wheatley/infrastructure
2
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

chore(k8s-wheatley): Bump versions #42

Merged
Peter merged 1 commit from pgi-bump-versions into main 2026-09-19 23:48:34 +02:00
Conversation 2 Commits 1 Files changed 1 +4 -4
Peter commented 2026-09-19 23:44:33 +02:00
Owner
Copy link
No description provided.
chore(k8s-wheatley): Bump versions
All checks were successful
Tofu Plan k8s-wheatley / tofu-plan-k8s-wheatley (pull_request) Successful in 23s
Details
4c908356ba
forgejo-actions commented 2026-09-19 23:44:56 +02:00
Copy link

Tofu Plan k8s-wheatley

✅ OpenTofu Format and Style 🖌

✅ OpenTofu Initialization ⚙️

✅ OpenTofu Validation 🤖

Validation Output 
Success! The configuration is valid.

✅ OpenTofu Plan 📖

Show Plan 
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp01
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = aab4b8474c60fc6f581140d46b010d763ecfe40020e3101853d1288005b38937 -> dc3710d3580fec618c87ba4e72a35862e8dad793adf464392a23ec7eb86962a0
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp02
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 1c6f3eb19002efa612ef643e7df666f4b599b5c6f781aebbe891eea801fcd4e5 -> c8a30cfcb4bee4eda667c4db561d541e849dcd9ef36615c854a1c0d7131e19a7
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp03
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 2cfcb42f1902b1324cf714627b54d8093a89ea55caeb111f5d78d07411ab2013 -> 755fd96aa13e2fafc29989d9a9fd97c28bd3b7ed348b4a7017b89ac186a142d5
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker01
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.21/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = dadc1bdc76443eeb826cd873d9c735a36827093c31814a53b5db834371fea24a -> f9aeada82a9bc18953a39002786d8190c34ee72701d6c299aa3987d523e6ca74
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker02
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.22/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = c6118fca630d3478eca9bb7f8c056bcbf6591dfecf73126e6f51d204405e26f5 -> 4ca2d082ae73e9b69dca27bb53c01d1ad4b8d296b84362f380e0725a5b7dc091
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker03
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.23/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 6abfacbeafc58cb54a77e9f7570256906f996874d7421572456c6d60e81e8586 -> 2ddbc6030f9d546b2a36969956402ef4d51bef2448bfea226be4cb46c7d92aaf
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 6 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run tofu apply now.
### Tofu Plan k8s-wheatley #### ✅ OpenTofu Format and Style 🖌 #### ✅ OpenTofu Initialization ⚙️ #### ✅ OpenTofu Validation 🤖 <details><summary>Validation Output</summary> ``` Success! The configuration is valid. ``` </details> #### ✅ OpenTofu Plan 📖 <details><summary>Show Plan</summary> ``` OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place (current -> planned) OpenTofu will perform the following actions: # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp01 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = aab4b8474c60fc6f581140d46b010d763ecfe40020e3101853d1288005b38937 -> dc3710d3580fec618c87ba4e72a35862e8dad793adf464392a23ec7eb86962a0 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp02 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 1c6f3eb19002efa612ef643e7df666f4b599b5c6f781aebbe891eea801fcd4e5 -> c8a30cfcb4bee4eda667c4db561d541e849dcd9ef36615c854a1c0d7131e19a7 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp03 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 2cfcb42f1902b1324cf714627b54d8093a89ea55caeb111f5d78d07411ab2013 -> 755fd96aa13e2fafc29989d9a9fd97c28bd3b7ed348b4a7017b89ac186a142d5 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker01 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.21/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = dadc1bdc76443eeb826cd873d9c735a36827093c31814a53b5db834371fea24a -> f9aeada82a9bc18953a39002786d8190c34ee72701d6c299aa3987d523e6ca74 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker02 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.22/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = c6118fca630d3478eca9bb7f8c056bcbf6591dfecf73126e6f51d204405e26f5 -> 4ca2d082ae73e9b69dca27bb53c01d1ad4b8d296b84362f380e0725a5b7dc091 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker03 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.23/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 6abfacbeafc58cb54a77e9f7570256906f996874d7421572456c6d60e81e8586 -> 2ddbc6030f9d546b2a36969956402ef4d51bef2448bfea226be4cb46c7d92aaf ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } Plan: 0 to add, 6 to change, 0 to destroy. ───────────────────────────────────────────────────────────────────────────── Note: You didn't use the -out option to save this plan, so OpenTofu can't guarantee to take exactly these actions if you run tofu apply now. ``` </details>
Peter merged commit 4692aca758 into main 2026-09-19 23:48:34 +02:00
forgejo-actions commented 2026-09-19 23:49:00 +02:00
Copy link

