specific configuration options.\ncluster:\n id: 6JoJP8tRRRzFYZea1vKa1JGTIdevuUQTiroMjszyiL0= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).\n secret: 4QUgKw5RD052Rx2ksaA2JU7ApMSn23jz5r7+ao+6EQA= # Shared secret of cluster (base64 encoded random 32 bytes).\n # Provides control plane specific configuration options.\n controlPlane:\n endpoint: https://192.168.100.82:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\n clusterName: cluster_shopstack # Configures the cluster's name.\n # Provides cluster specific network configuration options.\n network:\n dnsDomain: cluster.local # The domain used by Kubernetes DNS.\n # The pod subnet CIDR.\n podSubnets:\n - 10.244.0.0/16\n # The service subnet CIDR.\n serviceSubnets:\n - 10.96.0.0/12\n \n # # The CNI used.\n # cni:\n # name: custom # Name of CNI to use.\n # # URLs containing manifests to apply for the CNI.\n # urls:\n # - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml\n token: u4dr80.1oysddst4x18swd3 # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.\n secretboxEncryptionSecret: zUs+G11gBvwphb/KU2tJHQnvgaZSVJj33b3BzC1E1As= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\n # The base64 encoded root certificate authority used by Kubernetes.\n ca:\n crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRUG56UzZ0cUR3dmdRUlc2MkRnVVVkREFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTFNVEV4TlRBM016a3dNbG9YRFRNMU1URXhNekEzTXprdwpNbG93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCQ1NSUVRoeEl5TkpmMHp1SFdLS2Q3aE5OV0F1blBWMUJreW8wNFVNM2YzOGVOdmdVWENwdnNIKzdkRkkKdE5qYzNGUFJ2MmFtTnVRTExUdGxwZmFBalArallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVVqcTdmbDVwR2luZ2FKaHJvbVN5bFRHM0lkcWd3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQU5VbkxMTGcKSVREU2FtSFh3c0xiRFRMKzVYLzdJUHZEeW9FeFowVjhxbmZrQWlFQTQ0UjIxeGpPUDVhYlNjcWh2NWtTYXMwSwpqR2R5MkxHTzVpMkhjNFhaVXdRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9iNlc0SDhpWGZzNGtPTkdpMkN4RGpXR0RGaUx0ZjdEc1FlMWJyMm00Z0JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSkpGQk9IRWpJMGwvVE80ZFlvcDN1RTAxWUM2YzlYVUdUS2pUaFF6ZC9meDQyK0JSY0ttKwp3Zjd0MFVpMDJOemNVOUcvWnFZMjVBc3RPMldsOW9DTS93PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=\n # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n aggregatorCA:\n crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRR1o1STVsRzJ2UVZZWEdFWXJkbXB4akFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMU1URXhOVEEzTXprd01sb1hEVE0xTVRFeE16QTNNemt3TWxvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCUERzNnVjR21oT2dWc2kzbkRLL3RpeW01djNnNmlFVEZmRzgvSUdqTW8wL1JBeXVYRFpxCnRWazhWdHRwdGIxZ3JiVEdRTWFOb21NWFFMT0FwREw4YklLallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVV0Um05QjdDUWIrdDZtU1ExR3lIRXF6eUIxL2d3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnClZ4NzdaWEp3b3JrdlhMRGdlK0pnZkErdjNqemEwbm1VRWt5MUk1R3hkTUVDSVFEd3NZZkM1aFJjTnRUeU1QMjEKaFVPc1A3bHBjYUF5Z2FBUTFWSUs3R0YyNlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUt3d3hLMDQzODNMNjV5ZUNhb0lEWmNVUG5RYWJhbEZwcnJSeVJTWWY5bnRvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFOE96cTV3YWFFNkJXeUxlY01yKzJMS2JtL2VEcUlSTVY4Yno4Z2FNeWpUOUVESzVjTm1xMQpXVHhXMjJtMXZXQ3R0TVpBeG8yaVl4ZEFzNENrTXZ4c2dnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=\n # The base64 encoded private key for service account token generation.