- Add cilium-cni.yaml patch that disables flannel/kube-proxy and
includes Cilium 1.19.2 as an inline manifest
- Cilium installs during Talos bootstrap, no manual helm install needed
- Add certSANs for FQDNs to all node patches
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The raw image is only ~8.6GB, leaving too little ephemeral storage
for Kubernetes pods. Specifying size=32G tells the provider to expand
the disk after importing the image.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The custom Talos schematic includes qemu-guest-agent. The agent is
needed for Proxmox DNS to discover VM IPs via the API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Revert to using the BPG provider's native file_id disk import.
The provider SSH is configured via variable for qm importdisk.
Remove all SSH-based import steps from the CI pipeline.
Images are already downloaded to local:import/ on all nodes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Woodpecker mangles parameter expansion in multi-line scripts. Use a
shell function with explicit arguments instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Tofu creates VMs with empty disks in stopped state. The CI post-apply
step imports the Talos disk image via qm importdisk over SSH and
starts the VMs. Avoids Install storage reference on VM start.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The BPG provider's file_id disk import fails on this Proxmox version
with 'unable to parse volume ID' errors. Instead:
- Create VMs with empty 32G boot disks
- Post-apply CI step imports Talos image via qm importdisk over SSH
- Skips import if disk is already populated
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When a disk is imported from a file_id, the size comes from the image.
Setting both size and file_id causes the provider to fail with an
invalid volume ID error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The provider needs SSH access for qm importdisk. Pass the CI SSH key
as a tofu variable instead of reading from file (file doesn't exist
during plan step).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The provider needs SSH access to Proxmox nodes to import disk images
via qm importdisk. Use the CI-provisioned SSH key.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove download_file resource (times out with hardcoded provider limit).
Instead, download the Talos raw image directly via the Proxmox API
download-url endpoint in the CI pipeline before tofu apply runs.
The image is stored on local storage with import content type.
Skips download if image already exists on the node.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Proxmox doesn't support decompression for import content type.
Use the uncompressed .raw URL from Talos factory instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
local storage doesn't support 'import' content type. Store the raw
disk image as 'iso' content type — Proxmox accepts any file in the
ISO directory. The VM disk file_id will import from it correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
local-zfs is a ZFS pool (not file-based), can't upload files to it.
Use local storage with import content type instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Provider only accepts 'iso', 'vztmpl', or 'import'. Raw disk images
use 'import' content type on local-zfs storage.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Raw disk images belong on disk storage (local-zfs) with content_type
'images', not on ISO storage. Eliminates dependency on Install NFS.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The local storage doesn't accept ISO content type. Use the Install NFS
storage which is configured for ISO content across all nodes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allows removing orphaned resources from state before plan/apply.
Needed when VMs are destroyed outside tofu (e.g. broken storage)
and state references non-existent resources.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
BPG provider only supports gz/lzo/zst/bz2 decompression, not xz.
Switch to the .raw.zst variant from Talos factory.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace NFS ISO dependency with proxmox_virtual_environment_download_file
that pulls the Talos nocloud image directly from factory.talos.dev to
each Proxmox node's local storage. VMs boot from the raw disk image
instead of CDROM, eliminating the Install NFS storage dependency.
- Add talos_image.tf with download_file resource per node
- Add file_id support to proxmox_vm module disk config
- Remove CDROM from K8s VM definitions
- Boot order changed to virtio0 only
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PodMonitor CRD requires kube-prometheus-stack which isn't installed yet.
Disable monitoring for now, re-enable after monitoring stack is deployed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
IPAddressPool CRD is installed by MetalLB HelmRelease, so the
IPAddressPool resource must be in the post-crds stage.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
FluxCD dry-run fails when CRD-dependent resources (ClusterIssuer,
CephCluster) are in the same Kustomization as the HelmReleases that
install those CRDs. Split into 3 stages:
1. infrastructure/ - namespaces, HelmReleases (installs CRDs)
2. post-crds/ - ClusterIssuer (needs cert-manager CRDs)
3. rook-ceph-cluster/ - CephCluster, StorageClasses (needs Rook CRDs)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Change FluxCD git URL from git@ to gitea@ (Gitea uses 'gitea' user)
- Split Rook-Ceph into operator (infrastructure/) and cluster
(rook-ceph-cluster/) with FluxCD dependency ordering so CRDs exist
before CephCluster and StorageClass resources are applied
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Lessons from manual validation run:
- Add privileged PodSecurity labels to metallb-system, rook-ceph, ingress namespaces
- Add Cilium HelmRelease with Talos-specific settings (cgroup, kubePrism)
- Consolidate all namespace definitions in namespaces/
- Update cert-manager to use crds.enabled instead of installCRDs
- Enable all infrastructure components in main kustomization
- Add Talos secrets to .gitignore (controlplane.yaml, talosconfig)
- Update node patches with correct install disk (vda) and zone labels
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OVMF requires an EFI disk to boot properly. Without one, VMs get
temporary efivars and fail to boot from the Talos ISO. SeaBIOS
boots from CDROM without additional configuration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Supports recreating specific resources via -replace flag.
Pass space-separated resource addresses in TOFU_REPLACE variable.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Boot from CDROM (ide2) first for initial Talos install, then disk.
Set vm_state to 'running' so the started flag is correct.
Note: These changes only take effect on new creates since started
and boot are in lifecycle ignore_changes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Ollama container is currently stopped but the config said start=true,
causing every tofu apply to fail with HTTP 500 from Proxmox.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The BPG Proxmox provider deprecated the cdrom enabled attribute.
Remove it from the module and VM definitions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add cdrom and agent_enabled variables to the proxmox_vm module so VMs
can boot from ISO images. Attach Talos 1.10 nocloud ISO to the 3 K8s
VMs and disable QEMU guest agent (Talos doesn't support it).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.6