Tofu Apply k8s-wheatley

✅ OpenTofu Format and Style 🖌

✅ OpenTofu Initialization ⚙️

✅ OpenTofu Validation 🤖

Validation Output 
Success! The configuration is valid.

✅ OpenTofu Apply 🚀

Show Apply 
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp01
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = aab4b8474c60fc6f581140d46b010d763ecfe40020e3101853d1288005b38937 -> dc3710d3580fec618c87ba4e72a35862e8dad793adf464392a23ec7eb86962a0
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp02
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 1c6f3eb19002efa612ef643e7df666f4b599b5c6f781aebbe891eea801fcd4e5 -> c8a30cfcb4bee4eda667c4db561d541e849dcd9ef36615c854a1c0d7131e19a7
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_cp {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: controlplane
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-cp03
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth0
                        dhcp: false
                        vip:
                          ip: 10.13.37.10
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 2cfcb42f1902b1324cf714627b54d8093a89ea55caeb111f5d78d07411ab2013 -> 755fd96aa13e2fafc29989d9a9fd97c28bd3b7ed348b4a7017b89ac186a142d5
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker01
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.21/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = dadc1bdc76443eeb826cd873d9c735a36827093c31814a53b5db834371fea24a -> f9aeada82a9bc18953a39002786d8190c34ee72701d6c299aa3987d523e6ca74
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker02
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.22/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = c6118fca630d3478eca9bb7f8c056bcbf6591dfecf73126e6f51d204405e26f5 -> 4ca2d082ae73e9b69dca27bb53c01d1ad4b8d296b84362f380e0725a5b7dc091
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

  # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03] will be updated in-place
  ~ resource talos_machine_configuration_apply config_apply_worker {
      ~ client_configuration_wo        = (write-only attribute)
      ~ config_patches                 = [
          ~ <<-EOT
                debug: false
                machine:
                  type: worker
                  install:
                    disk: /dev/vda
                  network:
                    hostname: k8s-wheatley-worker03
                    nameservers:
                      - 9.9.9.9
                    interfaces:
                      - interface: eth1
                        mtu: 9000
                        dhcp: false
                        addresses:
                          - 10.0.69.23/24
                  kubelet:
                    extraArgs:
                      pod-max-pids: 1000
                    extraConfig:
                      imageGCHighThresholdPercent: 75
                      imageGCLowThresholdPercent: 70
                    nodeIP:
                      validSubnets:
                        - 10.13.37.0/24
                  kernel:
                    modules:
                      - name: drbd
                        parameters:
                          - usermode_helper=disabled
                      - name: drbd_transport_tcp
                      - name: dm_thin_pool
                  nodeLabels:
                    topology.kubernetes.io/region: k8s-wheatley
                    topology.kubernetes.io/zone: pve01.wheatley.in
                