\n serviceAccount:\n key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKSndJQkFBS0NBZ0VBbURCQk1tTHlkRW1GWnVMbkZaMkNxUmFtd1hFN2JicU14R2JsU0hqNWk4MlluamoyCmZhbTNYVTEvdlZUUGlHOEswV3pEenVPRGdzSHozNUUvRXdSK0kzSTl2K2dRQVJFdll1b2JWRXN5bFp2ZDlLYlkKTWNwMnc4UjlEUkFJVFd5NlNZVTN6WG5tRWZYbWczQ3FFRjMyRmRJWUg2MFVrTk1NQzhmUy9kMThLMGtUVk10VQpiMlpHNC91b3N3UkYzcVFDdUY3MGFPRTVSaFpUMHV3djFRd1ZYeEM0OExZU21qZ1FtbHl2YjZBemh6UHp4REpBCkxiS2g4aStLL1RYWW5MZXNSVnovbFVnRmFKQUVBMDgxTkdRV0U3TS9nMnJIVFhnLzhxV3FaSEMwcVNIMnFFekgKaTA1UFJUU1ZPOUNRUHV6V0doaVF0OXZlNlVubnRDenltWUk4bWRuTTJxc3VzM3QzSXhWYmU1L0U1eENlcm1rYQpwSU1oaTdGb25kL3l3UTkwY3hSQkRNNFZzdFZ1TGdoYllsUkREN1p5Y0d4MTA0ZlRUcXZjM0FhR016RmRNTSs0CjMyMldPYVhsTW0wNXZXU2dPYURQRWNUSWRkell0UVRMVm81RS9iWW5VSHFhOW5SVTRtc2Nkdjh1bVEzRi9RalEKLzFWa3FMQkg2cUhXV0c2TG0rSmZnQThiZmx6eE9NNDhJUTFqOVQwbFd1amlsc2RLa3h2U0Y1Um9tYkJoeEJzRQptOUF0aU9zbDN2MEk3SmlnQis4dTVKdnNlQUZVS0hsdElKWWNUU0hOeWxyRGViRGV3TWQzNm1Xak9scmRjVkNTCjdCNlFjRFJ2cGtzRk8zMXN0NjE1Njk2Z0QralFQUEw3dHlkMTMxZjZrNldTU1YzQzhHT0ZQTXE4VDkwQ0F3RUEKQVFLQ0FnQWQzc0s5SC95VVpHWEJodUZ5TmFNU2l2YVoyeDZkNzlKM0xmYnNuWW5sTGFvNXk5WmRYYlUybytKaApoOGJmOFdOL0xValZUNFJkWXJINS9Ha1QwM3JxZkI2d2p0eXRTUEV6Q2QzcFVvVVFKaktQTlR3VHNiaFR2am9KCkdVOTMydEpKWWROTkNoTGxEWTE3Mk40WUxra0JpV1hndWJqaW4vbXFTa01ZUHFPRFgybGk2REdmVjhTc05KV3MKNVRiTmR3VnRxSDF5SkZwNGJpTnZyNW5IeUFKZDBVdHJPMkUxVWJHNGlsNkltem5oM0ltSXhaQWhLQUZ2Sm5PeQpOU0paeUJjUTJpcno0dG5rNXZkU3F2WTNYVG1VRGtkMkJMd3ZjVjJqdzI1SkhuSG5ERnA4TisybVl1MWVHTzc5CmVYY0dVcmZIRVhFK0ZQS1FlVWYzN2lhRGlMTlo5WkRidlcyMkNWc0RiTHNUalczaWJQZmtzZUJrTEhnZHBPTUMKajJ3cVpsL0RjVkFyYzZuUVZyaXlhQXpiQ1Yxb1ZPTFZSc2JNL01zb0lDNVJ1b2pqc3AyNzhEY2RXaU1nZmdhKworb0M5RjRLVGZ6WHpiY1RTckUrV0pSbDZzc1pzZGw1eGNObTA0QWUxbW1UbFBMeHdGL0M2VUxZRVlDeW5nck1BCmNqYTAyWVpQM3NOVVpRbnVKZFZJMFJmSXlQV1lvby9oM01RNExTTm1FbEJFL0lGbnF6NmM2aCtrNGJnVE1mdUkKaFJPZzNXeGhRc0FMM3lSZGVkQXI3K2g0NVd6WFIyUlJMbDlrOE1oK0x6QnptUGdvUHplTlZIZlBlS0xyS3ZGeQpXTWdmY2dYOEFyNWlxdWNVTUtMaFFzc2hIbnNlVCtFaDN1ZEJEUDlwL3JNaG8rQ0RvUUtDQVFFQXhGR0J3TGh1ClFaYzRPWGZteEVqZTZHbkJyY1lldEF4Sk5KS0p6eE42YlBCZWZZRUJpcXFwdFFKS3JzTnQ2U1UyMmpJdDVaTkQKN2dJanE4Zk1URFZqVDVGL0N1L2pSa3NEY1VxcW12eFpUT0J0dTg2WGxzWHc0ekN6VWpxUlhubUZ0UFRqSGNkOQpNbnB1Z0QxNGRwNHVOK1BQYXU4RDU1aGN4NkFtL2FXeDlHY0QweTZWRC93QzZHOXJFalo2L1o2emlXRFZ1YjQ2CmFYdHZiTmpJdW52MW1WSGsveHhpWlN1SjF4SGUrZ2YyS3k4YVBhcFhPSGZBNHZrOExjZTc5MEdRaHIxdWMvYWoKeXBhM0l5OG52ekcvdUxES0FIaVhwOXU1TFRiSlg3SFpjQTZ6UnBkblpkY0x3SjlhRGtwR3doZWNseVF5NHBYZAo2MVdxSStQeHRSMzdKUUtDQVFFQXhuUlY4ZHRJc0ExUmY3WndJTVpVUHRsU2cvRHBkaE5KZzFUSktuaStmbjF2CjBYMGpWQWZ4ZmdVaG04MXVDUkg5MVI5d0s0aDRGYTg4a1MzaGp0Wlpva2VYNzlVSXlVbHlwUnJySmJ3Sko4Ym0KdnlPbXZ2aW92STFFNUtCcTA0dmdnN0pTVDFSZFlUVVMrUGpCUGhQR01zQUFWTEpCWEdJVjZGT2lxTTNsSk9FZQpRZUNyZGtBSnpKclQxajJ4L08rRVNwTTI1WUM2TW96dzVqSDdxa3ArM0Q3dnlzdVFzMzN0bW5FMkVzMlRvZnBIClhwUnhFR3Q5QlYxKzBCRHRmU3BlNXZwMGtQMndWMEcxbnlNSHd2ZkErdEozYloxaTJBOFlFc1hpRWI5SmtkM1QKMDQvZ1FScTJXSDNveFZ3S2huRFFSdGxVRlZhVHJ4UTdtVVF2VFJBQVdRS0NBUUJSaWRqdWhxdWtxbjQ3d0VVawp1Vzk3OEpEMDhCakloMkhRYUJ5ODJVWThBUW45N3BzSlVTRHpnV1FyZWhnb2djQnFsL1RnS1c1SmFMSVFJd2dECmp4a1ViMFhvOFFIZ3JEOWR5cmxaYmY1Wkk4M3Y5enFXOE5mQVJQWDE3VVY3aTlXdzl4VnR4UEdIQ2Jyam9LUnIKLy84S1Q2QlN0YnRWY2I3M1d0bFcrSDhWRjhSSzdrb1RQWVNucmI4MjdWSGdEUTVjdk0rSU9pNWdxVmY2U1gvMQpsSTdKZzI0dFYwaTI1SUozeFlCck1PdFp2RktWMGk0djBlMVhXRlZhWGw3L3IwZXI3dm4xU0RkM2FXbmZQekt2CkFxYXl1eHJyWHlyK0dSQ3NhdGp3MmhtSnBWRm92SEhCcHJQRzZXaXFEc2VjemRuSUhNelZ0NUZZc1ZmZFdFdUkKQWsvUkFvSUJBR1Y2aDVnczhYWlUyUi9kUW1rQUFZUkJ6SmY3VU9ZMzVwZHBlNVJrT2NTa2o5RW5sREViL3JqYQpGdDE4cG8rc3k0ZDNrL3d1eEhrU0tuNXlYNnlTbnpNRU9RVkNna09yY3h4S0w0UVVLdnBVRXhvYU9PSGVkU28xCmNzMFYyb3BpTkdRamcwTmRlSUtFaVRjV3ZIbnAwcWVRMXBwNHJFTjVSSXFRZWRTbnRFeXZjTEZ2R1Q1V2NLeFgKWDR0bDhPWE45Ry9ONTN4ajN0S0tqNFNtZW5JUnRkMFpzYlNaYzF6VlAvS0JnWTBMNGpvcHFPVU1NdVNha2t0MApDNnlKZTJkTmkwbkJPR29MejJoUENYaGVpVkdCTHdVVEtrNjY5QmhYWDQvNThDZnpFTU91RXV0VDN2QnJvR0tQCnY3OXIyVlgxeWdyd2hyYUNsdkluL25IWkUvYnIvOEVDZ2dFQVVTK2V2WG9BVjU4NW1wdVdrMytWVi8rYmFFQkkKaDIrZ2ErSUdNejU3K2w3OGg2RXdUN3pkRkVrcTVLeFljNXZhdnpNZncwbVhRNEZLK0lJMWZWVnZ2UGpsM3VJNApUNytvaDcwSUg0aFZLcmIyVkg2clBHNXBOT0xSU3J1QW1DVGdMN0FjOGtrRXJzaHpmQjVoSkNrdmpkaDdwSTYvClZnYTIrcDNWYXFMdWRDbXpnT0MzdXZiVjAxRjhSdjhxWWJMTXN6SXZzU0NyL0pMTE00RGZJaDdIWVJwNkdEUmgKbHF2NUtDeXVsbHl6bkNrTWRla2xrdmZqajRmUk42SEhsNEEvV1pLclBmQ1FxcGl4cEJOeFFOdGNGZTNSWXExKwpSVFV1eEhpaFdRd1NEbFl0U0lySmI0ejlXczRpT1dFYjZtRWJtWEFmT1daQlBXSWQyMDhoTkFxQkRRPT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K\n # API server specific configuration options.\n apiServer:\n image: registry.k8s.io/kube-apiserver:v1.34.1 # The container image used in the API server manifest.\n # Extra certificate subject alternative names for the API server's certificate.\n certSANs:\n - 192.168.100.82\n disablePodSecurityPolicy: true # Disable PodSecurityPolicy in the API server and default manifests.\n # Configure the API server admission plugins.\n admissionControl:\n - name: PodSecurity # Name is the name of the admission controller.\n # Configuration is an embedded configuration object to be used as the plugin's\n configuration:\n apiVersion: pod-security.admission.config.k8s.io/v1alpha1\n defaults:\n audit: restricted\n audit-version: latest\n enforce: baseline\n enforce-version: latest\n warn: restricted\n warn-version: latest\n exemptions:\n namespaces:\n - kube-system\n runtimeClasses: []\n usernames: []\n kind: PodSecurityConfiguration\n # Configure the API server audit policy.\n auditPolicy:\n apiVersion: audit.k8s.io/v1\n kind: Policy\n rules:\n - level: Metadata\n \n # # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.\n # authorizationConfig:\n # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.\n # name: webhook # Name is used to describe the authorizer.\n # # webhook is the configuration for the webhook authorizer.\n # webhook:\n # connectionInfo:\n # type: InClusterConfig\n # failurePolicy: Deny\n # matchConditionSubjectAccessReviewVersion: v1\n # matchConditions:\n # - expression: has(request.resourceAttributes)\n # - expression: '!(\\''system:serviceaccounts:kube-system\\'' in request.groups)'\n # subjectAccessReviewVersion: v1\n # timeout: 3s\n # - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.\n # name: in-cluster-authorizer # Name is used to describe the authorizer.\n # # webhook is the configuration for the webhook authorizer.\n # webhook:\n # connectionInfo:\n # type: InClusterConfig\n # failurePolicy: NoOpinion\n # matchConditionSubjectAccessReviewVersion: v1\n # subjectAccessReviewVersion: v1\n # timeout: 3s\n # Controller manager server specific configuration options.