From 5d370184040d91fb4bb433dd655454b692c92501 Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Wed, 19 Aug 2026 00:25:47 +0200 Subject: [PATCH 1/6] Initial implementation using kustomize and envsubst --- Makefile | 2 +- class/capi-provider-talos.yml | 44 +- class/defaults.yml | 35 +- component/bootstrap-provider.jsonnet | 41 ++ component/controlplane-provider.jsonnet | 41 ++ component/main.jsonnet | 2 + scripts/envsubst-dir | 20 + tests/defaults.yml | 3 + ...abpt-validating-webhook-configuration.yaml | 49 +++ ...losconfigs.bootstrap.cluster.x-k8s.io.yaml | 246 +++++++++++ ...gtemplates.bootstrap.cluster.x-k8s.io.yaml | 164 +++++++ ...1_deployment_cabpt-controller-manager.yaml | 76 ++++ ....io_v1_certificate_cabpt-serving-cert.yaml | 16 + ....io_v1_issuer_cabpt-selfsigned-issuer.yaml | 10 + ....io_v1_clusterrole_cabpt-manager-role.yaml | 60 +++ ...8s.io_v1_clusterrole_cabpt-proxy-role.yaml | 20 + ...terrole_cabpt-talosconfig-editor-role.yaml | 28 ++ ...rolebinding_cabpt-manager-rolebinding.yaml | 15 + ...errolebinding_cabpt-proxy-rolebinding.yaml | 15 + ..._cabpt-talosconfig-editor-rolebinding.yaml | 15 + ...io_v1_role_cabpt-leader-election-role.yaml | 47 ++ ...ing_cabpt-leader-election-rolebinding.yaml | 16 + ...pt-controller-manager-metrics-service.yaml | 17 + .../v1_service_cabpt-webhook-service.yaml | 15 + ...cacppt-mutating-webhook-configuration.yaml | 32 ++ ...cppt-validating-webhook-configuration.yaml | 31 ++ ...lplanes.controlplane.cluster.x-k8s.io.yaml | 413 ++++++++++++++++++ ..._deployment_cacppt-controller-manager.yaml | 78 ++++ ...io_v1_certificate_cacppt-serving-cert.yaml | 16 + ...io_v1_issuer_cacppt-selfsigned-issuer.yaml | 10 + ...io_v1_clusterrole_cacppt-manager-role.yaml | 65 +++ ..._v1_clusterrole_cacppt-metrics-reader.yaml | 12 + ...s.io_v1_clusterrole_cacppt-proxy-role.yaml | 20 + ...olebinding_cacppt-manager-rolebinding.yaml | 15 + ...rrolebinding_cacppt-proxy-rolebinding.yaml | 15 + ...o_v1_role_cacppt-leader-election-role.yaml | 47 ++ ...on.k8s.io_v1_role_cacppt-manager-role.yaml | 28 ++ ...ng_cacppt-leader-election-rolebinding.yaml | 16 + ...pt-controller-manager-metrics-service.yaml | 17 + .../v1_service_cacppt-webhook-service.yaml | 15 + 40 files changed, 1824 insertions(+), 3 deletions(-) create mode 100644 component/bootstrap-provider.jsonnet create mode 100644 component/controlplane-provider.jsonnet create mode 100755 scripts/envsubst-dir create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml create mode 100644 tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml diff --git a/Makefile b/Makefile index 02f0524..d0556a8 100644 --- a/Makefile +++ b/Makefile @@ -81,4 +81,4 @@ $(test_instances): .PHONY: clean clean: ## Clean the project - rm -rf .cache compiled dependencies vendor helmcharts jsonnetfile*.json || true + rm -rf .cache compiled dependencies vendor helmcharts manifests jsonnetfile*.json || true diff --git a/class/capi-provider-talos.yml b/class/capi-provider-talos.yml index d3fb7bd..2cb6ffe 100644 --- a/class/capi-provider-talos.yml +++ b/class/capi-provider-talos.yml @@ -8,4 +8,46 @@ parameters: - input_paths: - ${_base_directory}/component/main.jsonnet input_type: jsonnet - output_path: capi-provider-talos/ + output_path: . + - input_paths: + - ${_base_directory}/component/bootstrap-provider.jsonnet + input_type: jsonnet + output_path: ${_base_directory}/manifests/capi-bootstrap-provider-talos/ + - input_type: external + output_path: . + input_paths: + - ${_kustomize_wrapper} + env_vars: + INPUT_DIR: ${_base_directory}/manifests/capi-bootstrap-provider-talos/ + args: + - ${_base_directory}/manifests/capi-bootstrap-provider-talos-rendered/ + - input_type: external + output_path: . + input_paths: + - ${_base_directory}/scripts/envsubst-dir + # map env vars from parameters as needed + env_vars: {} + args: + - ${_base_directory}/manifests/capi-bootstrap-provider-talos-rendered + - \${compiled_target_dir}/capi-provider-talos/bootstrap/10_kustomize + - input_paths: + - ${_base_directory}/component/controlplane-provider.jsonnet + input_type: jsonnet + output_path: ${_base_directory}/manifests/capi-controlplane-provider-talos/ + - input_type: external + output_path: . + input_paths: + - ${_kustomize_wrapper} + env_vars: + INPUT_DIR: ${_base_directory}/manifests/capi-controlplane-provider-talos/ + args: + - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered/ + - input_type: external + output_path: . + input_paths: + - ${_base_directory}/scripts/envsubst-dir + # map env vars from parameters as needed + env_vars: {} + args: + - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered + - \${compiled_target_dir}/capi-provider-talos/controlplane/10_kustomize diff --git a/class/defaults.yml b/class/defaults.yml index 2d45221..e5bc1bb 100644 --- a/class/defaults.yml +++ b/class/defaults.yml @@ -2,4 +2,37 @@ parameters: capi_provider_talos: =_metadata: multi_tenant: true - namespace: syn-capi-provider-talos + # The component assumes that this namespace already exists via dependency `component-capi-core` + namespace: syn-cluster-api + + images: + capi-bootstrap-provider-talos: + registry: ghcr.io + image: siderolabs/cluster-api-bootstrap-talos-controller + tag: v0.6.12 + capi-controlplane-provider-talos: + registry: ghcr.io + image: siderolabs/cluster-api-control-plane-talos-controller + tag: v0.5.13 + + bootstrap: + kustomize: + # The root path of the kustomize manifests. This path is relative to the root of the repository. + manifest_path: config/default + + # An object with variables that the generated manifests will be templated with. + # They should be specified in the format: + # variables: + # my_variable: bar + variables: {} + + controlplane: + kustomize: + # The root path of the kustomize manifests. This path is relative to the root of the repository. + manifest_path: config/default + + # An object with variables that the generated manifests will be templated with. + # They should be specified in the format: + # variables: + # my_variable: bar + variables: {} diff --git a/component/bootstrap-provider.jsonnet b/component/bootstrap-provider.jsonnet new file mode 100644 index 0000000..a6feab7 --- /dev/null +++ b/component/bootstrap-provider.jsonnet @@ -0,0 +1,41 @@ +// main template for capi-provider-cloudscale +local com = import 'lib/commodore.libjsonnet'; +local