                cluster:
                  apiServer:
                    auditPolicy:
                      apiVersion: audit.k8s.io/v1
                      kind: Policy
                      rules:
                        - level: Metadata
                  network:
                    cni:
                      name: none
                  proxy:
                    disabled: true
                  extraManifests:
              -   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
              +   - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml
                  inlineManifests:
                  - name: cilium-bootstrap
                    contents: |
                      ---
                      apiVersion: rbac.authorization.k8s.io/v1
                      kind: ClusterRoleBinding
                      metadata:
                        name: cilium-install
                      roleRef:
                        apiGroup: rbac.authorization.k8s.io
                        kind: ClusterRole
                        name: cluster-admin
                      subjects:
                      - kind: ServiceAccount
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: v1
                      kind: ServiceAccount
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      ---
                      apiVersion: batch/v1
                      kind: Job
                      metadata:
                        name: cilium-install
                        namespace: kube-system
                      spec:
                        backoffLimit: 10
                        template:
                          metadata:
                            labels:
                              app: cilium-install
                          spec:
                            restartPolicy: OnFailure
                            tolerations:
                              - operator: Exists
                              - effect: NoSchedule
                                operator: Exists
                              - effect: NoExecute
                                operator: Exists
                              - effect: PreferNoSchedule
                                operator: Exists
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoSchedule
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: NoExecute
                              - key: node-role.kubernetes.io/control-plane
                                operator: Exists
                                effect: PreferNoSchedule
                            affinity:
                              nodeAffinity:
                                requiredDuringSchedulingIgnoredDuringExecution:
                                  nodeSelectorTerms:
                                    - matchExpressions:
                                        - key: node-role.kubernetes.io/control-plane
                                          operator: Exists
                            serviceAccount: cilium-install
                            serviceAccountName: cilium-install
                            hostNetwork: true
                            containers:
                            - name: cilium-install
                              image: quay.io/cilium/cilium-cli:latest
                              env:
                              - name: KUBERNETES_SERVICE_HOST
                                valueFrom:
                                  fieldRef:
                                    apiVersion: v1
                                    fieldPath: status.podIP
                              - name: KUBERNETES_SERVICE_PORT
                                value: 6443
                              command:
                                - cilium
                                - install
                                - --set
                                - ipam.mode=kubernetes
                                - --set
                                - kubeProxyReplacement=true
                                - --set
                                - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}
                                - --set
                                - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}
                                - --set
                                - cgroup.autoMount.enabled=false
                                - --set
                                - cgroup.hostRoot=/sys/fs/cgroup
                                - --set
                                - k8sServiceHost=
                                - --set
                                - k8sServicePort=
                                - --set
                                - gatewayAPI.enabled=true
                                - --set
                                - gatewayAPI.enableAlpn=true 
                                - --set
                                - gatewayAPI.enableAppProtocol=true
                                - --set
                                - hubble.relay.enabled=true
                                - --set 
                                - hubble.ui.enabled=true
            EOT,
        ]
        id                             = machine_configuration_apply
      ~ machine_configuration          = (sensitive value)
      ~ machine_configuration_hash     = 6abfacbeafc58cb54a77e9f7570256906f996874d7421572456c6d60e81e8586 -> 2ddbc6030f9d546b2a36969956402ef4d51bef2448bfea226be4cb46c7d92aaf
      ~ machine_configuration_input    = (sensitive value)
      ~ machine_configuration_input_wo = (write-only attribute)
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 6 to change, 0 to destroy.
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02]: Modifying... [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03]: Modifications complete after 0s [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01]: Modifications complete after 0s [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02]: Modifications complete after 0s [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03]: Modifications complete after 0s [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01]: Modifications complete after 0s [id=machine_configuration_apply]
module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02]: Modifications complete after 0s [id=machine_configuration_apply]

Apply complete! Resources: 0 added, 6 changed, 0 destroyed.

Outputs:

