feat(k8s-2): bare-metal config for saturn #587

2026-08-25T20:12:34Z

claude-bot commented

2026-08-25 20:12:34 +00:00

Prepared ahead of saturn's conversion, while osd.0 evacuates. Structurally identical to k8s-1.yaml — only serials, MACs and addresses differ.

Written from saturn's live hardware, not assumed. The X710 port 1 MAC came from the guest that currently owns it (talosctl -n 10.2.40.136 get links), because a passed-through NIC is invisible to the host. It matched the sequential pattern, but guessing was not worth the risk given what a wrong NIC selector did to jupiter.


Kingston `50026B7382DA5F6E`	system disk
Crucial `2332E86B74BC`	EPHEMERAL — retiring from `osd.0` at 81% wear
X710 p0 `58:47:ca:76:6f:73`	trunk: VLAN 40 (mgmt) + VLAN 30 (`ens19`)
X710 p1 `58:47:ca:76:6f:74`	Ceph cluster net, `10.99.0.2/29`, MTU 9000
PM983	OSD — by-id path added to `cephcluster.yaml` after install

Both disks selected by serial, links by kernel name. Not stylistic: Talos and Proxmox disagree on NVMe enumeration order, and a network document that fails to resolve disables default DHCP machine-wide — which is what left jupiter with no address on any interface.

talosctl validate --mode metal passes against v1.12.6.

Note on merging

Nothing applies this on merge — talos/patches/ is applied by hand during the install. Landing it now means the file under review is the file that actually gets installed, rather than reviewing it after the fact.

k8s-3 keeps its VM-era layout until neptune is converted.

🤖 Generated with Claude Code

Prepared ahead of saturn's conversion, while `osd.0` evacuates. Structurally identical to `k8s-1.yaml` — only serials, MACs and addresses differ. **Written from saturn's live hardware, not assumed.** The X710 port 1 MAC came from the guest that currently owns it (`talosctl -n 10.2.40.136 get links`), because a passed-through NIC is invisible to the host. It matched the sequential pattern, but guessing was not worth the risk given what a wrong NIC selector did to jupiter. | | | |---|---| | Kingston `50026B7382DA5F6E` | system disk | | Crucial `2332E86B74BC` | EPHEMERAL — retiring from `osd.0` at 81% wear | | X710 p0 `58:47:ca:76:6f:73` | trunk: VLAN 40 (mgmt) + VLAN 30 (`ens19`) | | X710 p1 `58:47:ca:76:6f:74` | Ceph cluster net, `10.99.0.2/29`, MTU 9000 | | PM983 | OSD — by-id path added to `cephcluster.yaml` after install | Both disks selected by **serial**, links by **kernel name**. Not stylistic: Talos and Proxmox disagree on NVMe enumeration order, and a network document that fails to resolve disables default DHCP machine-wide — which is what left jupiter with no address on any interface. `talosctl validate --mode metal` passes against v1.12.6. ## Note on merging Nothing applies this on merge — `talos/patches/` is applied by hand during the install. Landing it now means the file under review is the file that actually gets installed, rather than reviewing it after the fact. k8s-3 keeps its VM-era layout until neptune is converted. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-08-25 20:12:34 +00:00

feat(k8s-2): bare-metal config for saturn

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ef6111bda3

Structurally identical to k8s-1.yaml; only serials, MACs and addresses differ.
Written from saturn's live hardware rather than assumed: the X710 port 1 MAC
came from the guest that currently owns it, since the host cannot see a
passed-through NIC.

  Kingston  50026B7382DA5F6E  system disk
  Crucial   2332E86B74BC      EPHEMERAL, retiring from osd.0 at 81% wear
  X710 p0   58:47:ca:76:6f:73 trunk, VLAN 40 + VLAN 30
  X710 p1   58:47:ca:76:6f:74 Ceph cluster network, 10.99.0.2/29

Links are addressed by kernel name rather than LinkAliasConfig, and both disks
by serial. Talos and Proxmox do not agree on NVMe enumeration order, and a
network document that fails to resolve takes the whole machine's DHCP with it.

Not applied by anything on merge — talos patches are applied by hand. Landing
it before the conversion so the file under review is the file that gets
installed.