kap = import 'lib/kapitan.libjsonnet'; +local kube = import 'lib/kube.libjsonnet'; +local inv = kap.inventory(); +// The hiera parameters for the component +local params = inv.parameters.capi_provider_talos; + +com.Kustomization( + 'https://github.com/siderolabs/cluster-api-bootstrap-provider-talos/' + params.bootstrap.kustomize.manifest_path, + params.images['capi-bootstrap-provider-talos'].tag, + { + 'ghcr.io/siderolabs/cluster-api-bootstrap-talos-controller': { + local image = params.images['capi-bootstrap-provider-talos'], + newTag: image.tag, + newName: '%(registry)s/%(image)s' % image, + }, + }, + { + namespace: params.namespace, + labels+: [ + { + pairs: { + 'app.kubernetes.io/managed-by': 'commodore', + }, + }, + ], + patchesStrategicMerge: [ 'rm-namespace.yaml' ], + }, +) { + 'rm-namespace': [ + { + '$patch': 'delete', + apiVersion: 'v1', + kind: 'Namespace', + metadata: { + name: 'cabpt-system', + }, + }, + ], +} diff --git a/component/controlplane-provider.jsonnet b/component/controlplane-provider.jsonnet new file mode 100644 index 0000000..9f3e6c1 --- /dev/null +++ b/component/controlplane-provider.jsonnet @@ -0,0 +1,41 @@ +// main template for capi-provider-cloudscale +local com = import 'lib/commodore.libjsonnet'; +local kap = import 'lib/kapitan.libjsonnet'; +local kube = import 'lib/kube.libjsonnet'; +local inv = kap.inventory(); +// The hiera parameters for the component +local params = inv.parameters.capi_provider_talos; + +com.Kustomization( + 'https://github.com/siderolabs/cluster-api-control-plane-provider-talos/' + params.controlplane.kustomize.manifest_path, + params.images['capi-controlplane-provider-talos'].tag, + { + 'ghcr.io/siderolabs/cluster-api-control-plane-talos-controller': { + local image = params.images['capi-controlplane-provider-talos'], + newTag: image.tag, + newName: '%(registry)s/%(image)s' % image, + }, + }, + { + namespace: params.namespace, + labels+: [ + { + pairs: { + 'app.kubernetes.io/managed-by': 'commodore', + }, + }, + ], + patchesStrategicMerge: [ 'rm-namespace.yaml' ], + }, +) { + 'rm-namespace': [ + { + '$patch': 'delete', + apiVersion: 'v1', + kind: 'Namespace', + metadata: { + name: 'cacppt-system', + }, + }, + ], +} diff --git a/component/main.jsonnet b/component/main.jsonnet index 237819c..ee1ff7e 100644 --- a/component/main.jsonnet +++ b/component/main.jsonnet @@ -5,6 +5,8 @@ local inv = kap.inventory(); // The hiera parameters for the component local params = inv.parameters.capi_provider_talos; +assert std.member(inv.applications, 'capi-core') : 'Application capi-core is not available'; + // Define outputs below { } diff --git a/scripts/envsubst-dir b/scripts/envsubst-dir new file mode 100755 index 0000000..738765e --- /dev/null +++ b/scripts/envsubst-dir @@ -0,0 +1,20 @@ +#!/usr/bin/env bash +set -euo pipefail + +src="$1" +dst="$2" + +mkdir -p "$dst" + +find "$src" -type f -name '*.yaml' -print0 | +while IFS= read -r -d '' file; do + relative="${file#$src/}" + output="$dst/$relative" + + mkdir -p "$(dirname "$output")" + + envsubst \ + -no-unset \ + -i "$file" \ + -o "$output" +done diff --git a/tests/defaults.yml b/tests/defaults.yml index a4da5b7..c837aa2 100644 --- a/tests/defaults.yml +++ b/tests/defaults.yml @@ -1,3 +1,6 @@ # Overwrite parameters here +applications: + - capi-core + # parameters: {...} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml new file mode 100644 index 0000000..abfdaf6 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cabpt-validating-webhook-configuration.yaml @@ -0,0 +1,49 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /validate-bootstrap-cluster-x-k8s-io-v1alpha3-talosconfig + failurePolicy: Fail + name: vtalosconfig.cluster.x-k8s.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + resources: + - talosconfigs + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /validate-bootstrap-cluster-x-k8s-io-v1alpha3-talosconfigtemplate + failurePolicy: Fail + name: vtalosconfigtemplate.cluster.x-k8s.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - UPDATE + resources: + - talosconfigtemplates + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..606fed0 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigs.bootstrap.cluster.x-k8s.io.yaml @@ -0,0 +1,246 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: talosconfigs.bootstrap.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: bootstrap.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosConfig + listKind: TalosConfigList + plural: talosconfigs + singular: talosconfig + scope: Namespaced + versions: + - name: v1alpha2 + schema: + openAPIV3Schema: + description: TalosConfig is the Schema for the talosconfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + data: + type: string + generateType: + type: string + required: + - generateType + type: object + status: + description: TalosConfigStatus defines the observed state of TalosConfig + properties: + bootstrapData: + description: BootstrapData will be a slice of bootstrap data + format: byte + type: string + errorMessage: + description: ErrorMessage will be set on non-retryable errors + type: string + errorReason: + description: ErrorReason will be set on non-retryable errors + type: string + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed + type: boolean + talosConfig: + description: Talos config will be a string containing the config for + download + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosConfig is the Schema for the talosconfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge patch + list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + status: + description: TalosConfigStatus defines the observed state of TalosConfig + properties: + conditions: + description: Conditions defines current service state of the TalosConfig. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This field may be empty. + maxLength: 10240 + minLength: 1 + type: string + reason: + description: |- + reason is the reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may be empty. + maxLength: 256 + minLength: 1 + type: string + severity: + description: |- + severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + maxLength: 32 + type: string + status: + description: status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + maxLength: 256 + minLength: 1 + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors + type: string + failureReason: + description: FailureReason will be set on non-retryable errors + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed + type: boolean + talosConfig: + description: |- + Talos config will be a string containing the config for download. + + Deprecated: please use `-talosconfig` secret. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..a7b0183 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_talosconfigtemplates.bootstrap.cluster.x-k8s.io.yaml @@ -0,0 +1,164 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cabpt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: talosconfigtemplates.bootstrap.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: cabpt-webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: bootstrap.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosConfigTemplate + listKind: TalosConfigTemplateList + plural: talosconfigtemplates + singular: talosconfigtemplate + scope: Namespaced + versions: + - name: v1alpha2 + schema: + openAPIV3Schema: + description: TalosConfigTemplate is the Schema for the talosconfigtemplates + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigTemplateSpec defines the desired state of TalosConfigTemplate + properties: + template: + description: TalosConfigTemplateResource defines the Template structure + properties: + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + data: + type: string + generateType: + type: string + required: + - generateType + type: object + type: object + required: + - template + type: object + type: object + served: true + storage: false + - name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosConfigTemplate is the Schema for the talosconfigtemplates + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosConfigTemplateSpec defines the desired state of TalosConfigTemplate + properties: + template: + description: TalosConfigTemplateResource defines the Template structure + properties: + spec: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + type: object + required: + - template + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml new file mode 100644 index 0000000..9688855 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/apps_v1_deployment_cabpt-controller-manager.yaml @@ -0,0 +1,76 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + name: cabpt-controller-manager + namespace: syn-cluster-api +spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + template: + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + spec: + containers: + - args: + - --enable-leader-election + - --feature-gates=MachinePool=false + - --diagnostics-address=:8443 + - --insecure-diagnostics=false + command: + - /manager + image: ghcr.io/siderolabs/cluster-api-talos-controller:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 500m + memory: 500Mi + requests: + cpu: 100m + memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: cabpt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml new file mode 100644 index 0000000..63d3bad --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_certificate_cabpt-serving-cert.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-serving-cert + namespace: syn-cluster-api +spec: + dnsNames: + - cabpt-webhook-service.syn-cluster-api.svc + - cabpt-webhook-service.syn-cluster-api.svc.cluster.local + issuerRef: + kind: Issuer + name: cabpt-selfsigned-issuer + secretName: cabpt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml new file mode 100644 index 0000000..0f0d329 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/cert-manager.io_v1_issuer_cabpt-selfsigned-issuer.yaml @@ -0,0 +1,10 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-selfsigned-issuer + namespace: syn-cluster-api +spec: + selfSigned: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml new file mode 100644 index 0000000..fb0cf78 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-manager-role.yaml @@ -0,0 +1,60 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-manager-role +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs/status + verbs: + - get + - patch + - update +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + - machines + - machines/status + verbs: + - get + - list + - watch +- apiGroups: + - exp.cluster.x-k8s.io + resources: + - machinepools + - machinepools/status + verbs: + - get + - list + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml new file mode 100644 index 0000000..25788c0 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-proxy-role.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml new file mode 100644 index 0000000..f83d166 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cabpt-talosconfig-editor-role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-talosconfig-editor-role +rules: +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - talosconfigs/status + verbs: + - get + - patch + - update diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml new file mode 100644 index 0000000..cddc604 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-manager-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-manager-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml new file mode 100644 index 0000000..d8aecdb --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-proxy-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-proxy-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml new file mode 100644 index 0000000..160ade2 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cabpt-talosconfig-editor-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-talosconfig-editor-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cabpt-talosconfig-editor-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml new file mode 100644 index 0000000..ed974a6 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_role_cabpt-leader-election-role.yaml @@ -0,0 +1,47 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-leader-election-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml new file mode 100644 index 0000000..b9864fd --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cabpt-leader-election-rolebinding.