infra/kube: added kube cluster infrastructure

.sops.yaml

@@ -3,7 +3,7 @@ creation_rules:
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.env$
     input_type: dotenv

infra/kube/.gitignore

@@ -0,0 +1,3 @@
+clusterconfig/
+manifests/cilium.yaml
+talconfig.json

infra/kube/manifests/cilium/values.yaml

@@ -0,0 +1,67 @@
+ipam:
+    mode: kubernetes
+kubeProxyReplacement: true
+securityContext:
+    capabilities:
+        ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+        cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+cgroup:
+    autoMount:
+        enabled: false
+    hostRoot: /sys/fs/cgroup
+k8sServiceHost: localhost
+k8sServicePort: 7445
+etcd:
+    clusterDomain: cluster.local
+l2announcements:
+    enabled: true
+externalIPs:
+    enabled: true
+ingressController:
+    enabled: false
+    loadbalancerMode: shared
+    default: false
+    service:
+        externalTrafficPolicy: Cluster
+envoy:
+    xffNumTrustedHopsL7PolicyIngress: 1
+sops:
+    lastmodified: "2026-08-21T18:35:32Z"
+    mac: ENC[AES256_GCM,data:Ad0t52gfwmsLe1VWx9dsV9zI1k2XFHRpy369T6xqoimcqM19jMcInS/0Rgpg9QTFqOhMMJnf/Qf9H1+bvOvoyk32ykbkRJh7V2QHF/vaBfD/GyvEeJb17swoPehf6JyaLhzpIU8I94el3EEFhwi42xhnW8c/ghtKMqcc5VNwJP0=,iv:ouYUEQhKHMlCVsMEaDyhAndS3y0WRkv+LPX9JGnjtfs=,tag:wXEAZhc6yn47LO/U0PauoA==,type:str]
+    pgp:
+        - created_at: "2026-08-21T18:35:32Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//c5xdgliA1tjpUtZlZ0ByB+acwEbEA7Ee2K2ySg3GcQHG
+            2oE2QO2TvRkUzyLE+td7NgRWBqEV/6u/Ozfee2tLiijjCgUg4QtgEPFqQVS9QKZW
+            QXRRsBhG5vxdJqKXn22g2bofNuJZuDSUiGL2MMy85Tm1HAc9Rb65+UcRqtlqrkVU
+            e2GaxcYM+YexWnpBqA+685PSidbYVehH5WSgfTXqbilYmxmZH0wBPdLzSm63dDd2
+            SdtFy3JfsNDg3jYMge57FHd+FANltbdW5tHQaa+6FX9akyQ+3mY/xXt2Ut/KiiuP
+            WFb3SvNxluRXjvyKQXmkUPZDjL8YbY+jdcH9WEuWXFClwa2g3OVOSPotSvJ5eW3A
+            z5kk3tIq+LqIYpCPd/0AjpkAzeijAFATTxVUUsvPJHe6WDrCC0koP/7Vqqk3vvJh
+            5BM4/1pT5v9HfbgirR5ja3EBxgLEGFHRW4IAL5dJnL+JtM/NQwYJuWmzEn9Bdlu8
+            25aqVfVRkeOrjh/dS+2jwJvjPhzWd0KHv58PkCJVT6tJcitgak3eK8yV74HXRrbj
+            dBYr0hxs1oDQt5U6bqVVfzCXg0c/ZP1Or/kcjQQUHNsOyornbxJ6RTqeVTdLENWY
+            RZ6d2WNFVagbH8Kr2ah/L+MzHPQvhNSrLBpj8FjJH3wifZ4AePubSidv+ipJkH3S
+            XgFe9BbrSzN6b684/bBswl6sOK/AiW9pFPrGTuT+0qFvPcKNHLq+faltMS9rz3DW
+            FF+s0h07i4pkf9iED1nfXane+DpuKpDaE6S8UIn7SwrXJ5A67woc28QcaFbxYkw=
+            =lil9
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2