kubeconfig = <sensitive>
talosconfig = <sensitive>
### Tofu Apply k8s-wheatley #### ✅ OpenTofu Format and Style 🖌 #### ✅ OpenTofu Initialization ⚙️ #### ✅ OpenTofu Validation 🤖 <details><summary>Validation Output</summary> ``` Success! The configuration is valid. ``` </details> #### ✅ OpenTofu Apply 🚀 <details><summary>Show Apply</summary> ``` OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place (current -> planned) OpenTofu will perform the following actions: # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp01 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = aab4b8474c60fc6f581140d46b010d763ecfe40020e3101853d1288005b38937 -> dc3710d3580fec618c87ba4e72a35862e8dad793adf464392a23ec7eb86962a0 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp02 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 1c6f3eb19002efa612ef643e7df666f4b599b5c6f781aebbe891eea801fcd4e5 -> c8a30cfcb4bee4eda667c4db561d541e849dcd9ef36615c854a1c0d7131e19a7 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_cp { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: controlplane install: disk: /dev/vda network: hostname: k8s-wheatley-cp03 nameservers: - 9.9.9.9 interfaces: - interface: eth0 dhcp: false vip: ip: 10.13.37.10 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 2cfcb42f1902b1324cf714627b54d8093a89ea55caeb111f5d78d07411ab2013 -> 755fd96aa13e2fafc29989d9a9fd97c28bd3b7ed348b4a7017b89ac186a142d5 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker01 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.21/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = dadc1bdc76443eeb826cd873d9c735a36827093c31814a53b5db834371fea24a -> f9aeada82a9bc18953a39002786d8190c34ee72701d6c299aa3987d523e6ca74 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker02 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.22/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = c6118fca630d3478eca9bb7f8c056bcbf6591dfecf73126e6f51d204405e26f5 -> 4ca2d082ae73e9b69dca27bb53c01d1ad4b8d296b84362f380e0725a5b7dc091 ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } # module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03] will be updated in-place ~ resource talos_machine_configuration_apply config_apply_worker { ~ client_configuration_wo = (write-only attribute) ~ config_patches = [ ~ <<-EOT debug: false machine: type: worker install: disk: /dev/vda network: hostname: k8s-wheatley-worker03 nameservers: - 9.9.9.9 interfaces: - interface: eth1 mtu: 9000 dhcp: false addresses: - 10.0.69.23/24 kubelet: extraArgs: pod-max-pids: 1000 extraConfig: imageGCHighThresholdPercent: 75 imageGCLowThresholdPercent: 70 nodeIP: validSubnets: - 10.13.37.0/24 kernel: modules: - name: drbd parameters: - usermode_helper=disabled - name: drbd_transport_tcp - name: dm_thin_pool nodeLabels: topology.kubernetes.io/region: k8s-wheatley topology.kubernetes.io/zone: pve01.wheatley.in cluster: apiServer: auditPolicy: apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata network: cni: name: none proxy: disabled: true extraManifests: - - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml inlineManifests: - name: cilium-bootstrap contents: | --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cilium-install roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: cilium-install namespace: kube-system --- apiVersion: v1 kind: ServiceAccount metadata: name: cilium-install namespace: kube-system --- apiVersion: batch/v1 kind: Job metadata: name: cilium-install namespace: kube-system spec: backoffLimit: 10 template: metadata: labels: app: cilium-install spec: restartPolicy: OnFailure tolerations: - operator: Exists - effect: NoSchedule operator: Exists - effect: NoExecute operator: Exists - effect: PreferNoSchedule operator: Exists - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoSchedule - key: node-role.kubernetes.io/control-plane operator: Exists effect: NoExecute - key: node-role.kubernetes.io/control-plane operator: Exists effect: PreferNoSchedule affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists serviceAccount: cilium-install serviceAccountName: cilium-install hostNetwork: true containers: - name: cilium-install image: quay.io/cilium/cilium-cli:latest env: - name: KUBERNETES_SERVICE_HOST valueFrom: fieldRef: apiVersion: v1 fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: 6443 command: - cilium - install - --set - ipam.mode=kubernetes - --set - kubeProxyReplacement=true - --set - securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - --set - securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - --set - cgroup.autoMount.enabled=false - --set - cgroup.hostRoot=/sys/fs/cgroup - --set - k8sServiceHost= - --set - k8sServicePort= - --set - gatewayAPI.enabled=true - --set - gatewayAPI.enableAlpn=true - --set - gatewayAPI.enableAppProtocol=true - --set - hubble.relay.enabled=true - --set - hubble.ui.enabled=true EOT, ] id = machine_configuration_apply ~ machine_configuration = (sensitive value) ~ machine_configuration_hash = 6abfacbeafc58cb54a77e9f7570256906f996874d7421572456c6d60e81e8586 -> 2ddbc6030f9d546b2a36969956402ef4d51bef2448bfea226be4cb46c7d92aaf ~ machine_configuration_input = (sensitive value) ~ machine_configuration_input_wo = (write-only attribute) # (5 unchanged attributes hidden) } Plan: 0 to add, 6 to change, 0 to destroy. module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02]: Modifying... [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp03]: Modifications complete after 0s [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp01]: Modifications complete after 0s [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_cp[k8s-wheatley-cp02]: Modifications complete after 0s [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker03]: Modifications complete after 0s [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker01]: Modifications complete after 0s [id=machine_configuration_apply] module.talos-bootstrap.talos_machine_configuration_apply.config_apply_worker[k8s-wheatley-worker02]: Modifications complete after 0s [id=machine_configuration_apply] Apply complete! Resources: 0 added, 6 changed, 0 destroyed. Outputs: kubeconfig = <sensitive> talosconfig = <sensitive> ``` </details>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
wheatley/infrastructure!42
No description provided.