Enable Built-in k3s Features (Traefik, Helm-Chart-Controller) #39

gthieleb · 2025-09-17T08:25:45Z

Because we want to use argocd to bootstrap clusters and rely on some existing functionality of k3s we want to extend this by enabling built-in k3s features.

This change should carefully extend the core functionality of this module without breaking its guiding principles.

…onfig

…ommand

jceb · 2025-09-26T07:44:52Z

Thank you for the PR. I want to review the PR in more detail. In general, you are able to adjust k3s parameters via the additional parameters variable. However, I do see its limitations and am happy to consider a different configuration mechanism.

gthieleb · 2025-09-30T18:18:56Z

@jceb Thank you for your response. I am happy to discuss the feature and improvements. If its fine lets schedule a short call.

jceb

Thank you for the effort and please excuse the delay in getting back to you! The PR is on a good track. We do need to simplify it more so that the user is presented with a clean interface for managing a super custom configuration of the cluster. I made a number of commits below. Please have a look.

I was thinking in a similar but slightly different direction when it comes to a super custom configuration of the cluster. My idea was to allow the user to just specify a completely custom configuration, turn it into YAML and store it here: https://docs.k3s.io/installation/configuration#configuration-file.

We store the default config in /etc/rancher/k3s/config.yaml.d/00-default.yaml, use flags only for the most crucial settings that must be defined, and place the user's configuration in /etc/rancher/k3s/config.yaml.d/10-user.yaml. We could also provide additional configurations per node pool, that are placed in /etc/rancher/k3s/config.yaml.d/20-nodepool.yaml with variable replacement in values, e.g. NODE is replaced by the actual node name.

What do you think about this idea? This would simplify the interface and allow the user to completely customize the cluster at the cost of accidentally building a foot-gun.

jceb · 2026-01-24T13:28:59Z

variables.tf

  default     = ""
 }

+variable "k3s_features" {


Can we combine the two lists? I'd prefer to only have one list that lists all the features that the user wants to enable, including the custom configuration.

We could mark the custom_config as optional(string) to reduce the noise.

We should also include a validation of the supported feature names so that users are warned when they're trying to configure an unsupported feature.

Is it a good idea to let users configure the cloud-controller feature? I'm not 100% sure about network-policy but isn't this taken care of by cilium and it wouldn't make sense to enable this feature?

Will we keep the k3s_features variable together with the config file approach? If yes I would remove the custom_config here.

jceb · 2026-01-24T13:31:49Z

variables.tf

 }

+variable "k3s_features" {
+  description = "Configurable k3s features that can be enabled or disabled. Each feature can have enabled flag and optional custom configuration content that will be written to /etc/rancher/k3s/{feature}-config.yaml"


Suggested change

description = "Configurable k3s features that can be enabled or disabled. Each feature can have enabled flag and optional custom configuration content that will be written to /etc/rancher/k3s/{feature}-config.yaml"

description = "Configurable k3s features that can be enabled or disabled. Each feature has an enabled flag and optional custom configuration content"

jceb · 2026-01-24T13:32:54Z

README.md


 ## Configuration

+### Enabling k3s Features


Suggested change

### Enabling k3s Features

### Enabling additional k3s Features

jceb · 2026-01-24T13:35:52Z

README.md


+### Enabling k3s Features
+
+k3s comes with various features by default, which are **disabled by default** in this Terraform module to ensure maximum control and flexibility. These features can be enabled as needed using the `k3s_features` variable:


Suggested change

k3s comes with various features by default, which are **disabled by default** in this Terraform module to ensure maximum control and flexibility. These features can be enabled as needed using the `k3s_features` variable:

terraform-hcloud-k3s provides a fully functional default configuration. Enabling additional features requires a comprehensive understanding of how k3s is configured and is an advanced use case! Features can be enabled as needed using the `k3s_features` variable:

jceb · 2026-01-24T13:36:43Z

README.md

+k3s comes with various features by default, which are **disabled by default** in this Terraform module to ensure maximum control and flexibility. These features can be enabled as needed using the `k3s_features` variable:
+
+**Available Features:**
+- **Traefik Ingress Controller**: Can be enabled for ingress management


