simu · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -1,5 +1,83 @@
 parameters:
   talos_capi_cluster_cloudscale:
     =_metadata:
+      multi_instance: true
       multi_tenant: true
-    namespace: syn-talos-capi-cluster-cloudscale
+    namespace: syn-cluster-api
+
+    clusterName: ${cluster:name}
+
+    # TODO(sg): how will updates work with CAPI?
+    # IMPORTANT: this is only used for ensuring CAPI renders a suitable
+    # MachineConfig and isn't used to define the cluster's actual Talos
+    # version (at least when using the OpenStack raw image from the image
+    # factory).
+    talosVersion: '1.13'
+    # NOTE(sg): this is the well-known default schematic UUID
+    talosSchematicUUID: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba
+    kubernetesVersion: 'v1.36.1'
+    apiURL: ""
+
+    cni: cilium
+
+    cloudscale:
+      # TODO(sg): document this
+      customImageSlug: talos-v${talos_capi_cluster_cloudscale:talosVersion}-37656798
+      # TODO(sg): decide on default sizing
+      privateNetwork:
+        # TODO(sg): does this need to match the privnet name on cloudscale?
+        name: privnet-${talos_capi_cluster_cloudscale:clusterName}
+        uuid: TO_BE_REPLACED
+      region: ${facts:region}
+
+    controlPlane:
+      count: 1
+      flavor: plus-16-4
+      rootVolumeSize: 50
+
+    workerGroups:
+      worker:
+        count: 1
+        flavor: plus-16-4
+        rootVolumeSize: 50
+
+    cluster:
+      spec:
+        clusterNetwork:
+          pods:
+            cidrBlocks:
+              - 10.128.0.0/14
+          services:
+            cidrBlocks:
+              - 172.30.0.0/16
+          serviceDomain: cluster.local
+
+    cloudscaleCluster:
+      spec:
+        region: ${talos_capi_cluster_cloudscale:cloudscale:region}
+        credentialsRef:
+          # TODO(sg): figure out the real default name here.
+          name: cloudscale-credentials
+
+    talosControlPlane:
+      metadata: {}
+      spec: {}
+      strategicPatches: {}
+
+    talosStrategicPatches: {}
+
+    kubernetesApiServer:
+      authenticationConfigurationJWT: {}
+
+    ## Temporary config for user kubeconfig service
+    images:
+      caddy:
+        registry: docker.io
+        repository: caddy/caddy
+        tag: 2.11.4-alpine
+    kubeconfig:
+      serverURL: ""
+      ingressAnnotations: {}
+      oidc:
+        issuerURL: ""
+        clientId: ""
diff --git a/class/talos-capi-cluster-cloudscale.yml b/class/talos-capi-cluster-cloudscale.yml
@@ -7,5 +7,6 @@ parameters:
         output_path: .