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-leader-election-rolebinding + namespace: syn-cluster-api +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cabpt-leader-election-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml new file mode 100644 index 0000000..77817b9 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-controller-manager-metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager + name: cabpt-controller-manager-metrics-service + namespace: syn-cluster-api +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml new file mode 100644 index 0000000..4b30f7a --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/bootstrap/10_kustomize/v1_service_cabpt-webhook-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: bootstrap-talos + name: cabpt-webhook-service + namespace: syn-cluster-api +spec: + ports: + - port: 443 + targetPort: 9443 + selector: + cluster.x-k8s.io/provider: bootstrap-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml new file mode 100644 index 0000000..0e3b7ec --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_mutatingwebhookconfiguration_cacppt-mutating-webhook-configuration.yaml @@ -0,0 +1,32 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-mutating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: cacppt-webhook-service + namespace: syn-cluster-api + path: /mutate-controlplane-cluster-x-k8s-io-v1alpha3-taloscontrolplane + failurePolicy: Fail + matchPolicy: Equivalent + name: default.taloscontrolplane.controlplane.cluster.x-k8s.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + resources: + - taloscontrolplanes + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml new file mode 100644 index 0000000..77d4f88 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/admissionregistration.k8s.io_v1_validatingwebhookconfiguration_cacppt-validating-webhook-configuration.yaml @@ -0,0 +1,31 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: cacppt-webhook-service + namespace: syn-cluster-api + path: /validate-controlplane-cluster-x-k8s-io-v1alpha3-taloscontrolplane + failurePolicy: Fail + name: validate.taloscontrolplane.controlplane.cluster.x-k8s.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1alpha3 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - taloscontrolplanes + sideEffects: None diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml new file mode 100644 index 0000000..0401f9c --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apiextensions.k8s.io_v1_customresourcedefinition_taloscontrolplanes.controlplane.cluster.x-k8s.io.yaml @@ -0,0 +1,413 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: syn-cluster-api/cacppt-serving-cert + controller-gen.kubebuilder.io/version: v0.17.0 + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + cluster.x-k8s.io/v1alpha3: v1alpha3 + cluster.x-k8s.io/v1alpha4: v1alpha3 + cluster.x-k8s.io/v1beta1: v1alpha3 + name: taloscontrolplanes.controlplane.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: webhook-service + namespace: syn-cluster-api + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: controlplane.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: TalosControlPlane + listKind: TalosControlPlaneList + plural: taloscontrolplanes + shortNames: + - tcp + singular: taloscontrolplane + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: TalosControlPlane API Server is ready to receive requests + jsonPath: .status.ready + name: Ready + type: boolean + - description: This denotes whether or not the control plane has the uploaded + talos-config configmap + jsonPath: .status.initialized + name: Initialized + type: boolean + - description: Total number of non-terminated machines targeted by this control + plane + jsonPath: .status.replicas + name: Replicas + type: integer + - description: Total number of fully running and ready control plane machines + jsonPath: .status.readyReplicas + name: Ready Replicas + type: integer + - description: Total number of unavailable machines targeted by this control plane + jsonPath: .status.unavailableReplicas + name: Unavailable Replicas + type: integer + name: v1alpha3 + schema: + openAPIV3Schema: + description: TalosControlPlane is the Schema for the taloscontrolplanes API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TalosControlPlaneSpec defines the desired state of TalosControlPlane + properties: + controlPlaneConfig: + description: |- + ControlPlaneConfig is a two TalosConfigSpecs + to use for initializing and joining machines to the control plane. + properties: + controlplane: + description: TalosConfigSpec defines the desired state of TalosConfig + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + init: + description: 'Deprecated: starting from cacppt v0.4.0 provider + doesn''t use init configs.' + properties: + configPatches: + items: + properties: + op: + type: string + path: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + data: + type: string + generateType: + type: string + hostname: + description: Set hostname in the machine configuration to + some value. + properties: + source: + description: |- + Source of the hostname. + + Allowed values: + "MachineName" (use linked Machine's Name). + "InfrastructureName" (use linked Machine's infrastructure's name). + type: string + type: object + strategicPatches: + description: Talos Linux machine configuration strategic merge + patch list. + items: + type: string + type: array + talosVersion: + type: string + required: + - generateType + type: object + required: + - controlplane + type: object + infrastructureTemplate: + description: |- + InfrastructureTemplate is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + replicas: + description: |- + Number of desired machines. Defaults to 1. When stacked etcd is used only + odd numbers are permitted, as per [etcd best practice](https://etcd.io/docs/v3.3.12/faq/#why-an-odd-number-of-cluster-members). + This is a pointer to distinguish between explicit zero and not specified. + format: int32 + type: integer + rolloutStrategy: + default: + rollingUpdate: + maxSurge: 1 + type: RollingUpdate + description: |- + The RolloutStrategy to use to replace control plane machines with + new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if + RolloutStrategyType = RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of control planes that can be scheduled above or under the + desired number of control planes. + Value can be an absolute number 1 or 0. + Defaults to 1. + Example: when this is set to 1, the control plane can be scaled + up immediately when the rolling update starts. + x-kubernetes-int-or-string: true + type: object + type: + description: |- + Change rollout strategy. + + Supported strategies: + * "RollingUpdate". + * "OnDelete" + + Default is RollingUpdate. + type: string + type: object + version: + description: Version defines the desired Kubernetes version. + minLength: 2 + pattern: ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)([-0-9a-zA-Z_\.