From af2b40be9fc08a133d23838fa79df2d24d18faeb Mon Sep 17 00:00:00 2001 From: Timofei Larkin Date: Sat, 25 Jul 2026 02:40:10 +0300 Subject: [PATCH] docs(kubernetes): re-home talos-reconcile comments after split Three template comments in the control-plane chart still described the talos-reconcile Job as living here, but the worker split moved it to the kubernetes-nodes chart (one run per pool release): - talos-pki.yaml pointed at "the routing note in talos-reconcile-job.yaml", a file this chart no longer contains. - cluster.yaml said "the talos-reconcile main-phase Job re-patches certSANs" as if this chart still runs it; it now also states the consequence the kubernetes-nodes side already documents -- the ClusterIP SAN arrives only through a pool and a pool-less cluster keeps DNS SANs only, a best-effort extra that nothing depends on. - cilium.yaml credited the /etc/hosts seeding to the same Job without naming its new home; it also now notes why the entry is always present wherever Cilium runs (workers only exist through pools). Comments only ({{/* */}} blocks, stripped at render time); no manifest output changes, pinned by the chart's unittest suite staying green. Assisted-By: Claude Signed-off-by: Timofei Larkin --- packages/apps/kubernetes/templates/cluster.yaml | 11 ++++++++--- .../kubernetes/templates/helmreleases/cilium.yaml | 15 ++++++++------- .../kubernetes/templates/talos/talos-pki.yaml | 5 +++-- 3 files changed, 19 insertions(+), 12 deletions(-) diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml index 5f3ded9f2..436eab7d1 100644 --- a/packages/apps/kubernetes/templates/cluster.yaml +++ b/packages/apps/kubernetes/templates/cluster.yaml @@ -286,9 +286,14 @@ spec: protocol: TCP {{- /* Initial render lists only the DNS SANs because the apiserver Service ClusterIP is not yet allocated when Helm executes the - template. The talos-reconcile main-phase Job re-patches certSANs - with the live ClusterIP once Kamaji emits the Service, and - Kamaji then re-issues the apiserver TLS cert to cover it. */}} + template. Since the worker split, the talos-reconcile Job that + re-patches certSANs with the live ClusterIP (after which Kamaji + re-issues the apiserver TLS cert) runs in each kubernetes-nodes + pool release, not in this chart: a cluster with at least one pool + gains the ClusterIP SAN once Kamaji emits the Service, while a + pool-less cluster keeps DNS SANs only. That is a best-effort + extra, not a dependency -- workers dial the apiserver by DNS name + via extraHostEntries, so nothing requires the IP SAN. */}} certSANs: - {{ printf "%s.%s.svc" .Release.Name .Release.Namespace }} - {{ printf "%s.%s.svc.%s" .Release.Name .Release.Namespace (include "kubernetes.tenantClusterDomain" .) }} diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml index 24698c874..f0a380396 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml @@ -1,12 +1,13 @@ {{- define "cozystack.defaultCiliumValues" -}} {{- /* Cilium runs hostNetwork on the Talos worker nodes and resolves the - apiserver via the worker's /etc/hosts, which the talos-reconcile - main-phase Job seeds with the Kamaji Service ClusterIP under - ..svc through machine.network.extraHostEntries. So a - plain DNS host works here without a lookup-and-reuse race: the - cert covers the same DNS name from chart render time, and the - hosts entry is set well before kubelet (and therefore Cilium) - comes up on the node. */}} + apiserver via the worker's /etc/hosts, which the kubernetes-nodes + chart's talos-reconcile Job seeds with the Kamaji Service ClusterIP + under ..svc through machine.network.extraHostEntries + (workers only exist through pools, so every node Cilium runs on has + the entry). So a plain DNS host works here without a + lookup-and-reuse race: the cert covers the same DNS name from chart + render time, and the hosts entry is set well before kubelet (and + therefore Cilium) comes up on the node. */}} cilium: k8sServiceHost: {{ printf "%s.%s.svc" .Release.Name .Release.Namespace }} k8sServicePort: 6443 diff --git a/packages/apps/kubernetes/templates/talos/talos-pki.yaml b/packages/apps/kubernetes/templates/talos/talos-pki.yaml index 17ee8459e..ceab17b7d 100644 --- a/packages/apps/kubernetes/templates/talos/talos-pki.yaml +++ b/packages/apps/kubernetes/templates/talos/talos-pki.yaml @@ -76,8 +76,9 @@ spec: Workers reach trustd via the Service DNS name (the worker's machine.network.extraHostEntries injects the ClusterIP into /etc/hosts), so the cert never needs an IP SAN patched in after the - ClusterIP becomes known — see the routing note in - talos-reconcile-job.yaml. */}} + ClusterIP becomes known — see the routing note in the kubernetes-nodes + chart's talos-reconcile-job.yaml, where the Job lives since the worker + split. */}} issuerRef: name: {{ .Release.Name }}-talos-ca kind: Issuer