       - input_paths:
           - ${_base_directory}/component/main.jsonnet
+          - ${_base_directory}/component/user-kubeconfig.jsonnet
         input_type: jsonnet
         output_path: talos-capi-cluster-cloudscale/
diff --git a/component/app.jsonnet b/component/app.jsonnet
@@ -3,7 +3,23 @@ local inv = kap.inventory();
 local params = inv.parameters.talos_capi_cluster_cloudscale;
 local argocd = import 'lib/argocd.libjsonnet';
 
-local app = argocd.App('talos-capi-cluster-cloudscale', params.namespace);
+local app = argocd.App('talos-capi-cluster-cloudscale', params.namespace) {
+  spec+: {
+    ignoreDifferences+: [
+      {
+        group: 'cluster.x-k8s.io',
+        kind: 'MachineDeployment',
+        jsonPointers: [ '/spec/replicas' ],
+      },
+    ],
+    syncPolicy+: {
+      syncOptions+: [
+        'RespectIgnoreDifferences=true',
+        'ServerSideApply=true',
+      ],
+    },
+  },
+};
 
 local appPath =
   local project = std.get(std.get(app, 'spec', {}), 'project', 'syn');

diff --git a/component/assets/user-kubeconfig-index.html b/component/assets/user-kubeconfig-index.html
@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>{{ env "CLUSTER_NAME" }} Kubeconfig</title>
+    <style>
+      body {
+        font-family: 'sans-serif';
+        width: 50%;
+        margin: 0 auto;
+      }
+
+      pre {
+        font-size: 120%;
+        display: block;
+        background: #ddd;
+        border: 1px solid #333;
+        white-space: pre-wrap;
+        word-wrap: break-word;
+        padding: 1ex;
+      }
+      code {
+        user-select: all;
+      }
+      ol {
+        padding: 0 1.5em;
+      }
+      li > code {
+        font-size: 120%;
+      }
+
+      * :has(> [class="copy"]) {
+        position: relative;
+      }
+
+      [class="copy"]::after {
+        content: "[copy]";
+        position: absolute;
+        right: 6.5em;
+        top: 0;
+        margin: 0.5em;
+      }
+      li [class="copy"]::after {
+        right: 0;
+      }
+      li {
+        margin: 0.7ex 0;
+      }
+      li > pre {
+        margin-top: 0.5ex;
+        margin-bottom: 0.5ex;
+      }
+
+      a.download {
+        position: absolute;
+        right: 0;
+        top: 0;
+        margin: 0.5em;
+        color: black;
+        text-decoration: none;
+      }
+
+      a.download:hover {
+        font-weight: bold;
+      }
+
+      [class="copy"]:hover::after {
+        font-weight: bold;
+        cursor: pointer;
+      }
+
+      .copied > [class="copy"]::after {
+        content: "[copied]";
+      }
+    </style>
+    <script>
+      window.onload = () => {
+        document.querySelectorAll('[class="copy"]').forEach($el =>
+          $el.addEventListener('click', async ($el) => {
+            const $node = $el.target;
+            const content = $node.textContent;
+            try {
+              await navigator.clipboard.writeText(content);
+            } catch (error) {
+              console.error(error.message);
+            }
+            $node.parentNode.classList.add('copied');
+            setTimeout(($n => () => $n.classList.remove('copied'))($node.parentNode), 1000);
+          })
+        );
+      }
+    </script>
+  </head>
+  <body>
+    <h1>{{ env "CLUSTER_NAME" }} Kubeconfig</h1>
+    <p>
+      <!-- NOTE(sg): the whole <pre> contents must be in a single line to not mess up the formatting! -->
+      <pre><a class="download" href="./kubeconfig" download="{{ env "CLUSTER_NAME" }}.kubeconfig">[download]</a><code class="copy">{{- readFile "kubeconfig" -}}</code></pre>
+    </p>
+    <h1>First time setup</h1>
+    <ol>
+      <li>Make sure you have a recent <code>kubectl</code> installed. See the <a href="https://kubernetes.io/docs/tasks/tools/#kubectl">upstream docs</a> for install instructions.</li>
+      <li>Download the <code>kubectl</code> <a href="https://github.com/int128/kubelogin#setup" target="_blank">kubelogin</a> plugin and ensure it&rsquo;s available in your <code>$PATH</code> as <code>kubectl-oidc_login</code></li>
+      <li>Verify that the plugin is available.<br/>
+        <pre class="li"><code class="copy">kubectl oidc-login --version</code></pre>
+      </li>
+      <li>Download this cluster&rsquo;s <a href="./kubeconfig" download="{{ env "CLUSTER_NAME" }}.kubeconfig">kubeconfig</a></li>
+      <li>Set the <code>$KUBECONFIG</code> environment variable<br/>
+        <pre class="li"><code class="copy">export KUBECONFIG=~/Downloads/{{ env "CLUSTER_NAME" }}.kubeconfig</code></pre>
+      </li>
+      <li>Test access<br/>
+        <pre class="li"><code class="copy">kubectl auth whoami</code></pre>
+        If everything is setup correctly, this should authenticate you with your VSHN account in your browser and then show some details about your user.