\n controllerManager:\n image: registry.k8s.io/kube-controller-manager:v1.34.1 # The container image used in the controller manager manifest.\n # Kube-proxy server-specific configuration options\n proxy:\n image: registry.k8s.io/kube-proxy:v1.34.1 # The container image used in the kube-proxy manifest.\n \n # # Disable kube-proxy deployment on cluster bootstrap.\n # disabled: false\n # Scheduler server specific configuration options.\n scheduler:\n image: registry.k8s.io/kube-scheduler:v1.34.1 # The container image used in the scheduler manifest.\n # Configures cluster member discovery.\n discovery:\n enabled: true # Enable the cluster membership discovery feature.\n # Configure registries used for cluster member discovery.\n registries:\n # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\n kubernetes:\n disabled: true # Disable Kubernetes discovery registry.\n # Service registry is using an external service to push and pull information about cluster members.\n service: {}\n # # External service endpoint.\n # endpoint: https://discovery.talos.dev/\n # Etcd specific configuration options.\n etcd:\n # The `ca` is the root certificate authority of the PKI.\n ca:\n crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRV2VzOHgvOGJ6eHIwOGJDZkZrL3FXREFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkxTVRFeE5UQTNNemt3TWxvWERUTTFNVEV4TXpBM016a3dNbG93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkhTM2lycVlKUS9JCnNuUmlucFYwYlJkSnBHVmtWSkpoVnRsQ2pvWFNwYVZYZk8zUzVHRFpJbVh0MDdTTkl5aUwvOTJZNjBWT2dEbm8KNmljaitpSFRERWlqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVdFBDN0lsTTBhc3RRCmNvT1RjWGJMd1ZqUEpId3dDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdjSEVBbXR0bUJtWjlnTUxQVUU0cGRsbEcKckE1ekxxbGVMelNvSTRnVVBCNENJUUNnSVV1bzNKWXRXVW9iZ0Rubm9GcDZjWDE2RU9tNENlT3FWbHlWUEM1dApadz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUp3TFVmaWp4eXNaektQbzE2eDV0ZGlKZjlMSVJpbW1zenlBZnNIZStXTzdvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFZExlS3VwZ2xEOGl5ZEdLZWxYUnRGMG1rWldSVWttRlcyVUtPaGRLbHBWZDg3ZExrWU5raQpaZTNUdEkwaktJdi8zWmpyUlU2QU9lanFKeVA2SWRNTVNBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=\n \n # # The container image used to create the etcd service.\n # image: gcr.io/etcd-development/etcd:v3.6.5\n\n # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.\n # advertisedSubnets:\n # - 10.0.0.0/8\n # A list of urls that point to additional manifests.\n extraManifests: []\n # - https://www.example.com/manifest1.yaml\n # - https://www.example.com/manifest2.yaml\n\n # A list of inline Kubernetes manifests.\n inlineManifests: []\n # - name: namespace-ci # Name of the manifest.\n # contents: |- # Manifest contents as a string.\n # apiVersion: v1\n # kind: Namespace\n # metadata:\n # \tname: ci\n\n \n # # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\n\n # # Decryption secret example (do not use in production!).\n # aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=\n\n # # Core DNS specific configuration options.\n # coreDNS:\n # image: registry.k8s.io/coredns/coredns:v1.12.4 # The `image` field is an override to the default coredns image.\n\n # # External cloud provider configuration.\n # externalCloudProvider:\n # enabled: true # Enable external cloud provider.