+]*)?$ + type: string + required: + - controlPlaneConfig + - infrastructureTemplate + - version + type: object + status: + description: TalosControlPlaneStatus defines the observed state of TalosControlPlane + properties: + bootstrapped: + description: |- + Bootstrapped denotes whether any nodes received bootstrap request + which is required to start etcd and Kubernetes components in Talos. + type: boolean + conditions: + description: Conditions defines current service state of the KubeadmControlPlane. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This field may be empty. + maxLength: 10240 + minLength: 1 + type: string + reason: + description: |- + reason is the reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may be empty. + maxLength: 256 + minLength: 1 + type: string + severity: + description: |- + severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + maxLength: 32 + type: string + status: + description: status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + maxLength: 256 + minLength: 1 + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + failureMessage: + description: |- + ErrorMessage indicates that there is a terminal problem reconciling the + state, and will be set to a descriptive error message. + type: string + failureReason: + description: |- + FailureReason indicates that there is a terminal problem reconciling the + state, and will be set to a token value suitable for + programmatic interpretation. + type: string + initialized: + description: |- + Initialized denotes whether or not the control plane has the + uploaded talos-config configmap. + type: boolean + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: |- + Ready denotes that the TalosControlPlane API Server is ready to + receive requests. + type: boolean + readyReplicas: + description: Total number of fully running and ready control plane + machines. + format: int32 + type: integer + replicas: + description: |- + Total number of non-terminated machines targeted by this control plane + (their labels match the selector). + format: int32 + type: integer + selector: + description: |- + Selector is the label selector in string format to avoid introspection + by clients, and is used to provide the CRD-based integration for the + scale subresource and additional integrations for things like kubectl + describe.. The string will be in the same format as the query-param syntax. + More info about label selectors: http://kubernetes.io/docs/user-guide/labels#label-selectors + type: string + unavailableReplicas: + description: |- + Total number of unavailable machines targeted by this control plane. + This is the total number of machines that are still required for + the deployment to have 100% available capacity. They may either + be machines that are running but not yet ready or machines + that still have not been created. + format: int32 + type: integer + version: + description: |- + version represents the minimum Kubernetes version for the control plane machines + in the cluster. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml new file mode 100644 index 0000000..6614859 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/apps_v1_deployment_cacppt-controller-manager.yaml @@ -0,0 +1,78 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + name: cacppt-controller-manager + namespace: syn-cluster-api +spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + template: + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + spec: + containers: + - args: + - --enable-leader-election + - --diagnostics-address=:8443 + - --insecure-diagnostics=false + command: + - /manager + env: + - name: GRPC_ENFORCE_ALPN_ENABLED + value: "false" + image: ghcr.io/siderolabs/cluster-api-control-plane-talos-controller:v0.5.13 + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 500Mi + requests: + cpu: 100m + memory: 128Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + terminationGracePeriodSeconds: 10 + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: cacppt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml new file mode 100644 index 0000000..b7fae35 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_certificate_cacppt-serving-cert.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-serving-cert + namespace: syn-cluster-api +spec: + dnsNames: + - cacppt-webhook-service.syn-cluster-api.svc + - cacppt-webhook-service.syn-cluster-api.svc.cluster.local + issuerRef: + kind: Issuer + name: cacppt-selfsigned-issuer + secretName: cacppt-webhook-service-cert diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml new file mode 100644 index 0000000..dfe7b35 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/cert-manager.io_v1_issuer_cacppt-selfsigned-issuer.yaml @@ -0,0 +1,10 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-selfsigned-issuer + namespace: syn-cluster-api +spec: + selfSigned: {} diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml new file mode 100644 index 0000000..43dbe0e --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-manager-role.yaml @@ -0,0 +1,65 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-role +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - watch +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - get + - list + - patch + - update + - watch +- apiGroups: + - bootstrap.cluster.x-k8s.io + - controlplane.cluster.x-k8s.io + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + verbs: + - get + - list + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machines/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml new file mode 100644 index 0000000..f0c4c87 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-metrics-reader.