Project Documentation Index

Welcome to the documentation for the OCI-Managed On-Prem Talos Cluster. This cluster represents a modern, zero-trust approach to bare-metal Kubernetes management.

Documentation Modules

1. Architecture Overview
   • High-level topology and design principles.
   • Tailscale integration and Sidero logic.
2. Sidero Infrastructure Setup
   • OCI NLB and Tailscale service exposure.
   • Provider configuration and environment variables.
3. Networking & Bootstrapping
   • PXE-over-Tailscale flow.
   • OPNsense configuration requirements.
   • Tailscale Operator strategy.
4. OPNsense Bridge Guide
   • DHCP/PXE relay settings.
   • Tailscale Subnet Router configuration.
   • Firewall rules for SideroLink and TFTP.
5. Provisioning & Lifecycle
   • CAPI CRD structure.
   • Talos configuration patches (SATA/NVME split).
   • Upgrade and scaling procedures.
6. Security Hardening
   • Protecting the Sidero Metadata service.
   • Mitigating pod-level config exfiltration.

Quick Start for Engineers

Prerequisites

• Access to the OCI Management Cluster.
• clusterctl and talosctl installed locally.
• A Tailscale AuthKey (reusable/ephemeral) for new nodes.

Monitoring Provisioning

# Watch servers appearing from on-prem
kubectl get servers.sidero.dev -A

# Watch the CAPI machine state
kubectl get machines -A

# Check Tailnet status
tailscale status

Accessing the Cluster

The cluster API is exposed via the Tailscale Operator. Ensure your local machine is on the same Tailnet and use the generated Kubeconfig:

export KUBECONFIG=onprem-cluster.kubeconfig
kubectl get nodes