\n # # A list of urls that point to additional manifests for an external cloud provider.\n # manifests:\n # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml\n # - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml\n\n # # A map of key value pairs that will be added while fetching the extraManifests.\n # extraManifestHeaders:\n # Token: \"1234567\"\n # X-ExtraInfo: info\n\n # # Settings for admin kubeconfig generation.\n # adminKubeconfig:\n # certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).\n\n # # Allows running workload on control-plane nodes.\n # allowSchedulingOnControlPlanes: true\n" diff --git a/talos/node_config.yaml b/talos/node_config.yaml new file mode 100644 index 0000000..e69de29 diff --git a/talos/node_machineconfig.yaml b/talos/node_machineconfig.yaml new file mode 100644 index 0000000..e69de29 diff --git a/talos/ntp.patch.yaml b/talos/ntp.patch.yaml new file mode 100644 index 0000000..b08199e --- /dev/null +++ b/talos/ntp.patch.yaml @@ -0,0 +1,5 @@ +machine: + time: + servers: + - time.google.com + - pool.ntp.org diff --git a/vpc/README.md b/vpc/README.md new file mode 100644 index 0000000..d1af2a6 --- /dev/null +++ b/vpc/README.md @@ -0,0 +1,48 @@ +> [!NOTE] +> Active VPC module for ShopStack infra v1. +> Used by `envs/dev/main.tf` via `source = "../../vpc"`. + +# vpc + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.5.0 | +| [aws](#requirement\_aws) | >= 5.0 | + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.8.1 | + +## Resources + +No resources. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [azs](#input\_azs) | List of Availability Zones where subnets will be created. | `list(string)` | n/a | yes | +| [env](#input\_env) | Deployment environment (e.g., dev, prod). | `string` | n/a | yes | +| [private\_subnet\_cidrs](#input\_private\_subnet\_cidrs) | List of CIDR blocks for the private subnets. | `list(string)` | n/a | yes | +| [project](#input\_project) | Project name used for resource naming and tagging. | `string` | n/a | yes | +| [public\_subnet\_cidrs](#input\_public\_subnet\_cidrs) | List of CIDR blocks for the public subnets. | `list(string)` | n/a | yes | +| [region](#input\_region) | AWS region where the VPC resources are created. | `string` | n/a | yes | +| [vpc\_cidr](#input\_vpc\_cidr) | Primary CIDR block for the VPC. | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [private\_subnets](#output\_private\_subnets) | List of private subnet IDs created in the VPC. | +| [public\_subnets](#output\_public\_subnets) | List of public subnet IDs created in the VPC. | +| [vpc\_id](#output\_vpc\_id) | ID of the VPC created by this module. | + diff --git a/vpc/main.tf b/vpc/main.tf index 8b9e408..a7b0e11 100644 --- a/vpc/main.tf +++ b/vpc/main.tf @@ -1,41 +1,27 @@ +provider "aws" { + region = var.region +} + + +# Base VPC module for the ShopStack environment. +# Uses terraform-aws-modules/vpc. NAT Gateway is disabled to reduce cost. module "vpc" { - # Use the official AWS VPC module from the Terraform Registry source = "terraform-aws-modules/vpc/aws" version = "5.8.1" - # Define VPC name based on project and environment - name = "${var.project}-${var.env}" - - # Set the CIDR block for the VPC - cidr = var.vpc_cidr + name = "${var.project}-${var.env}-vpc" + cidr = var.vpc_cidr - # Define