+      </li>
+    </ol>
+  </body>
+</html>
diff --git a/component/espejote-templates/kubeconfig-ca-manager.jsonnet b/component/espejote-templates/kubeconfig-ca-manager.jsonnet
@@ -0,0 +1,121 @@
+local esp = import 'espejote.libsonnet';
+
+local config = import 'capi-kubeconfig-ca-manager/config.json';
+
+local kubeconfig =
+  local kcs = esp.context().kubeconfig;
+  assert std.length(kcs) == 1 : 'Expected kubeconfig context to have length 1';
+  assert std.objectHas(kcs[0].data, 'value') : 'Expected kubeconfig secret to have field `value`';
+  std.parseYaml(std.base64Decode(kcs[0].data.value));
+
+local cluster_ca = std.base64Decode(
+  kubeconfig.clusters[0].cluster['certificate-authority-data']
+);
+
+local user_kubeconfig =
+  local contextName = 'oidc@%s' % kubeconfig.clusters[0].name;
+  {
+    apiVersion: 'v1',
+    kind: 'Config',
+    clusters: [
+      kubeconfig.clusters[0] {
+        cluster+: {
+          [if config.apiURL != '' then 'server']:
+            'https://%s:6443' % config.apiURL,
+        },
+      },
+    ],
+    contexts: [
+      {
+        context: {
+          cluster: kubeconfig.clusters[0].name,
+          user: 'oidc',
+        },
+        name: contextName,
+      },
+    ],
+    'current-context': contextName,
+    users: [
+      {
+        name: 'oidc',
+        user: {
+          exec: {
+            apiVersion: 'client.authentication.k8s.io/v1beta1',
+            args: [
+              'oidc-login',
+              'get-token',
+              '--oidc-issuer-url=%s' % config.oidcIssuerURL,
+              '--oidc-client-id=%s' % config.oidcClientId,
+              '--oidc-extra-scope=email offline_access profile openid',
+            ],
+            command: 'kubectl',
+            interactiveMode: 'IfAvailable',
+            provideClusterInfo: false,
+          },
+        },
+      },
+    ],
+  };
+local index_html = importstr 'capi-kubeconfig-ca-manager/index.html';
+local caddy_json = importstr 'capi-kubeconfig-ca-manager/caddy.json';
+local confighash = std.sha256(
+  std.manifestJsonMinified(user_kubeconfig) + index_html + caddy_json
+);
+
+[
+  {
+    apiVersion: 'v1',
+    kind: 'ConfigMap',
+    metadata: {
+      name: config.dynfactConfigMapName,
+      namespace: 'syn',
+      labels: {
+        'app.kubernetes.io/managed-by': 'espejote',
+        'steward.syn.tools/include-facts': '',
+      },
+    },
+    data: {
+      facts: std.manifestJsonMinified({
+        talosAPICertificateAuthorityData:
+          kubeconfig.clusters[0].cluster['certificate-authority-data'],
+      }),
+    },
+  },
+  {
+    apiVersion: 'v1',
+    kind: 'ConfigMap',
+    metadata: {
+      name: config.caddyResourceName,
+      namespace: config.namespace,
+    },
+    data: {
+      // manifestYamlDoc doesn't add a trailing newline, so we do it
+      // ourselves.
+      kubeconfig: std.manifestYamlDoc(user_kubeconfig, quote_keys=false) + '\n',
+      'cluster-ca.crt': cluster_ca,
+      'index.html': index_html,
+      'caddy.json': caddy_json,
+    },
+  },
+  esp.applyOptions(
+    {
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      metadata: {
+        name: config.caddyResourceName,
+        namespace: config.namespace,
+      },
+      spec: {
+        template: {
+          metadata: {
+            annotations: {
+              ['%s.syn.tools/config-hash' % config.caddyResourceName]: confighash,
+            },
+          },
+        },
+      },
+    },
+    fieldManagerSuffix=':reloader',
+    force=true,
+  ),
+]