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-metrics-reader +rules: +- nonResourceURLs: + - /metrics + verbs: + - get diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml new file mode 100644 index 0000000..294d863 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrole_cacppt-proxy-role.yaml @@ -0,0 +1,20 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-proxy-role +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml new file mode 100644 index 0000000..d3ede3a --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-manager-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cacppt-manager-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml new file mode 100644 index 0000000..cf9fab5 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_clusterrolebinding_cacppt-proxy-rolebinding.yaml @@ -0,0 +1,15 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-proxy-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cacppt-proxy-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml new file mode 100644 index 0000000..7792d2b --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-leader-election-role.yaml @@ -0,0 +1,47 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-leader-election-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml new file mode 100644 index 0000000..24f6f28 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_role_cacppt-manager-role.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-manager-role + namespace: syn-cluster-api +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - get + - list + - watch +- apiGroups: + - rbac + resources: + - rolebindings + - roles + verbs: + - create + - get + - list + - watch diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml new file mode 100644 index 0000000..8417a65 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/rbac.authorization.k8s.io_v1_rolebinding_cacppt-leader-election-rolebinding.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-leader-election-rolebinding + namespace: syn-cluster-api +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cacppt-leader-election-role +subjects: +- kind: ServiceAccount + name: default + namespace: syn-cluster-api diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml new file mode 100644 index 0000000..525fa9b --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-controller-manager-metrics-service.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager + name: cacppt-controller-manager-metrics-service + namespace: syn-cluster-api +spec: + ports: + - name: https + port: 8443 + targetPort: https + selector: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager diff --git a/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml new file mode 100644 index 0000000..a106407 --- /dev/null +++ b/tests/golden/defaults/capi-provider-talos/capi-provider-talos/controlplane/10_kustomize/v1_service_cacppt-webhook-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/managed-by: commodore + cluster.x-k8s.io/provider: control-plane-talos + name: cacppt-webhook-service + namespace: syn-cluster-api +spec: + ports: + - port: 443 + targetPort: 9443 + selector: + cluster.x-k8s.io/provider: control-plane-talos + control-plane: controller-manager From 1054e8a4b516c9a0d8d7346d23bc7fae956796e4 Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Wed, 19 Aug 2026 11:17:16 +0200 Subject: [PATCH 2/6] Ignore linting for golden tests as output is from envsubst --- .yamllint.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.yamllint.yml b/.yamllint.yml index 92aea6c..f109579 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -22,3 +22,4 @@ ignore: | manifests/ vendor/ compiled/ + tests/golden/** From 2d8371f31a8a1a64f74e78e1b0dffa9d470d908d Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Wed, 19 Aug 2026 13:19:06 +0200 Subject: [PATCH 3/6] Use hardcoded path to kustomize folder --- class/defaults.yml | 6 ------ component/bootstrap-provider.jsonnet | 4 +++- component/controlplane-provider.jsonnet | 4 +++- 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/class/defaults.yml b/class/defaults.yml index e5bc1bb..9f9675d 100644 --- a/class/defaults.yml +++ b/class/defaults.yml @@ -16,9 +16,6 @@ parameters: tag: v0.5.13 bootstrap: - kustomize: - # The root path of the kustomize manifests. This path is relative to the root of the repository. - manifest_path: config/default # An object with variables that the generated manifests will be templated with. # They should be specified in the format: @@ -27,9 +24,6 @@ parameters: variables: {} controlplane: - kustomize: - # The root path of the kustomize manifests. This path is relative to the root of the repository. - manifest_path: config/default # An object with variables that the generated manifests will be templated with. # They should be specified in the format: diff --git a/component/bootstrap-provider.jsonnet b/component/bootstrap-provider.jsonnet index a6feab7..4d3f704 100644 --- a/component/bootstrap-provider.jsonnet +++ b/component/bootstrap-provider.jsonnet @@ -6,8 +6,10 @@ local inv = kap.inventory(); // The hiera parameters for the component local params = inv.parameters.capi_provider_talos; +local manifest_path = 'config/default'; + com.Kustomization( - 'https://github.com/siderolabs/cluster-api-bootstrap-provider-talos/' + params.bootstrap.kustomize.manifest_path, + 'https://github.com/siderolabs/cluster-api-bootstrap-provider-talos/' + manifest_path, params.images['capi-bootstrap-provider-talos'].tag, { 'ghcr.io/siderolabs/cluster-api-bootstrap-talos-controller': { diff --git a/component/controlplane-provider.jsonnet b/component/controlplane-provider.jsonnet index 9f3e6c1..1d4778d 100644 --- a/component/controlplane-provider.jsonnet +++ b/component/controlplane-provider.jsonnet @@ -6,8 +6,10 @@ local inv = kap.inventory(); // The hiera parameters for the component local params = inv.parameters.capi_provider_talos; +local manifest_path = 'config/default'; + com.Kustomization( - 'https://github.com/siderolabs/cluster-api-control-plane-provider-talos/' + params.controlplane.kustomize.manifest_path, + 'https://github.com/siderolabs/cluster-api-control-plane-provider-talos/' + manifest_path, params.images['capi-controlplane-provider-talos'].tag, { 'ghcr.io/siderolabs/cluster-api-control-plane-talos-controller': { From ad8e8cad0d6609b7f0c2e6d287b036dce670edcd Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Wed, 19 Aug 2026 17:09:54 +0200 Subject: [PATCH 4/6] Download envsubst dependency local to component --- class/capi-provider-talos.yml | 3 +- scripts/envsubst-dir | 59 ++++++++++++++++++++++++++++++++++- 2 files changed, 60 insertions(+), 2 deletions(-) diff --git a/class/capi-provider-talos.yml b/class/capi-provider-talos.yml index 2cb6ffe..52bd8c7 100644 --- a/class/capi-provider-talos.yml +++ b/class/capi-provider-talos.yml @@ -47,7 +47,8 @@ parameters: input_paths: - ${_base_directory}/scripts/envsubst-dir # map env vars from parameters as needed - env_vars: {} + env_vars: + ENVSUBST_VERSION: v1.4.3 args: - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered - \${compiled_target_dir}/capi-provider-talos/controlplane/10_kustomize diff --git a/scripts/envsubst-dir b/scripts/envsubst-dir index 738765e..2240dad 100755 --- a/scripts/envsubst-dir +++ b/scripts/envsubst-dir @@ -1,9 +1,66 @@ #!