update k8s support to 1.32 + Cilium L2 Announcement rfe

.envrc

@@ -3,13 +3,13 @@
 export PATH=$PATH:.github/bin
 
 # Platform Architecture
-export ARCH=$(uname -m | awk '{ if ($$1 == "x86_64") print "amd64"; else if ($$1 == "aarch64" || $$1 == "arm64") print "arm64"; else print "unknown" }')
+#export ARCH=$(uname -m | awk '{ if ($$1 == "x86_64") print "amd64"; else if ($$1 == "aarch64" || $$1 == "arm64") print "arm64"; else print "unknown" }')
 
 ##################################################################################
 # Basic Config Variables
-export KUBECONFIG=$PWD/.kube/config
-export TALOSCONFIG=$PWD/.talos/manifest/talosconfig
-export OMNICONFIG=.talos/omniconfig
+#export KUBECONFIG=$PWD/.kube/config
+#export TALOSCONFIG=$PWD/.talos/manifest/talosconfig
+#export OMNICONFIG=.talos/omniconfig
 export BROWSER=echo
 
 ##################################################################################

Pulumi.yaml

@@ -8,6 +8,7 @@ runtime:
   name: python
   options:
     virtualenv: venv
+    toolchain: poetry
 config:
   pulumi:tags:
     value:

docs/metal/optiplexprime/cluster.yaml

@@ -1,35 +1,35 @@
 kind: Cluster
 name: optiplexprime
 talos:
-  version: v1.7.6
+  version: v1.9.1
 kubernetes:
-  version: v1.30.4
+  version: v1.32.0
 ---
 kind: ControlPlane
-machines:
-  - 4c4c4544-0036-3110-8047-c2c04f394e32
-  - 4c4c4544-0035-5210-804b-c2c04f394e32
-  - 4c4c4544-0056-3210-804c-b5c04f525032
 patches:
   - file: docs/metal/optiplexprime/patch.yaml
+machines:
+  - 4c4c4544-0036-3110-8047-c2c04f394e32
+# - 4c4c4544-0035-5210-804b-c2c04f394e32
+# - 4c4c4544-0056-3210-804c-b5c04f525032
 ---
 kind: Machine
 name: 4c4c4544-0036-3110-8047-c2c04f394e32
 install:
-  disk: /dev/nvme1n1
-patches:
-  - file: docs/metal/optiplexprime/machine.yaml
----
-kind: Machine
-name: 4c4c4544-0035-5210-804b-c2c04f394e32
-install:
-  disk: /dev/nvme1n1
-patches:
-  - file: docs/metal/optiplexprime/machine.yaml
----
-kind: Machine
-name: 4c4c4544-0056-3210-804c-b5c04f525032
-install:
-  disk: /dev/nvme1n1
+  disk: /dev/nvme0n1
 patches:
   - file: docs/metal/optiplexprime/machine.yaml
+#---
+#kind: Machine
+#name: 4c4c4544-0035-5210-804b-c2c04f394e32
+#install:
+#  disk: /dev/nvme1n1
+#patches:
+#  - file: docs/metal/optiplexprime/machine.yaml
+#---
+#kind: Machine
+#name: 4c4c4544-0056-3210-804c-b5c04f525032
+#install:
+#  disk: /dev/nvme1n1
+#patches:
+#  - file: docs/metal/optiplexprime/machine.yaml

docs/metal/optiplexprime/machine.yaml

@@ -1,28 +1,45 @@
 machine:
+  features:
+    # Enable KubePrism k8s api proxy listening on each worker/cp node at `localhost:7455`
+    kubePrism:
+      enabled: true
+      port: 7445
   network:
+    hostname: op1
     interfaces:
       - interface: br0
         dhcp: true
         bridge:
           interfaces:
             - enp3s0
+            - enp0s31f6
   disks:
     - device: /dev/sda
       partitions:
-        - mountpoint: /var/mnt/hostpath-provisioner
+        - mountpoint: /var/mnt/hostpath-provisioner/ssd
   kubelet:
-    extraMounts:
-      - destination: /etc/cni/net.d
-        type: bind
-        source: /etc/cni/net.d
-        options:
-          - bind
-          - rshared
-          - rw
-      - destination: /opt/cni/bin
-        type: bind
-        source: /opt/cni/bin
-        options:
-          - bind
-          - rshared
-          - rw
+    extraArgs:
+      # Rotate server certificates automatically
+      # https://kubernetes.io/docs/tasks/tls/certificate-rotation/
+      # Approve the CSR requests for the kubelet to rotate the certificates
+      # https://kubernetes.io/docs/tasks/tls/certificate-rotation/#approving-the-csr-requests
+      # Example Command:
+      # kubectl get csr | grep Pending | awk '{print $1}' | xargs kubectl certificate approve
+      # Example Command for All Namespaces:
+      # kubectl get csr --no-headers | awk '/Pending/ {print $1}' | xargs -I {} kubectl certificate approve {}
+      rotate-server-certificates: "false"
+#   extraMounts:
+#     - destination: /etc/cni/net.d
+#       type: bind
+#       source: /etc/cni/net.d
+#       options:
+#         - bind
+#         - rshared
+#         - rw
+#     - destination: /opt/cni/bin
+#       type: bind
+#       source: /opt/cni/bin
+#       options:
+#         - bind
+#         - rshared
+#         - rw

docs/metal/optiplexprime/patch.yaml

@@ -2,3 +2,8 @@ cluster:
   allowSchedulingOnControlPlanes: true
   apiServer:
     disablePodSecurityPolicy: true
+  network:
+    cni:
+      name: none
+  proxy:
+    disabled: true