talosgenerator

type Config struct {
	// PatchesDir is the root directory for Talos patches.
	PatchesDir string
	// MirrorRegistries contains mirror registry specifications in "host=upstream" format.
	// Example: ["docker.io=https://registry-1.docker.io"]
	MirrorRegistries []string
	// WorkerNodes is the number of worker nodes configured.
	// When 0 (default), generates allow-scheduling-on-control-planes.yaml.
	WorkerNodes int
	// DisableDefaultCNI indicates whether to disable Talos's default CNI (Flannel).
	// When true, generates a disable-default-cni.yaml patch to set cluster.network.cni.name to "none".
	// This is required when using an alternative CNI like Cilium.
	DisableDefaultCNI bool
	// EnableKubeletCertRotation indicates whether to enable kubelet serving certificate rotation.
	// When true, generates a kubelet-cert-rotation.yaml patch with rotate-server-certificates: true.
	// This is required for secure metrics-server communication using TLS.
	EnableKubeletCertRotation bool
	// ClusterName is an optional explicit cluster name override.
	// When set, generates a cluster-name.yaml patch to set cluster.clusterName.
	// This name is used for the kubeconfig context (admin@<name>).
	ClusterName string
	// EnableImageVerification indicates whether to generate an ImageVerificationConfig template.
	// When true, generates an image-verification.yaml document with a default skip-all rule
	// and commented examples for keyless (Cosign/OIDC) and public key verification.
	// This requires Talos 1.13+.
	EnableImageVerification bool
	// DisableCDI indicates whether to generate a patch that disables CDI.
	// When true, generates a disable-cdi.yaml patch to set machine.features.enableCDI to false.
	// Talos 1.13+ enables CDI by default, so this patch is only needed when CDI should be turned off.
	DisableCDI bool
	// EnableExternalCloudProvider indicates whether to enable the external cloud provider.
	// When true, generates an external-cloud-provider.yaml patch that sets
	// cluster.externalCloudProvider.enabled to true and machine.kubelet.extraArgs.cloud-provider
	// to "external". This is required for Hetzner Cloud so that the Cloud Controller Manager
	// can initialize nodes with a providerID and the CSI driver can schedule.
	// See: https://www.talos.dev/latest/kubernetes-guides/configuration/cloud-provider/
	EnableExternalCloudProvider bool
	// EnableIngressFirewall indicates whether to generate Talos ingress firewall documents.
	// When true, generates NetworkDefaultActionConfig (ingress: block) and per-role
	// NetworkRuleConfig documents for defense-in-depth at the OS level.
	// Requires the NetworkCIDR and CNIPort fields to be set.
	// See: https://www.talos.dev/latest/talos-guides/network/ingress-firewall/
	EnableIngressFirewall bool
	// NetworkCIDR is the cluster's private network CIDR, used to restrict
	// ingress firewall rules to cluster-internal traffic (e.g., "10.0.0.0/16").
	NetworkCIDR string
	// CNIPort is the CNI encapsulation port (e.g., 8472 for Cilium VXLAN, 4789 for Flannel/Calico).
	CNIPort int
}

type Generator struct{}