feat: rename talos folder

docs/talos/ingress.md

@@ -0,0 +1,55 @@
+# Ingress Controller
+
+Lets install an ingress controller (NGINX or Traefik) on a basic Talos Linux cluster.
+
+## NGINX (option 1)
+
+```shell
+# add worker labels (if needed)
+kubectl label node w-01 node-role.kubernetes.io/worker=""
+kubectl label node w-02 node-role.kubernetes.io/worker=""
+kubectl label node w-03 node-role.kubernetes.io/worker=""
+
+# add repo and install
+helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
+helm repo update
+helm install ingress-nginx ingress-nginx/ingress-nginx \
+  -n ingress-nginx --create-namespace \
+  --set controller.service.type=LoadBalancer \
+  --set controller.nodeSelector."node-role\.kubernetes\.io/worker"=""
+```
+
+### Uninstall NGINX
+
+```shell
+helm uninstall ingress-nginx -n ingress-nginx
+```
+
+## Traefik (option 2)
+
+```shell
+# add repo
+helm repo add traefik https://traefik.github.io/charts
+helm repo update
+
+# create traefik config
+cat <<EOF > traefik-values.yaml
+service:
+  type: LoadBalancer
+nodeSelector:
+  node-role.kubernetes.io/worker: ""
+additionalArguments:
+  - "--certificatesresolvers.letsencrypt.acme.email=your-email@domain.com"
+  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
+  - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+EOF
+
+# install
+helm install traefik traefik/traefik -n traefik-system --create-namespace -f traefik-values.yaml
+```
+
+### Uninstall Traefik
+
+```shell
+helm uninstall traefik -n traefik-system
+```

docs/talos/lb.md

@@ -0,0 +1,50 @@
+# Loadbalancer
+
+Lets install a loadbalancer (MetalLB) on a Talos Linux cluster.
+
+## MetalLB
+
+```shell
+# add repo and install
+helm repo add metallb https://metallb.github.io/metallb
+helm repo update
+helm install metallb metallb/metallb -n metallb-system --create-namespace --wait
+
+# fix pod security for speaker pods
+kubectl label namespace metallb-system pod-security.kubernetes.io/enforce=privileged
+kubectl label namespace metallb-system pod-security.kubernetes.io/audit=privileged
+kubectl label namespace metallb-system pod-security.kubernetes.io/warn=privileged
+
+# restart speaker daemonset
+kubectl rollout restart daemonset/metallb-speaker -n metallb-system
+```
+
+```shell
+# configure metallb
+cat <<EOF | kubectl apply -f -
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: ingress-pool
+  namespace: metallb-system
+spec:
+  addresses:
+  - 10.8.15.175/32
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: ingress-pool
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+  - ingress-pool
+EOF
+```
+
+### Uninstall MetalLB
+
+```shell
+helm uninstall metallb -n metallb-system
+```

docs/talos/service_account.md

@@ -0,0 +1,86 @@
+# Service Account
+
+Lets create a service account for ci/cd activities in a new namespace.
+
+## Namespace
+
+```yaml
+cat <<EOF | kubectl apply -f -
+---
+apiVersion: "v1"
+kind: "Namespace"
+metadata:
+  name: "my-namespace"
+EOF
+```
+
+## ServiceAccount
+
+```yaml
+cat <<EOF | kubectl apply -f -
+---
+apiVersion: "v1"
+kind: "ServiceAccount"
+metadata:
+  name: "buzz"
+  namespace: "my-namespace"
+EOF
+```
+
+## Role
+
+```yaml
+cat <<EOF | kubectl apply -f -
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "Role"
+metadata:
+  namespace: "my-namespace"
+  name: "buzz-role"
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources: ["services", "configmaps", "secrets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["networking.k8s.io"]
+  resources: ["ingresses"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+EOF
+```
+
+## RoleBinding
+
+```yaml
+cat <<EOF | kubectl apply -f -
+---
+apiVersion: "rbac.authorization.k8s.io/v1"
+kind: "RoleBinding"
+metadata:
+  name: "buzz-binding"
+  namespace: "my-namespace"
+subjects:
+- kind: "ServiceAccount"
+  name: "buzz"
+  namespace: "my-namespace"
+roleRef:
+  kind: "Role"
+  name: "buzz-role"
+  apiGroup: "rbac.authorization.k8s.io"
+EOF
+```
+
+## Token and KubeConfig (OmnI)
+
+Get the token for the user.
+
+```shell
+kubectl create token buzz -n my-namespace
+```
+
+When using OmnI you can get the service account details (kubeconfig) using the following command;
+
+```shell
+omnictl kubeconfig --service-account -c <cluster-name> --user buzz /tmp/buzz-kubeconfig.yaml
+```