the Availability Zones to use azs = var.azs - - # Define CIDR blocks for public and private subnets public_subnets = var.public_subnet_cidrs private_subnets = var.private_subnet_cidrs - # Enable NAT Gateway for outbound traffic from private subnets - enable_nat_gateway = true - - # Create one NAT Gateway per AZ for high availability - single_nat_gateway = false - one_nat_gateway_per_az = true + # Mantenerlo barato / simple + enable_nat_gateway = false + single_nat_gateway = false - # Enable DNS hostnames and DNS resolution support within the VPC - enable_dns_hostnames = true - enable_dns_support = true - - # Common tags for resource identification and management tags = { Project = var.project Env = var.env - Managed = "terraform" } } - -# Output VPC and subnet identifiers -output "vpc_id" { value = module.vpc.vpc_id } -output "public_subnet_ids" { value = module.vpc.public_subnets } -output "private_subnet_ids" { value = module.vpc.private_subnets } diff --git a/vpc/outputs.tf b/vpc/outputs.tf new file mode 100644 index 0000000..039783f --- /dev/null +++ b/vpc/outputs.tf @@ -0,0 +1,15 @@ +output "vpc_id" { + description = "ID of the VPC created by this module." + value = module.vpc.vpc_id +} + +output "public_subnets" { + description = "List of public subnet IDs created in the VPC." + value = module.vpc.public_subnets +} + +output "private_subnets" { + description = "List of private subnet IDs created in the VPC." + value = module.vpc.private_subnets +} + diff --git a/vpc/variables.tf b/vpc/variables.tf index a0e7769..d355e13 100644 --- a/vpc/variables.tf +++ b/vpc/variables.tf @@ -1,34 +1,34 @@ variable "project" { - type = string - default = "shopstack" + type = string + description = "Project name used for resource naming and tagging." } variable "env" { - type = string - default = "dev" + type = string + description = "Deployment environment (e.g., dev, prod)." } variable "region" { - type = string - default = "us-east-1" + type = string + description = "AWS region where the VPC resources are created." } variable "vpc_cidr" { - type = string - default = "10.0.0.0/16" + type = string + description = "Primary CIDR block for the VPC." } variable "azs" { - type = list(string) - default = ["us-east-1a", "us-east-1b"] + type = list(string) + description = "List of Availability Zones where subnets will be created." } variable "public_subnet_cidrs" { - type = list(string) - default = ["10.0.0.0/24", "10.0.1.0/24"] + type = list(string) + description = "List of CIDR blocks for the public subnets." } variable "private_subnet_cidrs" { - type = list(string) - default = ["10.0.10.0/24", "10.0.11.0/24"] + type = list(string) + description = "List of CIDR blocks for the private subnets." } diff --git a/vpc/versions.tf b/vpc/versions.tf index a84eba9..b088b0f 100644 --- a/vpc/versions.tf +++ b/vpc/versions.tf @@ -1,20 +1,10 @@ terraform { - required_version = ">= 1.6.0" + required_version = ">= 1.5.0" + required_providers { aws = { source = "hashicorp/aws" - version = "~> 5.60" + version = ">= 5.0" } } - backend "s3" { - bucket = "shopstack-dev-tfstate" - key = "shopstack/dev/terraform.tfstate" - region = "us-east-1" - dynamodb_table = "shopstack-dev-tflock" - encrypt = true - } -} - -provider "aws" { - region = var.region }