diff --git a/.cruft.json b/.cruft.json index e79bd71..2cdb08e 100644 --- a/.cruft.json +++ b/.cruft.json @@ -21,9 +21,9 @@ "auto_release": "y", "copyright_holder": "VSHN AG ", "copyright_year": "2026", - "github_owner": "vshn", + "github_owner": "projectsyn", "github_name": "component-capi-provider-talos", - "github_url": "https://github.com/vshn/component-capi-provider-talos", + "github_url": "https://github.com/projectsyn/component-capi-provider-talos", "_template": "https://github.com/projectsyn/commodore-component-template.git", "_commit": "aec8da7344f670fff4f96fb20cbdcfbdeb2113d4" } diff --git a/.gitignore b/.gitignore index f6ff082..1ec97e6 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /_public # Additional entries +envsubst-v* diff --git a/.yamllint.yml b/.yamllint.yml index 92aea6c..f109579 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -22,3 +22,4 @@ ignore: | manifests/ vendor/ compiled/ + tests/golden/** diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0ff8bd7..45cb4e5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -3,4 +3,4 @@ This code repository is part of Project Syn and the contribution guide at https://syn.tools/syn/about/contribution_guide.html does apply. -Submit Pull Requests at https://github.com/vshn/component-capi-provider-talos/pulls. +Submit Pull Requests at https://github.com/projectsyn/component-capi-provider-talos/pulls. diff --git a/class/capi-provider-talos.yml b/class/capi-provider-talos.yml index d3fb7bd..f48ab74 100644 --- a/class/capi-provider-talos.yml +++ b/class/capi-provider-talos.yml @@ -8,4 +8,46 @@ parameters: - input_paths: - ${_base_directory}/component/main.jsonnet input_type: jsonnet - output_path: capi-provider-talos/ + output_path: . + - input_paths: + - ${_base_directory}/component/bootstrap-provider.jsonnet + input_type: jsonnet + output_path: ${_base_directory}/manifests/capi-bootstrap-provider-talos/ + - input_type: external + output_path: . + input_paths: + - ${_kustomize_wrapper} + env_vars: + INPUT_DIR: ${_base_directory}/manifests/capi-bootstrap-provider-talos/ + args: + - ${_base_directory}/manifests/capi-bootstrap-provider-talos-rendered/ + - input_type: external + output_path: . + input_paths: + - ${_base_directory}/envsubst-dir + # map env vars from parameters as needed + env_vars: ${capi_provider_talos:bootstrap:variables} + args: + - ${_base_directory}/manifests/capi-bootstrap-provider-talos-rendered + - \${compiled_target_dir}/capi-provider-talos/bootstrap/10_kustomize + - input_paths: + - ${_base_directory}/component/controlplane-provider.jsonnet + input_type: jsonnet + output_path: ${_base_directory}/manifests/capi-controlplane-provider-talos/ + - input_type: external + output_path: . + input_paths: + - ${_kustomize_wrapper} + env_vars: + INPUT_DIR: ${_base_directory}/manifests/capi-controlplane-provider-talos/ + args: + - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered/ + - input_type: external + output_path: . + input_paths: + - ${_base_directory}/envsubst-dir + # map env vars from parameters as needed + env_vars: ${capi_provider_talos:controlplane:variables} + args: + - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered + - \${compiled_target_dir}/capi-provider-talos/controlplane/10_kustomize diff --git a/class/defaults.yml b/class/defaults.yml index 2d45221..fa73e85 100644 --- a/class/defaults.yml +++ b/class/defaults.yml @@ -2,4 +2,20 @@ parameters: capi_provider_talos: =_metadata: multi_tenant: true - namespace: syn-capi-provider-talos + namespace: syn-cluster-api + + images: + capi-bootstrap-provider-talos: + registry: ghcr.io + image: siderolabs/cluster-api-bootstrap-talos-controller + tag: v0.6.12 + capi-controlplane-provider-talos: + registry: ghcr.io + image: siderolabs/cluster-api-control-plane-talos-controller + tag: v0.5.13 + + bootstrap: + variables: {} + + controlplane: + variables: {} diff --git a/component/app.jsonnet b/component/app.jsonnet index 4e9839f..8b489d3 100644 --- a/component/app.jsonnet +++ b/component/app.jsonnet @@ -3,7 +3,13 @@ local inv = kap.inventory(); local params = inv.parameters.capi_provider_talos; local argocd = import 'lib/argocd.libjsonnet'; -local app = argocd.App('capi-provider-talos', params.namespace); +local app = argocd.App('capi-provider-talos', params.namespace) { + spec+: { + syncOptions+: [ + 'ServerSideApply=true', + ], + }, +}; local appPath = local project = std.get(std.get(app, 'spec', {}), 'project', 'syn'); diff --git a/component/bootstrap-provider.jsonnet b/component/bootstrap-provider.jsonnet new file mode 100644 index 0000000..d428f57 --- /dev/null +++ b/component/bootstrap-provider.jsonnet @@ -0,0 +1,42 @@ +local com = import 'lib/commodore.libjsonnet'; +local kap = import 'lib/kapitan.libjsonnet'; +local kube = import 'lib/kube.libjsonnet'; +local inv = kap.inventory(); +// The hiera parameters for the component +local params = inv.parameters.capi_provider_talos; + +local manifest_path = 'config/default'; + +com.Kustomization( + 'https://github.com/siderolabs/cluster-api-bootstrap-provider-talos/' + manifest_path, + params.images['capi-bootstrap-provider-talos'].tag, + { + 'ghcr.io/siderolabs/cluster-api-bootstrap-talos-controller': { + local image = params.images['capi-bootstrap-provider-talos'], + newTag: image.tag, + newName: '%(registry)s/%(image)s' % image, + }, + }, + { + namespace: params.namespace, + labels+: [ + { + pairs: { + 'app.kubernetes.io/managed-by': 'commodore', + }, + }, + ], + patchesStrategicMerge: [ 'rm-namespace.yaml' ], + }, +) { + 'rm-namespace': [ + { + '$patch': 'delete', + apiVersion: 'v1', + kind: 'Namespace', + metadata: { + name: 'cabpt-system', + }, + }, + ], +} diff --git a/component/controlplane-provider.jsonnet b/component/controlplane-provider.jsonnet new file mode 100644 index 0000000..b057c36 --- /dev/null +++ b/component/controlplane-provider.jsonnet @@ -0,0 +1,42 @@ +local com = import 'lib/commodore.libjsonnet'; +local kap = import 'lib/kapitan.libjsonnet'; +local kube = import 'lib/kube.libjsonnet'; +local inv = kap.inventory(); +// The hiera parameters for the component +local params = inv.parameters.capi_provider_talos; + +local manifest_path = 'config/default'; + +com.Kustomization( + 'https://github.com/siderolabs/cluster-api-control-plane-provider-talos/' + manifest_path, + params.images['capi-controlplane-provider-talos'].tag, + { + 'ghcr.io/siderolabs/cluster-api-control-plane-talos-controller': { + local image = params.images['capi-controlplane-provider-talos'], + newTag: image.tag, + newName: '%(registry)s/%(image)s' % image, + }, + }, + { + namespace: params.namespace, + labels+: [ + { + pairs: { + 'app.kubernetes.io/managed-by': 'commodore', + }, + }, + ], + patchesStrategicMerge: [ 'rm-namespace.yaml' ], + }, +) { + 'rm-namespace': [ + { + '$patch': 'delete', + apiVersion: 'v1', + kind: 'Namespace', + metadata: { + name: 'cacppt-system', + }, + }, + ], +} diff --git a/component/main.jsonnet b/component/main.jsonnet index 237819c..b8e8cc7 100644 --- a/component/main.jsonnet +++ b/component/main.jsonnet @@ -5,6 +5,8 @@ local inv = kap.inventory(); // The hiera parameters for the component local params = inv.parameters.capi_provider_talos; +assert std.member(inv.applications, 'capi-core') : 'Component capi-provider-talos requires component capi-core'; + // Define outputs below { } diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc index ca3ce45..2351b46 100644 --- a/docs/modules/ROOT/pages/references/parameters.adoc +++ b/docs/modules/ROOT/pages/references/parameters.adoc @@ -6,14 +6,67 @@ The parent key for all of the following parameters is `capi_provider_talos`. [horizontal] type:: string -default:: `syn-capi-provider-talos` +default:: `syn-cluster-api` The namespace in which to deploy this component. +The component assumes that this namespace already exists via dependency `component-capi-core`. +== `images` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +The default Docker image location and tag to use for the CAPI provider talos components (keys `capi-boostrap-provider-talos` and `capi-controlplane-provider-talos`). + +Entries in this dict should be dictionaries with keys `registry`, `image`, and `tag`. This structure provides the basis for dependency maintenance with Renovate. + +The values of `capi-bootstrap-provider-talos.tag` and `capi-controlplane-provider-talos.tag` in this dict is used by the component to select the versions of the upstream CAPI provider talos components. + +== `bootstrap.variables` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +An object with environment variables that the generated manifests of the bootstrap provider will be templated with, similar to `clusterctl`. +Variables should be specified in the format: + +[source,yaml] +---- +variables: + FOO: bar +---- + +== `controlplane.variables` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +An object with environment variables that the generated manifests of the control plane provider will be templated with, similar to `clusterctl`. +variables should be specified in the format: + +[source,yaml] +---- +variables: + FOO: bar +---- == Example [source,yaml] ---- namespace: example-namespace +images: + capi-bootstrap-provider-talos: + tag: tag: v0.6.12 + capi-controlplane-provider-talos: + tag: tag: v0.5.13 +bootstrap: + variables: + MY_VARIABLE: value +controlplane: + variables: + MY_VARIABLE: value ---- diff --git a/envsubst-dir b/envsubst-dir new file mode 100755 index 0000000..8a83f90 --- /dev/null +++ b/envsubst-dir @@ -0,0 +1,77 @@ +#!/usr/bin/env bash +set -euo pipefail + +basedir=$(dirname "$0") +version="${ENVSUBST_VERSION:-v1.4.3}" + +src="$1" +dst="$2" + +ensure_envsubst () { + set -eu + + local dir="$1" + # Version with leading `v`. + local version="$2" + + local arch + arch=$(uname -m) + case $arch in + aarch64|arm64) arch="arm64";; + x86_64|amd64) arch="x86_64";; + *) + >&2 echo "Unsupported arch: $arch" + exit 5 + :: + esac + + local os + os=$(uname -s) + if [[ "$os" != "Linux" && "$os" != "Darwin" ]]; then + >&2 echo "Unsupported os: $os" + exit 5 + fi + + if [ ! -x "${dir}/envsubst-${version}-${os}-${arch}" ]; then + download_envsubst "${dir}" "${version}" "${os}" "${arch}" + else + >&2 echo "envsubst-${version}-${os}-${arch} already installed" + fi + + echo "${dir}/envsubst-${version}-${os}-${arch}" +} + +download_envsubst () { + set -eu + + local dir="$1" + local version="$2" + local os="$3" + local arch="$4" + + local url="https://github.com/a8m/envsubst/releases/download/${version}/envsubst-${os}-${arch}" + + >&2 echo "Downloading envsubst-${version}-${os}-${arch} from ${url}" + + curl -fsSLo "${dir}/envsubst-${version}-${os}-${arch}" "${url}" + chmod +x "${dir}/envsubst-${version}-${os}-${arch}" + + >&2 echo "envsubst-${version}-${os}-${arch} successfully installed" +} + +envsubst="$(ensure_envsubst "${basedir}" "${version}")" + +mkdir -p "$dst" + +find "$src" -type f -name '*.yaml' -print0 | +while IFS= read -r -d '' file; do + relative="${file#$src/}" + output="$dst/$relative" + + mkdir -p "$(dirname "$output")" + + "$envsubst" \ + -no-unset \ + -i "$file" \ + -o "$output" +done diff --git a/tests/defaults.yml b/tests/defaults.yml index a4da5b7..c837aa2 100644 --- a/tests/defaults.yml +++ b/tests/defaults.yml @@ -1,3 +1,6 @@ # Overwrite parameters here +applications: + - capi-core + # parameters: {...