feat: update config options and taskfiles

.github/tests/config-talos.yaml

@@ -25,9 +25,10 @@ tls_sans: ["fake"]
 age_pubkey: $TEMPLATE_AGE_PUBLIC_KEY
 bgp:
   enabled: false
-github_address: https://github.com/onedr0p/cluster-template
-github_branch: main
-github_webhook_token: fake
+github:
+  address: https://github.com/onedr0p/cluster-template
+  branch: main
+  webhook_token: fake
 cloudflare:
   enabled: true
   domain: fake

.taskfiles/talos/Taskfile.yaml

@@ -34,19 +34,17 @@ tasks:
     requires:
       vars: [HOSTNAME]
     preconditions:
-      - talosctl --nodes {{.HOSTNAME}} get machineconfig &>/dev/null
-      - talosctl config info &>/dev/null
+      - talosctl --nodes {{.HOSTNAME}} get machineconfig
+      - talosctl config info
       - test -f {{.TALHELPER_CLUSTER_DIR}}/{{.CLUSTER_NAME}}-{{.HOSTNAME}}.yaml
       - test -f {{.TALOSCONFIG}}
       - which talosctl yq
 
   upgrade-node:
     desc: Upgrade Talos on a single node [HOSTNAME=required]
     cmds:
-      - task: down
       - talosctl --nodes {{.HOSTNAME}} upgrade --image="factory.talos.dev/installer{{if eq .TALOS_SECUREBOOT "true"}}-secureboot{{end}}/{{.TALOS_SCHEMATIC_ID}}:{{.TALOS_VERSION}}" --timeout=10m
       - talosctl --nodes {{.HOSTNAME}} health --wait-timeout=10m --server=false
-      - task: up
     vars:
       TALOS_SCHEMATIC_ID:
         sh: kubectl get node {{.HOSTNAME}} --output=jsonpath='{.metadata.annotations.extensions\.talos\.dev/schematic}'
@@ -58,8 +56,8 @@ tasks:
       vars: [HOSTNAME]
     preconditions:
       - curl -fsSL -o /dev/null --fail https://github.com/siderolabs/talos/releases/tag/{{.TALOS_VERSION}}
-      - talosctl --nodes {{.HOSTNAME}} get machineconfig &>/dev/null
-      - talosctl config info &>/dev/null
+      - talosctl --nodes {{.HOSTNAME}} get machineconfig
+      - talosctl config info
       - test -f {{.TALOSCONFIG}}
       - which kubectl talosctl yq
 
@@ -73,8 +71,8 @@ tasks:
         sh: yq '.kubernetesVersion' {{.TALHELPER_CONFIG_FILE}}
     preconditions:
       - curl -fsSL -o /dev/null --fail https://github.com/siderolabs/kubelet/releases/tag/{{.KUBERNETES_VERSION}}
-      - talosctl --nodes {{.KUBERNETES_CONTROLLER}} get machineconfig &>/dev/null
-      - talosctl config info &>/dev/null
+      - talosctl --nodes {{.KUBERNETES_CONTROLLER}} get machineconfig
+      - talosctl config info
       - test -f {{.TALOSCONFIG}}
       - which talosctl yq
 
@@ -85,15 +83,3 @@ tasks:
     cmd: talhelper gencommand reset --config-file {{.TALHELPER_CONFIG_FILE}} --out-dir {{.TALHELPER_CLUSTER_DIR}} --extra-flags="--reboot {{- if eq .CLI_FORCE false }} --system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL{{ end }} --graceful=false --wait=false" | bash
   preconditions:
     - which talhelper
-
-  down:
-    internal: true
-    cmd: flux --namespace flux-system suspend kustomization --all
-    preconditions:
-      - which flux
-
-  up:
-    internal: true
-    cmd: flux --namespace flux-system resume kustomization --all
-    preconditions:
-      - which flux

README.md

@@ -216,7 +216,7 @@ By default Flux will periodically check your git repository for changes. In orde
     https://flux-webhook.${cloudflare.domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
     ```
 
-3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook URL and your `github_webhook_token` secret in `config.yaml`, Content type: `application/json`, Events: Choose Just the push event, and save.
+3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook URL and your `${github.webhook_token}` secret in `config.yaml`, Content type: `application/json`, Events: Choose Just the push event, and save.
 
 ## 💥 Reset
 

config.sample.yaml

@@ -1,7 +1,7 @@
 ---
 
 #
-# 1. (REQUIRED) Cluster details - Cluster represents the Kubernetes cluster layer and any additional customizations
+# (REQUIRED) Cluster details - Cluster represents the Kubernetes cluster layer and any additional customizations
 #
 
 # (REQUIRED) Cluster name; affects Cilium and Talos
@@ -25,12 +25,12 @@ node_inventory: []
   #   mtu: ""             # (OPTIONAL) MTU for the NIC. DEFAULT: 1500
   # ...
 