/usr/bin/env bash set -euo pipefail +basedir=$(dirname "$0")/../dependencies +version="${ENVSUBST_VERSION:-v1.4.3}" + src="$1" dst="$2" +ensure_envsubst () { + set -eu + + local dir="$1" + # Version with leading `v`. + local version="$2" + + local arch + arch=$(uname -m) + case $arch in + aarch64|arm64) arch="arm64";; + x86_64|amd64) arch="x86_64";; + *) + >&2 echo "Unsupported arch: $arch" + exit 5 + :: + esac + + local os + os=$(uname -s) + if [[ "$os" != "Linux" && "$os" != "Darwin" ]]; then + >&2 echo "Unsupported os: $os" + exit 5 + fi + + if [ ! -x "${dir}/envsubst-${version}-${os}-${arch}" ]; then + download_envsubst "${dir}" "${version}" "${os}" "${arch}" + else + >&2 echo "envsubst-${version}-${os}-${arch} already installed" + fi + + echo "${dir}/envsubst-${version}-${os}-${arch}" +} + +download_envsubst () { + set -eu + + local dir="$1" + local version="$2" + local os="$3" + local arch="$4" + + local url="https://github.com/a8m/envsubst/releases/download/${version}/envsubst-${os}-${arch}" + + >&2 echo "Downloading envsubst-${version}-${os}-${arch} from ${url}" + + curl -fsSLo "${dir}/envsubst-${version}-${os}-${arch}" "${url}" + chmod +x "${dir}/envsubst-${version}-${os}-${arch}" + + >&2 echo "envsubst-${version}-${os}-${arch} successfully installed" +} + +envsubst="$(ensure_envsubst "${basedir}" "${version}")" + mkdir -p "$dst" find "$src" -type f -name '*.yaml' -print0 | @@ -13,7 +70,7 @@ while IFS= read -r -d '' file; do mkdir -p "$(dirname "$output")" - envsubst \ + "$envsubst" \ -no-unset \ -i "$file" \ -o "$output" From 8541d32f70249db73b77890570d7c6f9cadcedfe Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Tue, 25 Aug 2026 13:26:12 +0200 Subject: [PATCH 5/6] Apply changes from code review --- .gitignore | 1 + Makefile | 2 +- class/capi-provider-talos.yml | 9 ++- class/defaults.yml | 11 ---- component/bootstrap-provider.jsonnet | 1 - component/controlplane-provider.jsonnet | 1 - component/main.jsonnet | 2 +- .../ROOT/pages/references/parameters.adoc | 56 ++++++++++++++++++- scripts/envsubst-dir => envsubst-dir | 2 +- 9 files changed, 62 insertions(+), 23 deletions(-) rename scripts/envsubst-dir => envsubst-dir (97%) diff --git a/.gitignore b/.gitignore index f6ff082..1ec97e6 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /_public # Additional entries +envsubst-v* diff --git a/Makefile b/Makefile index d0556a8..02f0524 100644 --- a/Makefile +++ b/Makefile @@ -81,4 +81,4 @@ $(test_instances): .PHONY: clean clean: ## Clean the project - rm -rf .cache compiled dependencies vendor helmcharts manifests jsonnetfile*.json || true + rm -rf .cache compiled dependencies vendor helmcharts jsonnetfile*.json || true diff --git a/class/capi-provider-talos.yml b/class/capi-provider-talos.yml index 52bd8c7..f48ab74 100644 --- a/class/capi-provider-talos.yml +++ b/class/capi-provider-talos.yml @@ -24,9 +24,9 @@ parameters: - input_type: external output_path: . input_paths: - - ${_base_directory}/scripts/envsubst-dir + - ${_base_directory}/envsubst-dir # map env vars from parameters as needed - env_vars: {} + env_vars: ${capi_provider_talos:bootstrap:variables} args: - ${_base_directory}/manifests/capi-bootstrap-provider-talos-rendered - \${compiled_target_dir}/capi-provider-talos/bootstrap/10_kustomize @@ -45,10 +45,9 @@ parameters: - input_type: external output_path: . input_paths: - - ${_base_directory}/scripts/envsubst-dir + - ${_base_directory}/envsubst-dir # map env vars from parameters as needed - env_vars: - ENVSUBST_VERSION: v1.4.3 + env_vars: ${capi_provider_talos:controlplane:variables} args: - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered - \${compiled_target_dir}/capi-provider-talos/controlplane/10_kustomize diff --git a/class/defaults.yml b/class/defaults.yml index 9f9675d..fa73e85 100644 --- a/class/defaults.yml +++ b/class/defaults.yml @@ -2,7 +2,6 @@ parameters: capi_provider_talos: =_metadata: multi_tenant: true - # The component assumes that this namespace already exists via dependency `component-capi-core` namespace: syn-cluster-api images: @@ -16,17 +15,7 @@ parameters: tag: v0.5.13 bootstrap: - - # An object with variables that the generated manifests will be templated with. - # They should be specified in the format: - # variables: - # my_variable: bar variables: {} controlplane: - - # An object with variables that the generated manifests will be templated with. - # They should be specified in the format: - # variables: - # my_variable: bar variables: {} diff --git a/component/bootstrap-provider.jsonnet b/component/bootstrap-provider.jsonnet index 4d3f704..d428f57 100644 --- a/component/bootstrap-provider.jsonnet +++ b/component/bootstrap-provider.jsonnet @@ -1,4 +1,3 @@ -// main template for capi-provider-cloudscale local com = import 'lib/commodore.libjsonnet'; local kap = import 'lib/kapitan.libjsonnet'; local kube = import 'lib/kube.libjsonnet'; diff --git a/component/controlplane-provider.jsonnet b/component/controlplane-provider.jsonnet index 1d4778d..b057c36 100644 --- a/component/controlplane-provider.jsonnet +++ b/component/controlplane-provider.jsonnet @@ -1,4 +1,3 @@ -// main template for capi-provider-cloudscale local com = import 'lib/commodore.libjsonnet'; local kap = import 'lib/kapitan.libjsonnet'; local kube = import 'lib/kube.libjsonnet'; diff --git a/component/main.jsonnet b/component/main.jsonnet index ee1ff7e..b8e8cc7 100644 --- a/component/main.jsonnet +++ b/component/main.jsonnet @@ -5,7 +5,7 @@ local inv = kap.inventory(); // The hiera parameters for the component local params = inv.parameters.capi_provider_talos; -assert std.member(inv.applications, 'capi-core') : 'Application capi-core is not available'; +assert std.member(inv.applications, 'capi-core') : 'Component capi-provider-talos requires component capi-core'; // Define outputs below { diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc index ca3ce45..ee361db 100644 --- a/docs/modules/ROOT/pages/references/parameters.adoc +++ b/docs/modules/ROOT/pages/references/parameters.adoc @@ -6,14 +6,66 @@ The parent key for all of the following parameters is `capi_provider_talos`. [horizontal] type:: string -default:: `syn-capi-provider-talos` +default:: `syn-cluster-api` -The namespace in which to deploy this component. +The namespace in which to deploy this component. The component assumes that this namespace already exists via dependency `component-capi-core`. +== `images` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +The default Docker image location and tag to use for the CAPI provider talos components (keys `capi-boostrap-provider-talos` and `capi-controlplane-provider-talos`). + +Entries in this dict should be dictionaries with keys `registry`, `image`, and `tag`. This structure provides the basis for dependency maintenance with Renovate. + +The values of `capi-bootstrap-provider-talos.tag` and `capi-controlplane-provider-talos.tag` in this dict is used by the component to select the versions of the upstream CAPI provider talos components. + +== `bootstrap.variables` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +An object with environment variables that the generated manifests of the bootstrap provider will be templated with, similar to `clusterctl`. +variables should be specified in the format: + +[source,yaml] +---- +variables: + FOO: bar +---- + +== `controlplane.variables` + +[horizontal] +type:: dict +default:: See `class/defaults.yml` + +An object with environment variables that the generated manifests of the control plane provider will be templated with, similar to `clusterctl`. +variables should be specified in the format: + +[source,yaml] +---- +variables: + FOO: bar +---- == Example [source,yaml] ---- namespace: example-namespace +images: + capi-bootstrap-provider-talos: + tag: tag: v0.6.12 + capi-controlplane-provider-talos: + tag: tag: v0.5.13 +bootstrap: + variables: + MY_VARIABLE: value +controlplane: + variables: + MY_VARIABLE: value ---- diff --git a/scripts/envsubst-dir b/envsubst-dir similarity index 97% rename from scripts/envsubst-dir rename to envsubst-dir index 2240dad..8a83f90 100755 --- a/scripts/envsubst-dir +++ b/envsubst-dir @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -basedir=$(dirname "$0")/../dependencies +basedir=$(dirname "$0") version="${ENVSUBST_VERSION:-v1.4.3}" src="$1" From 2a93442e3d84da184bc24040ccd5c7f4d1dbdb65 Mon Sep 17 00:00:00 2001 From: Andreas Doebeli Date: Tue, 25 Aug 2026 14:15:27 +0200 Subject: [PATCH 6/6] Prepare to move repository to projectsyn --- .cruft.json | 4 ++-- CONTRIBUTING.md | 2 +- component/app.jsonnet | 8 +++++++- docs/modules/ROOT/pages/references/parameters.adoc | 5 +++-- .../capi-provider-talos/apps/capi-provider-talos.yaml | 3 +++ 5 files changed, 16 insertions(+), 6 deletions(-) diff --git a/.cruft.json b/.cruft.json index e79bd71..2cdb08e 100644 --- a/.cruft.json +++ b/.cruft.json @@ -21,9 +21,9 @@ "auto_release": "y", "copyright_holder": "VSHN AG ", "copyright_year": "2026", - "github_owner": "vshn", + "github_owner": "projectsyn", "github_name": "component-capi-provider-talos", - "github_url": "https://github.com/vshn/component-capi-provider-talos", + "github_url": "https://github.com/projectsyn/component-capi-provider-talos", "_template": "https://github.com/projectsyn/commodore-component-template.git", "_commit": "aec8da7344f670fff4f96fb20cbdcfbdeb2113d4" } diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0ff8bd7..45cb4e5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -3,4 +3,4 @@ This code repository is part of Project Syn and the contribution guide at https://syn.tools/syn/about/contribution_guide.html does apply. -Submit Pull Requests at https://github.com/vshn/component-capi-provider-talos/pulls. +Submit Pull Requests at https://github.com/projectsyn/component-capi-provider-talos/pulls. diff --git a/component/app.jsonnet b/component/app.jsonnet index 4e9839f..8b489d3 100644 --- a/component/app.jsonnet +++ b/component/app.jsonnet @@ -3,7 +3,13 @@ local inv = kap.inventory(); local params = inv.parameters.capi_provider_talos; local argocd = import 'lib/argocd.libjsonnet'; -local app = argocd.App('capi-provider-talos', params.namespace); +local app = argocd.App('capi-provider-talos', params.namespace) { + spec+: { + syncOptions+: [ + 'ServerSideApply=true', + ], + }, +}; local appPath = local project = std.get(std.get(app, 'spec', {}), 'project', 'syn'); diff --git a/docs/modules/ROOT/pages/references/parameters.adoc b/docs/modules/ROOT/pages/references/parameters.adoc index ee361db..2351b46 100644 --- a/docs/modules/ROOT/pages/references/parameters.adoc +++ b/docs/modules/ROOT/pages/references/parameters.adoc @@ -8,7 +8,8 @@ The parent key for all of the following parameters is `capi_provider_talos`. type:: string default:: `syn-cluster-api` -The namespace in which to deploy this component. The component assumes that this namespace already exists via dependency `component-capi-core`. +The namespace in which to deploy this component. +The component assumes that this namespace already exists via dependency `component-capi-core`. == `images` @@ -29,7 +30,7 @@ type:: dict default:: See `class/defaults.yml` An object with environment variables that the generated manifests of the bootstrap provider will be templated with, similar to `clusterctl`. -variables should be specified in the format: +Variables should be specified in the format: [source,yaml] ---- diff --git a/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml b/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml index e69de29..1b6582d 100644 --- a/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml +++ b/tests/golden/defaults/capi-provider-talos/apps/capi-provider-talos.yaml @@ -0,0 +1,3 @@ +spec: + syncOptions: + - ServerSideApply=true