} diff --git a/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml b/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml index e69de29..1b6582d 100644 --- a/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml +++ b/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml @@ -0,0 +1,3 @@ +spec: + syncOptions: + - ServerSideApply=true diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml new file mode 100644 index 0000000..abfdaf6 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml @@ -0,0 +1,49 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /validate-bootstrap-cluster-x-k8s-io-v1alpha3-talosconfig + failurePolicy: Fail + name: vtalosconfig.cluster.x-k8s.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + resources: + - talosconfigs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /validate-bootstrap-cluster-x-k8s-io-v1alpha3-talosconfigtemplate + failurePolicy: Fail + name: vtalosconfigtemplate.cluster.x-k8s.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - UPDATE + resources: + - talosconfigtemplates + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..606fed0 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml @@ -0,0 +1,246 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: talosconfigs.bootstrap.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: bootstrap.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosConfig + listKind: TalosConfigList + plural: talosconfigs + singular: talosconfig + scope: Namespaced + versions: + - name: v1alpha2 + schema: + openAPIV3Schema: + description: TalosConfig is the Schema for the talosconfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + data: + type: string + generateType: + type: string + required: + - generateType + type: object + status: + description: TalosConfigStatus defines the observed state of TalosConfig + properties: + bootstrapData: + description: BootstrapData will be a slice of bootstrap data + format: byte + type: string + errorMessage: + description: ErrorMessage will be set on non-retryable errors + type: string + errorReason: + description: ErrorReason will be set on non-retryable errors + type: string + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed + type: boolean + talosConfig: + description: Talos config will be a string containing the config for + download + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosConfig is the Schema for the talosconfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge patch + list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + status: + description: TalosConfigStatus defines the observed state of TalosConfig + properties: + conditions: + description: Conditions defines current service state of the TalosConfig. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This field may be empty. + maxLength: 10240 + minLength: 1 + type: string + reason: + description: |- + reason is the reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may be empty. + maxLength: 256 + minLength: 1 + type: string + severity: + description: |- + severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + maxLength: 32 + type: string + status: + description: status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + maxLength: 256 + minLength: 1 + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors + type: string + failureReason: + description: FailureReason will be set on non-retryable errors + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed + type: boolean + talosConfig: + description: |- + Talos config will be a string containing the config for download. + + Deprecated: please use `-talosconfig` secret. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..a7b0183 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml @@ -0,0 +1,164 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: talosconfigtemplates.bootstrap.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: bootstrap.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosConfigTemplate + listKind: TalosConfigTemplateList + plural: talosconfigtemplates + singular: talosconfigtemplate + scope: Namespaced + versions: + - name: v1alpha2 + schema: + openAPIV3Schema: + description: TalosConfigTemplate is the Schema for the talosconfigtemplates + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigTemplateSpec defines the desired state of TalosConfigTemplate + properties: + template: + description: TalosConfigTemplateResource defines the Template structure + properties: + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + data: + type: string + generateType: + type: string + required: + - generateType + type: object + type: object + required: + - template + type: object + type: object + served: true + storage: false + - name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosConfigTemplate is the Schema for the talosconfigtemplates + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigTemplateSpec defines the desired state of TalosConfigTemplate + properties: + template: + description: TalosConfigTemplateResource defines the Template structure + properties: + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + type: object + required: + - template + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml new file mode 100644 index 0000000..9688855 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml @@ -0,0 +1,76 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + name: cabpt-controller-manager + namespace: syn-cluster-api +spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + template: + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + spec: + containers: + - args: + - --enable-leader-election + - --feature-gates=MachinePool=false + - --diagnostics-address=:8443 + - --insecure-diagnostics=false + command: + - /manager + image: ghcr.io/siderolabs/cluster-api-talos-controller:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 500m + memory: 500Mi + requests: + cpu: 100m + memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: cabpt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml new file mode 100644 index 0000000..63d3bad --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-serving-cert + namespace: syn-cluster-api +spec: + dnsNames: + - cabpt-webhook-service.syn-cluster-api.svc + - cabpt-webhook-service.syn-cluster-api.svc.cluster.local + issuerRef: + kind: Issuer + name: cabpt-selfsigned-issuer + secretName: cabpt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml new file mode 100644 index 0000000..0f0d329 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml @@ -0,0 +1,10 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-selfsigned-issuer + namespace: syn-cluster-api +spec: + selfSigned: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml new file mode 100644 index 0000000..fb0cf78 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml @@ -0,0 +1,60 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-manager-role +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs/status + verbs: + - get + - patch + - update +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + - machines + - machines/status + verbs: + - get + - list + - watch +- apiGroups: + - exp.cluster.x-k8s.io + resources: + - machinepools + - machinepools/status + verbs: + - get + - list + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml new file mode 100644 index 0000000..25788c0 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml new file mode 100644 index 0000000..f83d166 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-talosconfig-editor-role +rules: +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs/status + verbs: + - get + - patch + - update diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml new file mode 100644 index 0000000..cddc604 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-manager-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml new file mode 100644 index 0000000..d8aecdb --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-proxy-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml new file mode 100644 index 0000000..160ade2 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-talosconfig-editor-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-talosconfig-editor-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml new file mode 100644 index 0000000..ed974a6 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml @@ -0,0 +1,47 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-leader-election-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml new file mode 100644 index 0000000..b9864fd --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-leader-election-rolebinding + namespace: syn-cluster-api +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cabpt-leader-election-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml new file mode 100644 index 0000000..77817b9 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + name: cabpt-controller-manager-metrics-service + namespace: syn-cluster-api +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml new file mode 100644 index 0000000..4b30f7a --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-webhook-service + namespace: syn-cluster-api +spec: + ports: + - port: 443 + targetPort: 9443 + selector: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml new file mode 100644 index 0000000..0e3b7ec --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml @@ -0,0 +1,32 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-mutating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: cacppt-webhook-service + namespace: syn-cluster-api + path: /mutate-controlplane-cluster-x-k8s-io-v1alpha3-taloscontrolplane + failurePolicy: Fail + matchPolicy: Equivalent + name: default.taloscontrolplane.controlplane.cluster.x-k8s.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + resources: + - taloscontrolplanes + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml new file mode 100644 index 0000000..77d4f88 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml @@ -0,0 +1,31 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cacppt-webhook-service + namespace: syn-cluster-api + path: /validate-controlplane-cluster-x-k8s-io-v1alpha3-taloscontrolplane + failurePolicy: Fail + name: validate.taloscontrolplane.controlplane.cluster.x-k8s.