-# (REQUIRED) The DNS servers to use for the cluster nodes.
+# (REQUIRED) The DNS servers to use for the cluster nodes. (DEFAULT: Cloudflare DNS)
 dns_servers:
   - "1.1.1.1"
   - "1.0.0.1"
 
-# (REQUIRED) The NTP servers to use for the cluster nodes.
+# (REQUIRED) The NTP servers to use for the cluster nodes. (DEFAULT: Cloudflare NTP)
 ntp_servers:
   - "162.159.200.1"
   - "162.159.200.123"
@@ -89,51 +89,38 @@ bgp:
   # If you want to use IPv6 check the advanced flags below
   advertised_network: ""
 
-# (OPTIONAL) Secureboot and TPM-based disk encryption
-#   Ref: https://www.talos.dev/v1.8/talos-guides/install/bare-metal-platforms/secureboot
-secureboot:
-  # (OPTIONAL) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
-  enabled: false
-  # (OPTIONAL) Enable TPM-based disk encryption. Requires TPM 2.0
-  encrypt_disk: false
-
 # (OPTIONAL) Change Cilium load balancer mode
 #   Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
 loadbalancer_mode: "dsr"
 
-#
-# 2. (REQUIRED) Flux details - Flux is used to manage the cluster configuration.
-#
-
-# (REQUIRED) GitHub repository URL
-#   For a public repo use the 'https://' URL (e.g. "https://github.com/onedr0p/cluster-template.git")
-#   For a private repo use the 'ssh://' URL (e.g. "ssh://[email protected]/onedr0p/cluster-template.git")
-#     If using a private repo make sure to following the instructions with the 'github_private_key' option below.
-github_address: ""
-
-# (REQUIRED) GitHub repository branch
-github_branch: "main"
-
-# (REQUIRED) Token for GitHub push-based sync
-# 1. Generate a new token with the following command:
-#    > openssl rand -hex 16
-# 2. Copy the token and paste it below
-github_webhook_token: ""
-
-# (OPTIONAL) Private key for Flux to access the GitHub repository
-#   1. Generate a new key with the following command:
-#      > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
-#   2. Make sure to paste public key from "github-deploy.key.pub" into
-#      the deploy keys section of your GitHub repository settings.
-#   3. Uncomment and paste the private key below
-#   4. Optionally set your repository on GitHub to private
-# github_private_key: |
-#   -----BEGIN OPENSSH PRIVATE KEY-----
-#   ...
-#   -----END OPENSSH PRIVATE KEY-----
+# (REQUIRED) GitHub details for Flux - Flux is used to manage the cluster configuration.
+github:
+  # (REQUIRED) GitHub repository URL
+  #   For a public repo use the 'https://' URL (e.g. "https://github.com/onedr0p/cluster-template.git")
+  #   For a private repo use the 'ssh://' URL (e.g. "ssh://[email protected]/onedr0p/cluster-template.git")
+  #     If using a private repo make sure to following the instructions with the 'github_private_key' option below.
+  address: ""
+  # (REQUIRED) GitHub repository branch
+  branch: "main"
+  # (REQUIRED) Token for GitHub push-based sync
+  # 1. Generate a new token with the following command:
+  #    > openssl rand -hex 16
+  # 2. Copy the token and paste it below
+  webhook_token: ""
+  # (OPTIONAL) Private key for Flux to access the GitHub repository
+  #   1. Generate a new key with the following command:
+  #      > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
+  #   2. Make sure to paste public key from "github-deploy.key.pub" into
+  #      the deploy keys section of your GitHub repository settings.
+  #   3. Uncomment and paste the private key below
+  #   4. Optionally set your repository on GitHub to private
+  # private_key: |
+  #   -----BEGIN OPENSSH PRIVATE KEY-----
+  #   ...
+  #   -----END OPENSSH PRIVATE KEY-----
 
 #
-# 3. (OPTIONAL) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
+# (OPTIONAL) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
 #
 
 cloudflare:
@@ -192,6 +179,18 @@ cloudflare:
     #   in your nodes host network that is NOT being used. This is announced over L2.
     ingress_vip: ""
 
+#
+# (ADVANCED) Here be dragons - Advanced settings for the brave
+#
+
+# (OPTIONAL) Secureboot and TPM-based disk encryption
+#   Ref: https://www.talos.dev/v1.9/talos-guides/install/bare-metal-platforms/secureboot
+secureboot:
+  # (OPTIONAL) Enable secureboot on UEFI systems. Not supported on x86 platforms in BIOS mode.
+  enabled: false
+  # (OPTIONAL) Enable TPM-based disk encryption. Requires TPM 2.0
+  encrypt_disk: false
+
 # (OPTIONAL) Feature gates are used to enable experimental features
 feature_gates:
   # Enable Dual Stack IPv4 first

templates/config/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2

@@ -4,4 +4,4 @@ kind: Secret
 metadata:
   name: github-webhook-token-secret
 stringData:
-  token: "#{ github_webhook_token }#"
+  token: "#{ github.webhook_token }#"

templates/config/kubernetes/flux/config/cluster.yaml.j2

@@ -6,13 +6,13 @@ metadata:
   namespace: flux-system
 spec:
   interval: 30m
-  url: "#{ github_address }#"
+  url: "#{ github.address }#"
   #% if github_private_key %#
   secretRef:
     name: github-deploy-key
   #% endif %#
   ref:
-    branch: "#{ github_branch | default('main', true) }#"
+    branch: "#{ github.branch | default('main', true) }#"
   ignore: |
     # exclude all
     /*