← Retour aux guides 13 août 2026

Talos Linux – mise en place d’un cluster monohôte

Guide rapide pour mettre en place un cluster monohôte

taloskubernetes

Table des matières

Prérequis
Configuration
Initialiser le cluster
Cilium
cert-manager

Prérequis

talosctl installé
kubectl installé
Machine physique ou VM avec au moins 2 cœurs CPU et 4 Go de RAM.
Image Talos Linux avec les extensions siderolabs/util-linux-tools et siderolabs/iscsi-tools (voir https://factory.talos.dev/).

Configuration

Modèle de configuration de l’hôte

version: v1alpha1
machine:
    kubelet:
      extraMounts:
      - destination: /var/mnt/longhorn
        type: bind
        source: /var/mnt/longhorn
        options:
        - bind
        - rshared
        - rw
    time:
      servers:
        - time.cloudflare.com
    install:
        disk: /dev/nvme0n1
        image: "Id de l'images (voir https://factory.talos.dev/)"
        wipe: true
        grubUseUKICmdline: true
---
apiVersion: v1alpha1
kind: HostnameConfig
hostname: node-01
auto: off
---
apiVersion: v1alpha1
kind: ResolverConfig
nameservers:
    - address: 1.1.1.1
    - address: 1.0.0.1
---
apiVersion: v1alpha1
kind: LinkConfig
name: enp1s0
mtu: 1500
up: true
---
apiVersion: v1alpha1
kind: BridgeConfig
name: bridge
links:
    - eth1
stp:
    enabled: true
vlan:
    filtering: true
up: true
addresses:
    - address: 192.168.0.2/24
routes:
  - gateway: 192.168.0.1
    metric: 240

Modèle de configuration du cluster

# machine:
 # nodeLabels:
 #   node.kubernetes.io/exclude-from-external-load-balancers:
 #     $patch: delete
cluster:
  ## Attention : ceci autorise les charges de travail à fonctionner sur tous les hôtes du cluster
  allowSchedulingOnControlPlanes: true
  ## Autorise longhorn-system à accéder au système.
  apiServer:
    admissionControl:
    - name: PodSecurity
      configuration:
        exemptions:
          namespaces:
          - longhorn-system
  network:
    cni:
      name: none
  extraManifests:
  - https://github.com/fluxcd/flux2/releases/latest/download/install.yaml
  inlineManifests:
  - name: longhorn
    contents: |-
      apiVersion: v1
      kind: Namespace
      metadata:
        name: longhorn-system
      ---
      apiVersion: source.toolkit.fluxcd.io/v1
      kind: HelmRepository
      metadata:
        name: longhorn
        namespace: longhorn-system
      spec:
        interval: 5m0s
        url: https://charts.longhorn.io/
      ---
      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
        name: longhorn
        namespace: longhorn-system
      spec:
        interval: 10m
        chart:
          spec:
            chart: longhorn
            version: "v1.12.1"
            sourceRef:
              kind: HelmRepository
              name: longhorn
              namespace: longhorn-system
            interval: 10m
        values:
          replicaCount: 1
          preUpgradeChecker:
            jobEnabled: false
          csi:
            attacherReplicaCount: 1
            provisionerReplicaCount: 1
            resizerReplicaCount: 1
            snapshotterReplicaCount: 1
  - name: cert-manager
    contents: |-
      apiVersion: v1
      kind: Namespace
      metadata:
        name: cert-manager
      ---
      apiVersion: source.toolkit.fluxcd.io/v1
      kind: HelmRepository
      metadata:
        name: cert-manager
        namespace: cert-manager
      spec:
        type: "oci"
        interval: 5m0s
        url: oci://quay.io/jetstack/charts/
      ---
      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
        name: cert-manager
        namespace: cert-manager
      spec:
        interval: 10m
        chart:
          spec:
            chart: cert-manager
            version: "v1.21.1"
            sourceRef:
              kind: HelmRepository
              name: cert-manager
              namespace: cert-manager
            interval: 10m
        values:
          crds:
            enabled: true
          podDnsPolicy: "None"
          podDnsConfig:
            nameservers:
              - "1.1.1.1"
              - "1.0.0.1"

Initialiser le cluster

1. Générer la configuration du cluster

export CLUSTER_NAME="skube-dev"
export Endpoint="https://192.168.0.1:6443"
export patchbase_conf="./template/model-cluster.yaml"
talosctl gen config $CLUSTER_NAME $Endpoint \
  --config-patch @${patchbase_conf} \
  --output ./init

2. Générer et déployer la configuration d’un nœud

Adaptez talossrv et talos_hostname à chaque nœud. Le fichier ${talos_hostname}.yaml doit exister dans ./template/.

export talossrv="--insecure --nodes 192.168.0.101"
export talos_hostname="astate"
export talos_roles="controlplane" # ou worker
# Application du bon fichier selon le rôle :
#   - controlplane : ./init/controlplane.yaml
#   - worker       : ./init/worker.yaml
talosctl machineconfig patch ./init/${talos_roles}.yaml \
  --patch @./template/${talos_hostname}.yaml \
  --output ./host/host_${talos_hostname}.yaml

# Application sur le nœud :
talosctl apply-config ${talossrv} --file ./host/host_${talos_hostname}.yaml

3. Mise en place du cluster

export talossrv="-n 192.168.0.1 --talosconfig=./init/talosconfig"

talosctl config endpoints 192.168.0.1 --talosconfig=./init/talosconfig
talosctl bootstrap ${talossrv}
talosctl kubeconfig ${talossrv}
talosctl health ${talossrv}
kubectl get nodes

Cilium

Installation manuelle.

N’installez pas Cilium si vous utilisez Flannel. Pour les utilisateurs de Flannel, une section MetalLB se trouve plus bas.

export cilium_version="1.20.0"
export cilium_replicas=1
helm upgrade cilium oci://quay.io/cilium/charts/cilium \
    --version ${cilium_version} \
    --namespace kube-system \
    --set ipam.mode=kubernetes \
    --set kubeProxyReplacement=true \
    --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
    --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
    --set cgroup.autoMount.enabled=false \
    --set cgroup.hostRoot=/sys/fs/cgroup \
    --set k8sServiceHost=localhost \
    --set k8sServicePort=7445 \
    --set gatewayAPI.enabled=true \
    --set gatewayAPI.enableAlpn=true \
    --set gatewayAPI.enableAppProtocol=true

Cilium LoadBalancer

Configuration des pools d’adresses IP du LoadBalancer

Variables :

LB_RANGE="172.28.8.0/24"

cat <<EOF | kubectl apply -f -
apiVersion: "cilium.io/v2"
kind: CiliumLoadBalancerIPPool
metadata:
  name: lb-ip-pool
  labels:
    pool: "blue"
spec:
  blocks:
  - cidr: $LB_RANGE
EOF

Cilium Gateway

cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-external
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: external-config
    namespace: envoy-gateway-system
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-internal
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller

cert-manager

cPanel

export EMAIL="ti@sim-nord.ca"
export cpanel_url="https://cpanal.url:2083"
export cpanel_user="cpanel_user"
export cpanel_api="cpanel_api_secret"
## Ce n’est pas idéal, mais c’est une solution temporaire…
kubectl apply -f https://raw.githubusercontent.com/jamesorlakin/cert-manager-cpanel-dns-webhook/master/deploy/v0.3.0.yaml
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: cpanel-credentials
  namespace: cert-manager
stringData:
  username: ${cpanel_user}
  apiToken: ${cpanel_api}
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: $EMAIL
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - dns01:
        webhook:
          groupName: jameslakin.co.uk
          solverName: cpanel-solver
          config:
            cpanelUrl: ${cpanel_url}
            secretRef: cert-manager/cpanel-credentials