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - taloscontrolplanes + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..0401f9c --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml @@ -0,0 +1,413 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: taloscontrolplanes.controlplane.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: controlplane.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosControlPlane + listKind: TalosControlPlaneList + plural: taloscontrolplanes + shortNames: + - tcp + singular: taloscontrolplane + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: TalosControlPlane API Server is ready to receive requests + jsonPath: .status.ready + name: Ready + type: boolean + - description: This denotes whether or not the control plane has the uploaded + talos-config configmap + jsonPath: .status.initialized + name: Initialized + type: boolean + - description: Total number of non-terminated machines targeted by this control + plane + jsonPath: .status.replicas + name: Replicas + type: integer + - description: Total number of fully running and ready control plane machines + jsonPath: .status.readyReplicas + name: Ready Replicas + type: integer + - description: Total number of unavailable machines targeted by this control plane + jsonPath: .status.unavailableReplicas + name: Unavailable Replicas + type: integer + name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosControlPlane is the Schema for the taloscontrolplanes API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosControlPlaneSpec defines the desired state of TalosControlPlane + properties: + controlPlaneConfig: + description: |- + ControlPlaneConfig is a two TalosConfigSpecs + to use for initializing and joining machines to the control plane. + properties: + controlplane: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + init: + description: 'Deprecated: starting from cacppt v0.4.0 provider + doesn''t use init configs.' + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + required: + - controlplane + type: object + infrastructureTemplate: + description: |- + InfrastructureTemplate is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + replicas: + description: |- + Number of desired machines. Defaults to 1. When stacked etcd is used only + odd numbers are permitted, as per [etcd best practice](https://etcd.io/docs/v3.3.12/faq/#why-an-odd-number-of-cluster-members). + This is a pointer to distinguish between explicit zero and not specified. + format: int32 + type: integer + rolloutStrategy: + default: + rollingUpdate: + maxSurge: 1 + type: RollingUpdate + description: |- + The RolloutStrategy to use to replace control plane machines with + new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if + RolloutStrategyType = RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of control planes that can be scheduled above or under the + desired number of control planes. + Value can be an absolute number 1 or 0. + Defaults to 1. + Example: when this is set to 1, the control plane can be scaled + up immediately when the rolling update starts. + x-kubernetes-int-or-string: true + type: object + type: + description: |- + Change rollout strategy. + + Supported strategies: + * "RollingUpdate". + * "OnDelete" + + Default is RollingUpdate. + type: string + type: object + version: + description: Version defines the desired Kubernetes version. + minLength: 2 + pattern: ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?$ + type: string + required: + - controlPlaneConfig + - infrastructureTemplate + - version + type: object + status: + description: TalosControlPlaneStatus defines the observed state of TalosControlPlane + properties: + bootstrapped: + description: |- + Bootstrapped denotes whether any nodes received bootstrap request + which is required to start etcd and Kubernetes components in Talos. + type: boolean + conditions: + description: Conditions defines current service state of the KubeadmControlPlane. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This field may be empty. + maxLength: 10240 + minLength: 1 + type: string + reason: + description: |- + reason is the reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may be empty. + maxLength: 256 + minLength: 1 + type: string + severity: + description: |- + severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + maxLength: 32 + type: string + status: + description: status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + maxLength: 256 + minLength: 1 + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + failureMessage: + description: |- + ErrorMessage indicates that there is a terminal problem reconciling the + state, and will be set to a descriptive error message. + type: string + failureReason: + description: |- + FailureReason indicates that there is a terminal problem reconciling the + state, and will be set to a token value suitable for + programmatic interpretation. + type: string + initialized: + description: |- + Initialized denotes whether or not the control plane has the + uploaded talos-config configmap. + type: boolean + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: |- + Ready