Verified with talosctl validate --mode metal against v1.12.6.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

k.renner merged commit 562b2dcc32 into master

2026-08-25 20:14:05 +00:00

k.renner referenced this issue from a commit

2026-08-25 20:14:05 +00:00

Merge pull request 'feat(k8s-2): bare-metal config for saturn' (#587) from k8s-2-baremetal into master

review-bot reviewed

2026-08-25 20:15:49 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit ef6111bda330df7e27f5c2646ddf47001e1cdb7e.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Replaces kubernetes/talos/patches/k8s-2.yaml's VM-era config (busPath device selectors, /dev/vda) with the bare-metal, multi-document Talos v1.12 config used for jupiter's conversion in k8s-1.yaml. Applied by hand at install time, not by any automated pipeline, so this diff's correctness is what actually gets installed on saturn. I compared it document-by-document against k8s-1.yaml and cross-checked the referenced Ceph network config; the file is structurally faithful to the reference and internally consistent. No blocking issues found.

🟡 Suggestions

kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml:150-152 still says the Ceph cluster network is "carried by an X710 SFP+ port PCI-passed-through to each Talos K8s VM" and points at opentofu/vm_15{0,1,2}_k8s_*.tf for all three nodes — already stale for jupiter and about to be stale for saturn too. Not something this PR needs to fix (it doesn't touch that file, and the runbook's step 9/2a handle the OSD/OpenTofu side separately), but worth a follow-up once saturn's conversion actually lands so the comment doesn't drift further from reality.

Tests

No automated tests apply to a hand-applied Talos machine-config patch; this is infra-as-documentation. The PR body states talosctl validate passed against v1.12.6, which is the right check for this kind of change and I have no way to independently re-run it in this sandbox. I did verify by inspection:

Both new serials (50026B7382DA5F6E disk, 2332E86B74BC EPHEMERAL) are unique in the repo — no accidental reuse of jupiter's or another node's values.
The shared control-plane VIP (10.2.40.60) is intentionally identical to k8s-1.yaml's (etcd-elected shared VIP across control-plane nodes) — not a copy-paste bug.
The Ceph cluster address 10.99.0.2/29 falls inside the 10.99.0.0/29 range cephcluster.yaml's addressRanges.cluster already expects, and differs from k8s-1's .1.
Document order and kind sequence (machine config, VolumeConfig, two LinkConfigs, two VLANConfigs, DHCPv4Config, Layer2VIPConfig) matches k8s-1.yaml exactly, consistent with the RUNBOOK's warning that a document that fails to resolve disables default DHCP machine-wide — same shape that was validated on jupiter.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `ef6111bda330df7e27f5c2646ddf47001e1cdb7e`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Replaces `kubernetes/talos/patches/k8s-2.yaml`'s VM-era config (busPath device selectors, `/dev/vda`) with the bare-metal, multi-document Talos v1.12 config used for jupiter's conversion in `k8s-1.yaml`. Applied by hand at install time, not by any automated pipeline, so this diff's correctness is what actually gets installed on saturn. I compared it document-by-document against `k8s-1.yaml` and cross-checked the referenced Ceph network config; the file is structurally faithful to the reference and internally consistent. No blocking issues found. ## 🟡 Suggestions - `kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml:150-152` still says the Ceph cluster network is "carried by an X710 SFP+ port PCI-passed-through to each Talos K8s VM" and points at `opentofu/vm_15{0,1,2}_k8s_*.tf` for all three nodes — already stale for jupiter and about to be stale for saturn too. Not something this PR needs to fix (it doesn't touch that file, and the runbook's step 9/2a handle the OSD/OpenTofu side separately), but worth a follow-up once saturn's conversion actually lands so the comment doesn't drift further from reality. ## Tests No automated tests apply to a hand-applied Talos machine-config patch; this is infra-as-documentation. The PR body states `talosctl validate` passed against v1.12.6, which is the right check for this kind of change and I have no way to independently re-run it in this sandbox. I did verify by inspection: - Both new serials (`50026B7382DA5F6E` disk, `2332E86B74BC` EPHEMERAL) are unique in the repo — no accidental reuse of jupiter's or another node's values. - The shared control-plane VIP (`10.2.40.60`) is intentionally identical to `k8s-1.yaml`'s (etcd-elected shared VIP across control-plane nodes) — not a copy-paste bug. - The Ceph cluster address `10.99.0.2/29` falls inside the `10.99.0.0/29` range `cephcluster.yaml`'s `addressRanges.cluster` already expects, and differs from k8s-1's `.1`. - Document order and kind sequence (machine config, `VolumeConfig`, two `LinkConfig`s, two `VLANConfig`s, `DHCPv4Config`, `Layer2VIPConfig`) matches `k8s-1.yaml` exactly, consistent with the RUNBOOK's warning that a document that fails to resolve disables default DHCP machine-wide — same shape that was validated on jupiter. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#587