infra/kube/manifests/flux-system/flux-instance.yaml

@@ -0,0 +1,48 @@
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: flux-system
+spec:
+  distribution:
+    version: "2.x"
+    registry: ghcr.io/fluxcd
+  sync:
+    name: homeprod
+    kind: GitRepository
+    url: https://github.com/vhaudiquet/homeprod
+    path: kubernetes/
+    ref: refs/heads/main
+  components:
+    - source-controller
+    - kustomize-controller
+    - helm-controller
+    - notification-controller
+    - image-reflector-controller
+    - image-automation-controller
+  cluster:
+    type: kubernetes
+    multitenant: false
+    networkPolicy: true
+    domain: "cluster.local"
+  kustomize:
+    patches:
+      - target:
+          kind: Deployment
+          name: "(kustomize-controller|helm-controller)"
+        patch: |
+          - op: add
+            path: /spec/template/spec/containers/0/args/-
+            value: --concurrent=10
+          - op: add
+            path: /spec/template/spec/containers/0/args/-
+            value: --requeue-dependency=10s
+      - patch: |
+          - op: add
+            path: /spec/decryption
+            value:
+              provider: sops
+              secretRef:
+                name: flux-sops
+        target:
+          kind: Kustomization

infra/kube/reconcile.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Reconcile Talos cluster infrastructure
+# Environment needed:
+# - SOPS_KEY: sops private key
+set -euo pipefail
+
+if [ -z "${SOPS_KEY:-}" ]; then
+  echo "Error: SOPS_KEY environment variable is not set" >&2
+  exit 1
+fi
+
+# Render the Cilium chart for manifest deployment
+helm repo add cilium https://helm.cilium.io/
+helm repo update
+helm template cilium cilium/cilium \
+  --version 1.20.1 \
+  --namespace kube-system \
+  -f manifests/cilium/values.yaml \
+  > manifests/cilium.yaml
+
+# Escape shell variables that must be resolved at container runtime, not by talhelper.
+# talhelper expands ${VAR} statically; prefixing with $$ (i.e. $${VAR}) tells it to
+# preserve the literal ${VAR} in the output so bash can expand it inside the container.
+sed -i 's/\${BIN_PATH}/$${BIN_PATH}/g' manifests/cilium.yaml
+
+# Generate Talos machine config
+talhelper genconfig
+
+# Apply generated machine config to the nodes, without reboot.
+# If it fails, it is safer for reconcile to be done manually:
+# the reboot is needed and that might disrupt the node
+talhelper gencommand apply --extra-flags="-m no-reboot" | bash
+
+# Obtain kubeconfig and export it for kubectl
+talosctl --talosconfig ./clusterconfig/talosconfig kubeconfig -f ./clusterconfig/kubeconfig
+export KUBECONFIG=./clusterconfig/kubeconfig
+
+# Show nodes
+kubectl get nodes
+
+# Create Flux namespace if it does not already exists
+kubectl get ns "flux-system" || kubectl create ns "flux-system"
+
+# Create SOPS secret in the cluster
+kubectl create secret generic flux-sops \
+  --namespace "flux-system" \
+  --from-literal=sops.asc="$SOPS_KEY" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Install the Flux operator if not installed already
+kubectl get deployment -n flux-system flux-operator || helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
+  --namespace "flux-system" \
+  --wait
+
+kubectl apply -f manifests/flux-system/flux-instance.yaml

infra/kube/talconfig.yaml

@@ -0,0 +1,46 @@
+---
+clusterName: kube
+talosVersion: v1.13.8
+kubernetesVersion: v1.36.0
+endpoint: https://10.2.2.138:6443
+domain: cluster.local
+allowSchedulingOnMasters: true
+clusterPodNets:
+  - 10.244.0.0/16
+clusterSvcNets:
+  - 10.96.0.0/12
+cniConfig:
+  name: none
+nodes:
+  - hostname: p330
+    ipAddress: 10.2.2.138
+    filenameTmpl: "{{.ClusterName}}-{{.Hostname}}.yaml"
+    extensionServices: []
+    controlPlane: true
+    machineSpec:
+      mode: metal
+      arch: amd64
+      secureboot: false
+      useUKI: false
+      bootMethod: iso
+    installDisk: /dev/nvme0n1
+    schematic:
+      customization:
+        systemExtensions:
+          officialExtensions:
+            - siderolabs/intel-ucode
+            - siderolabs/iscsi-tools
+    kernelModules:
+      - name: iscsi_tcp
+      - name: libiscsi
+      - name: scsi_transport_iscsi
+      - name: ext4
+      - name: ixgbe
+        parameters:
+          - allow_unsupported_sfp=1
+    networkInterfaces:
+      - interface: eno1
+        dhcp: true
+inlineManifests:
+  - name: cilium
+    contents: "@./manifests/cilium.yaml"