denotes that the TalosControlPlane API Server is ready to + receive requests. + type: boolean + readyReplicas: + description: Total number of fully running and ready control plane + machines. + format: int32 + type: integer + replicas: + description: |- + Total number of non-terminated machines targeted by this control plane + (their labels match the selector). + format: int32 + type: integer + selector: + description: |- + Selector is the label selector in string format to avoid introspection + by clients, and is used to provide the CRD-based integration for the + scale subresource and additional integrations for things like kubectl + describe.. The string will be in the same format as the query-param syntax. + More info about label selectors: http://kubernetes.io/docs/user-guide/labels#label-selectors + type: string + unavailableReplicas: + description: |- + Total number of unavailable machines targeted by this control plane. + This is the total number of machines that are still required for + the deployment to have 100% available capacity. They may either + be machines that are running but not yet ready or machines + that still have not been created. + format: int32 + type: integer + version: + description: |- + version represents the minimum Kubernetes version for the control plane machines + in the cluster. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml new file mode 100644 index 0000000..6614859 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml @@ -0,0 +1,78 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + name: cacppt-controller-manager + namespace: syn-cluster-api +spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + template: + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + spec: + containers: + - args: + - --enable-leader-election + - --diagnostics-address=:8443 + - --insecure-diagnostics=false + command: + - /manager + env: + - name: GRPC_ENFORCE_ALPN_ENABLED + value: "false" + image: ghcr.io/siderolabs/cluster-api-control-plane-talos-controller:v0.5.13 + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 500Mi + requests: + cpu: 100m + memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: cacppt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml new file mode 100644 index 0000000..b7fae35 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-serving-cert + namespace: syn-cluster-api +spec: + dnsNames: + - cacppt-webhook-service.syn-cluster-api.svc + - cacppt-webhook-service.syn-cluster-api.svc.cluster.local + issuerRef: + kind: Issuer + name: cacppt-selfsigned-issuer + secretName: cacppt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml new file mode 100644 index 0000000..dfe7b35 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml @@ -0,0 +1,10 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-selfsigned-issuer + namespace: syn-cluster-api +spec: + selfSigned: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml new file mode 100644 index 0000000..43dbe0e --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml @@ -0,0 +1,65 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-role +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + - controlplane.cluster.x-k8s.io + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + verbs: + - get + - list + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machines/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml new file mode 100644 index 0000000..f0c4c87 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-metrics-reader +rules: +- nonResourceURLs: + - /metrics + verbs: + - get diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml new file mode 100644 index 0000000..294d863 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml new file mode 100644 index 0000000..d3ede3a --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cacppt-manager-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml new file mode 100644 index 0000000..cf9fab5 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cacppt-proxy-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml new file mode 100644 index 0000000..7792d2b --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml @@ -0,0 +1,47 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-leader-election-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml new file mode 100644 index 0000000..24f6f28 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - get + - list + - watch +- apiGroups: + - rbac + resources: + - rolebindings + - roles + verbs: + - create + - get + - list + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml new file mode 100644 index 0000000..8417a65 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-leader-election-rolebinding + namespace: syn-cluster-api +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cacppt-leader-election-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml new file mode 100644 index 0000000..525fa9b --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + name: cacppt-controller-manager-metrics-service + namespace: syn-cluster-api +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml new file mode 100644 index 0000000..a106407 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-webhook-service + namespace: syn-cluster-api +spec: + ports: + - port: 443 + targetPort: 9443 + selector: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager