bzub

Talos + Sidero + SideroLink Notes

Goals

1. Better understand how Talos server lifecycles work when managed by Sidero and ClusterAPI.
2. Determine security best practices.
3. Contribute issues and documentation based on what is found.

Research

bzub

Sidero Hacks

Delete Cluster, Keep PKI

You just need to keep the CLUSTER_NAME-ca and CLUSTER_NAME-talos secrets around.

To do this you an remove the owner reference from them.

cluster_name="example-cluster"

bzub

# nothing

bzub

#!/usr/bin/env sh
set -e

command="${1}"
usage="${0} start|stop"

if [ -z "${command}" ]; then
	echo "ERROR: command argument required. [start|stop]"
	echo "${usage}"
	exit 1

bzub

	{`nested associative -- add same name, different path`,
		`
kind: Deployment
volumes:
- name: vol1
  projected:
    sources:
    - secret:
        name: source1
        optional: false

bzub

package main

import (
	"fmt"
	"os"

	"sigs.k8s.io/kustomize/kyaml/yaml"
)

func main() {

bzub

Examples

• https://github.com/bzub/kustomizable
• https://github.com/ioandr/kustomize-example
• https://github.com/kbst/multi-cluster-multi-tenant-kustomize

Kustomize plugins in the wild

• https://github.com/goabout/kustomize-sopssecret-plugin

bzub

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v  -timeout 240m
=== RUN   TestPluginVersion
--- PASS: TestPluginVersion (0.00s)
PASS
ok  	github.com/terraform-providers/terraform-provider-acme	0.013s
=== RUN   TestResourceACMERegistrationMigrateState
2019/01/14 03:59:39 [DEBUG] Migrating acme_registration state: old v0 state: &terraform.InstanceState{ID:"regurl", Attributes:map[string]string{"registration_body":"regbody", "registration_url":"https://acme-staging.api.letsencrypt.org/acme/reg/123456789", "registration_new_authz_url":"https://acme-staging.api.letsencrypt.org/acme/new-authz", "registration_tos_url":"https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf", "server_url":"https://acme-staging.api.letsencrypt.org/directory", "account_key_pem":"key", "email_address":"[email protected]"}, Ephemeral:terraform.EphemeralState{ConnInfo:map[string]string(nil), Type:""}, Meta:map[string]interface {}(nil), Tainted:false, mu:sync.Mutex{

bzub

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v  -timeout 240m
=== RUN   TestPluginVersion
--- PASS: TestPluginVersion (0.00s)
PASS
ok  	github.com/terraform-providers/terraform-provider-acme	0.013s
=== RUN   TestResourceACMERegistrationMigrateState
2019/01/14 01:48:06 [DEBUG] Migrating acme_registration state: old v0 state: &terraform.InstanceState{ID:"regurl", Attributes:map[string]string{"registration_tos_url":"https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf", "server_url":"https://acme-staging.api.letsencrypt.org/directory", "account_key_pem":"key", "email_address":"[email protected]", "registration_body":"regbody", "registration_url":"https://acme-staging.api.letsencrypt.org/acme/reg/123456789", "registration_new_authz_url":"https://acme-staging.api.letsencrypt.org/acme/new-authz"}, Ephemeral:terraform.EphemeralState{ConnInfo:map[string]string(nil), Type:""}, Meta:map[string]interface {}(nil), Tainted:false, mu:sync.Mutex{

bzub

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v  -timeout 240m
=== RUN   TestPluginVersion
--- PASS: TestPluginVersion (0.00s)
PASS
ok  	github.com/terraform-providers/terraform-provider-acme	(cached)
=== RUN   TestResourceACMERegistrationMigrateState
2019/01/14 00:21:28 [DEBUG] Migrating acme_registration state: old v0 state: &terraform.InstanceState{ID:"regurl", Attributes:map[string]string{"account_key_pem":"key", "email_address":"[email protected]", "registration_body":"regbody", "registration_url":"https://acme-staging.api.letsencrypt.org/acme/reg/123456789", "registration_new_authz_url":"https://acme-staging.api.letsencrypt.org/acme/new-authz", "registration_tos_url":"https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf", "server_url":"https://acme-staging.api.letsencrypt.org/directory"}, Ephemeral:terraform.EphemeralState{ConnInfo:map[string]string(nil), Type:""}, Meta:map[string]interface {}(nil), Tainted:false, mu:sync.Mute