From e7ae04102145533f8c7899df431bbe202578d267 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sun, 23 Mar 2025 20:59:11 +0100
Subject: [PATCH] refactor(tofu): template kubelet args

---
 tofu/kubernetes/talos/config.tf                              | 1 +
 .../kubernetes/talos/machine-config/control-plane.yaml.tftpl | 4 +---
 tofu/kubernetes/talos/variables.tf                           | 1 +
 tofu/kubernetes/talos_cluster.auto.tfvars                    | 5 +++++
 tofu/kubernetes/variables.tf                                 | 1 +
 5 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/tofu/kubernetes/talos/config.tf b/tofu/kubernetes/talos/config.tf
index c9cdb59..350e165 100644
--- a/tofu/kubernetes/talos/config.tf
+++ b/tofu/kubernetes/talos/config.tf
@@ -57,6 +57,7 @@ data "talos_machine_configuration" "this" {
       vip          = var.cluster.vip
     }), each.value.machine_type == "controlplane" ?
       templatefile("${path.module}/machine-config/control-plane.yaml.tftpl", {
+        kubelet = var.cluster.kubelet
         api_server = var.cluster.api_server
         inline_manifests = jsonencode(terraform_data.cilium_bootstrap_inline_manifests.output)
       }) : ""
diff --git a/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl b/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
index 7ce67d0..5a63a70 100644
--- a/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
+++ b/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
@@ -1,8 +1,6 @@
 machine:
   kubelet:
-    extraArgs:
-      # Needed for Netbird agent https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
-      allowed-unsafe-sysctls: net.ipv4.conf.all.src_valid_mark
+    ${indent(4, kubelet)}
 
 cluster:
   allowSchedulingOnControlPlanes: true
diff --git a/tofu/kubernetes/talos/variables.tf b/tofu/kubernetes/talos/variables.tf
index deb868f..60114eb 100644
--- a/tofu/kubernetes/talos/variables.tf
+++ b/tofu/kubernetes/talos/variables.tf
@@ -23,6 +23,7 @@ variable "cluster" {
     talos_machine_config_version = optional(string)
     proxmox_cluster    = string
     kubernetes_version = string
+    kubelet = optional(string)
     api_server = optional(string)
     cilium = object({
       bootstrap_manifest_path = string
diff --git a/tofu/kubernetes/talos_cluster.auto.tfvars b/tofu/kubernetes/talos_cluster.auto.tfvars
index 85c7d88..340a1fe 100644
--- a/tofu/kubernetes/talos_cluster.auto.tfvars
+++ b/tofu/kubernetes/talos_cluster.auto.tfvars
@@ -17,6 +17,11 @@ talos_cluster_config = {
     bootstrap_manifest_path = "talos/inline-manifests/cilium-install.yaml"
     values_file_path        = "../../k8s/infra/network/cilium/values.yaml"
   }
+  kubelet = <<-EOT
+    extraArgs:
+      # Needed for Netbird agent https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
+      allowed-unsafe-sysctls: net.ipv4.conf.all.src_valid_mark
+  EOT
   api_server = <<-EOT
     extraArgs:
       oidc-issuer-url: "https://authelia.stonegarden.dev"
diff --git a/tofu/kubernetes/variables.tf b/tofu/kubernetes/variables.tf
index 750f651..41a4f74 100644
--- a/tofu/kubernetes/variables.tf
+++ b/tofu/kubernetes/variables.tf
@@ -39,6 +39,7 @@ variable "talos_cluster_config" {
     talos_machine_config_version = optional(string)
     proxmox_cluster    = string
     kubernetes_version = string
+    kubelet = optional(string)
     api_server = optional(string)
     cilium = object({
       bootstrap_manifest_path = string