docs-simoncor-net/docs/talos-linux/basics.md

Basics

Lets install a basic loadbalancer (MetalLB) and ingress controller (NGINX or Traefik) on a basic Talos Linux cluster using 3 dedicated (to be labelled) worker nodes.

MetalLB

# add repo and install
helm repo add metallb https://metallb.github.io/metallb
helm repo update
helm install metallb metallb/metallb -n metallb-system --create-namespace --wait

# fix pod security for speaker pods
kubectl label namespace metallb-system pod-security.kubernetes.io/enforce=privileged
kubectl label namespace metallb-system pod-security.kubernetes.io/audit=privileged
kubectl label namespace metallb-system pod-security.kubernetes.io/warn=privileged

# restart speaker daemonset
kubectl rollout restart daemonset/metallb-speaker -n metallb-system

# configure metallb
cat <<EOF | kubectl apply -f -
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: ingress-pool
  namespace: metallb-system
spec:
  addresses:
  - 10.8.15.175/32
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: ingress-pool
  namespace: metallb-system
spec:
  ipAddressPools:
  - ingress-pool
EOF

Uninstall MetalLB

helm uninstall metallb -n metallb-system

NGINX (option 1)

# add worker labels (if needed)
kubectl label node w-01 node-role.kubernetes.io/worker=""
kubectl label node w-02 node-role.kubernetes.io/worker=""
kubectl label node w-03 node-role.kubernetes.io/worker=""

# add repo and install
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install ingress-nginx ingress-nginx/ingress-nginx \
  -n ingress-nginx --create-namespace \
  --set controller.service.type=LoadBalancer \
  --set controller.nodeSelector."node-role\.kubernetes\.io/worker"=""

Uninstall NGINX

helm uninstall ingress-nginx -n ingress-nginx

Traefik (option 2)

# add repo
helm repo add traefik https://traefik.github.io/charts
helm repo update

# create traefik config
cat <<EOF > traefik-values.yaml
service:
  type: LoadBalancer
nodeSelector:
  node-role.kubernetes.io/worker: ""
additionalArguments:
  - "--certificatesresolvers.letsencrypt.acme.email=your-email@domain.com"
  - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
  - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
EOF

# install
helm install traefik traefik/traefik -n traefik-system --create-namespace -f traefik-values.yaml

Uninstall Traefik

helm uninstall traefik -n traefik-system