feat(bootstrap): revive the talos phase, rename the mirror patch

Conversation 1 Commits 2 Files Changed 4

+58 -11

2 Commits

Author	SHA1	Message	Date
claude-bot	c92aff9e75	docs(talos): rename registry-mirror.yaml to what it actually does ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details The name says the bootstrap depends on a registry mirror. Reading the patch list in the runbook, that is the obvious conclusion — and it would be a serious problem, because a cold rebuild has no mirror: an in-cluster one cannot exist before the cluster does. The file configures no mirror. It writes one containerd setting, discard_unpacked_layers = false, so that pulled layers stay in the content store and Spegel can advertise them to peers later. Spegel writes the per-registry hosts.toml itself at runtime; the file's own comment says a machine.registries.mirrors block is not needed, and there is none anywhere in talos/patches. Image pulls at bootstrap go straight to the real registries. So the alarm the name raises is false, but it is the name doing it, and the cost of that is someone deciding a rebuild is blocked when it is not. containerd-layer-retention.yaml describes the single thing inside. Renamed with git mv and the three references updated. Verified `talosctl gen config` still produces a config with the renamed patch in the list.	2026-08-28 16:34:05 +02:00
claude-bot	cfba60afd0	feat(bootstrap): revive the talos phase and let it install the CNI The Cilium install had become a block of shell in a runbook for a human to paste. That is the same rot as a pinned version — nobody runs it between rebuilds, so nothing tells you when it stopped working. It belongs in the script that already drives the rest of the bootstrap. The talos phase was unusable since #581: it passed cilium-cni.yaml whole, and that file's `$patch: delete` document fails against a config with no inlineManifests. The file is gone, so the failure is gone with it — reviving the phase was mostly deleting two lines that referenced it. It now installs Cilium between `talosctl bootstrap` and the node-Ready wait, which is the only place it can go: with `cni: none` the kubelet stays NotReady until a CNI exists, so the wait below would otherwise time out against a cluster that was never going to converge. Chart repo, version constraint and values are read out of helmrelease.yaml at run time, so the script cannot install something different from what Flux reconciles minutes later. helm takes the semver range verbatim. There is a guard on the extracted values — the HelmRelease is a two-document file and selecting the wrong one yields an empty values set that helm silently renders as chart defaults, which is a failure mode worth catching loudly rather than discovering in a datapath. `--wait` because the next step needs a working network, and `upgrade --install` so a re-run after a partial bootstrap converges instead of erroring. Verified as far as it can be without wiping a cluster: `talosctl gen config` with exactly the patch list the script now passes produces a config carrying cni: none and proxy: disabled, no Cilium manifests, and it validates for metal mode. The apply-and-bootstrap half is untested since the rewrite, and the runbook says so — it keeps the manual procedure as the thing to read first and to fall back on.	2026-08-28 16:31:52 +02:00

Author

SHA1

Message

Date

claude-bot

c92aff9e75

docs(talos): rename registry-mirror.yaml to what it actually does

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

The name says the bootstrap depends on a registry mirror. Reading the patch list
in the runbook, that is the obvious conclusion — and it would be a serious
problem, because a cold rebuild has no mirror: an in-cluster one cannot exist
before the cluster does.

The file configures no mirror. It writes one containerd setting,
discard_unpacked_layers = false, so that pulled layers stay in the content store
and Spegel can advertise them to peers later. Spegel writes the per-registry
hosts.toml itself at runtime; the file's own comment says a
machine.registries.mirrors block is not needed, and there is none anywhere in
talos/patches. Image pulls at bootstrap go straight to the real registries.

So the alarm the name raises is false, but it is the name doing it, and the cost
of that is someone deciding a rebuild is blocked when it is not.
containerd-layer-retention.yaml describes the single thing inside.

Renamed with git mv and the three references updated. Verified `talosctl gen
config` still produces a config with the renamed patch in the list.

2026-08-28 16:34:05 +02:00

claude-bot

cfba60afd0

feat(bootstrap): revive the talos phase and let it install the CNI

The Cilium install had become a block of shell in a runbook for a human to
paste. That is the same rot as a pinned version — nobody runs it between
rebuilds, so nothing tells you when it stopped working. It belongs in the script
that already drives the rest of the bootstrap.

The talos phase was unusable since #581: it passed cilium-cni.yaml whole, and
that file's `$patch: delete` document fails against a config with no
inlineManifests. The file is gone, so the failure is gone with it — reviving the
phase was mostly deleting two lines that referenced it.

It now installs Cilium between `talosctl bootstrap` and the node-Ready wait,
which is the only place it can go: with `cni: none` the kubelet stays NotReady
until a CNI exists, so the wait below would otherwise time out against a cluster
that was never going to converge.

Chart repo, version constraint and values are read out of helmrelease.yaml at
run time, so the script cannot install something different from what Flux
reconciles minutes later. helm takes the semver range verbatim. There is a guard
on the extracted values — the HelmRelease is a two-document file and selecting
the wrong one yields an empty values set that helm silently renders as chart
defaults, which is a failure mode worth catching loudly rather than discovering
in a datapath.

`--wait` because the next step needs a working network, and `upgrade --install`
so a re-run after a partial bootstrap converges instead of erroring.

Verified as far as it can be without wiping a cluster: `talosctl gen config`
with exactly the patch list the script now passes produces a config carrying
cni: none and proxy: disabled, no Cilium manifests, and it validates for metal
mode. The apply-and-bootstrap half is untested since the rewrite, and the
runbook says so — it keeps the manual procedure as the thing to read first and
to fall back on.

2026-08-28 16:31:52 +02:00

feat(bootstrap): revive the talos phase, rename the mirror patch #710