From eb15ae041c02612a0d426a6321a53ae71931b52e Mon Sep 17 00:00:00 2001
From: karteekiitg <120569182+karteekiitg@users.noreply.github.com>
Date: Thu, 17 Apr 2025 14:51:38 +0530
Subject: [PATCH] refactor: readme, gitignore and talos_machine_config_version
 changes

Signed-off-by: Karteek <120569182+karteekiitg@users.noreply.github.com>
---
 .gitignore                                |  3 +-
 tofu/kubernetes/README.md                 | 50 +++++++++++++++++++++--
 tofu/kubernetes/talos/config.tf           |  2 +-
 tofu/kubernetes/talos_cluster.auto.tfvars |  3 +-
 4 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6e7de19..495d3f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ output
 
 *secret*.tfvars
 *secret*.tfvars.json
+!sealed-secrets.auto.tfvars
 
 *.lock.hcl
 
@@ -29,4 +30,4 @@ override.tf.json
 *.key
 
 *.pem
-*.crt
\ No newline at end of file
+*.crt
diff --git a/tofu/kubernetes/README.md b/tofu/kubernetes/README.md
index 4b8ddd1..5e17440 100644
--- a/tofu/kubernetes/README.md
+++ b/tofu/kubernetes/README.md
@@ -1,18 +1,32 @@
 # Kubernetes Tofu
 
+## Install pre-requisites
+1. [tofu](https://opentofu.org/docs/intro/install/)
+1. [talosctl](https://www.talos.dev/v1.9/talos-guides/install/talosctl/)
+1. [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
+
+## Initialize tofu
 ```shell
-tofu output -raw kube_config
-tofu output -raw talos_config
+tofu init
 ```
 
 ## Proxmox
 
-Environment variable
+### Environment variable
 
 ```shell
 export TF_VAR_proxmox_api_token="<YOUR_API_TOKEN>"
 ```
 
+### Optional External Secrets Manager / Other methods
+
+**Bitwarden Secrets Manager** - Name your secret TF_VAR_proxmox_api_token in bws.
+```shell
+bws run -- tofu ...
+```
+Note: By default the shell is sh. Change with --shell if required.
+
+
 ## Sealed-secrets
 
 Generate certificate
@@ -35,4 +49,32 @@ Output `talosconfig`
 
 ```shell
 tofu output -raw talos_config
-```
\ No newline at end of file
+```
+
+## Upgrading Talos and Kubernetes
+[Upgrade](https://blog.stonegarden.dev/articles/2024/08/talos-proxmox-tofu/#upgrading-the-cluster) talos nodes one by one.
+1. Set talos_image.auto.tfvars -> image -> update_version to the required update version.
+1. Set talos_cluster.auto.tfvars -> talos_cluster_config -> kubernetes_version to the required kubernetes version.
+1. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_1 -> update = true and run tofu apply.
+1. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_2 -> update = true, leave the previous nodes update = true and run tofu apply.
+1. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_3 -> update = true, leave the previous nodes update = true and run tofu apply.
+1. ...
+1. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_n -> update = true, leave the previous nodes update = true and run tofu apply.
+1. After upgrading all nodes, Set talos_image.auto.tfvars -> image -> version to match the update version and set update = false for all nodes.
+
+## Upgrading Talos Schematic
+
+1. Create a new schematic file.
+1. Same process as above instead of image.version and image.update_version, change image.schematic and image.update_schematic, in talos_image.auto.tfvars.
+
+## Upgrading Kubernetes Only
+
+Dry Run
+```shell
+sh upgrade-k8s.sh $CONTROLPLANE_NODE_IP --dry-run     # For testing
+```
+
+Upgrade
+```shell
+sh upgrade-k8s.sh $CONTROLPLANE_NODE_IP
+```
diff --git a/tofu/kubernetes/talos/config.tf b/tofu/kubernetes/talos/config.tf
index c331b89..9d6e34d 100644
--- a/tofu/kubernetes/talos/config.tf
+++ b/tofu/kubernetes/talos/config.tf
@@ -1,5 +1,5 @@
 resource "talos_machine_secrets" "this" {
-  talos_version = var.cluster.talos_machine_config_version
+  talos_version = var.cluster.talos_machine_config_version != null ? var.cluster.talos_machine_config_version : var.image.update_version
 }
 
 data "talos_client_configuration" "this" {
diff --git a/tofu/kubernetes/talos_cluster.auto.tfvars b/tofu/kubernetes/talos_cluster.auto.tfvars
index bed3950..99ceebc 100644
--- a/tofu/kubernetes/talos_cluster.auto.tfvars
+++ b/tofu/kubernetes/talos_cluster.auto.tfvars
@@ -10,7 +10,8 @@ talos_cluster_config = {
   gateway                      = "192.168.1.1"
   # The version of talos features to use in generated machine configuration. Generally the same as image version.
   # See https://github.com/siderolabs/terraform-provider-talos/blob/main/docs/data-sources/machine_configuration.md
-  talos_machine_config_version = "v1.9.2"
+  # Uncomment to use this instead of version from talos_image.
+  # talos_machine_config_version = "v1.9.2"
   proxmox_cluster              = "homelab"
   kubernetes_version = "1.32.0"  # renovate: github-releases=kubernetes/kubernetes
   cilium = {