Suggested change

- **Traefik Ingress Controller**: Can be enabled for ingress management

- **traefik**: Enable to use the built-in Traefik ingress controller

jceb · 2026-01-24T13:40:18Z

README.md

+- **ServiceLB Load Balancer**: Can be enabled for simple load balancing
+- **Local Storage Provider**: Can be enabled for local storage provisioning
+- **Metrics Server**: Installed separately as Helm Chart for better control
+- **Network Policy Controller**: Cilium is used as network plugin


Suggested change

- **Network Policy Controller**: Cilium is used as network plugin

jceb · 2026-01-24T13:42:28Z

README.md

+- **Local Storage Provider**: Can be enabled for local storage provisioning
+- **Metrics Server**: Installed separately as Helm Chart for better control
+- **Network Policy Controller**: Cilium is used as network plugin
+- **Kube-proxy**, **Helm Controller**, **Cloud Controller**: Additional configurable features


Suggested change

- **Kube-proxy**, **Helm Controller**, **Cloud Controller**: Additional configurable features

- **kube-proxy**: Is enabled by default, a custom configuration can be provided

- **helm-controller**: Enable to install the built-in helm controller

jceb · 2026-01-24T13:45:14Z

README.md

-   4. [Persistent Volume Encryption](#persistent-volume-encryption)
-   5. [Adjust Sysctl Parameters](#adjust-sysctl-parameters)
-   6. [Private Registry Access](#private-registry-access)
+   1. [Enabling k3s Features](#enabling-k3s-features)


Please move this section to the bottom of the configuration chapter since it's a very advanced topic.

jceb · 2026-01-24T13:46:57Z

README.md

+
+## Variables
+
+### `k3s_feature_list` and `k3s_disable_flags`


Let's have just one feature list. Everything happens in there: enabling, disabling.

jceb · 2026-01-24T13:47:42Z

README.md

+
+The variable `k3s_feature_list` defines which features are evaluated for enabling or disabling within the cluster.
+
+Terraform generates `k3s_disable_flags` automatically from this list combined with the `local.k3s_features` map:


Too much detail, the user should not be force to know how the internals of the module work, e.g. local.k3s_features.

gthieleb · 2026-01-28T12:24:39Z

@jceb I agree with the file-based approach. Will implement:

Keep essential CLI flags (--server, --token, etc.)
Module defaults in 00-default.yaml
User customizations in 10-user.yaml
Node-specific config in 20-nodepool.yaml with variable replacement
Remove custom_config complexity

GitOps users will handle HelmChartConfig separately anyway. Will rework the PR accordingly.

…onfig

…ommand

… into feature/k3s-features

gthieleb changed the title ~~Enable Built-in k3s Features (Traefik, Helm-Chart-Controller)~~ Draft: Enable Built-in k3s Features (Traefik, Helm-Chart-Controller) Sep 19, 2025

gthieleb added 2 commits September 20, 2025 09:21

feat: add k3s feature management and debugging options in Terraform c…

2c87744

…onfig

move cloudinit to locals block for debugging purpose

9a42289

gthieleb force-pushed the feature/k3s-features branch from e5f3c16 to 9a42289 Compare September 20, 2025 07:21

feat: add clusterId to hcloud-cloud-controller-manager installation c…

e5c6016

…ommand

gthieleb changed the title ~~Draft: Enable Built-in k3s Features (Traefik, Helm-Chart-Controller)~~ Enable Built-in k3s Features (Traefik, Helm-Chart-Controller) Sep 23, 2025

Merge branch 'identiops:main' into feature/k3s-features

a95ceaa

jceb requested changes Jan 24, 2026

View reviewed changes

gthieleb force-pushed the feature/k3s-features branch from 450a510 to a95ceaa Compare January 28, 2026 12:44

gthieleb added 5 commits January 28, 2026 13:44

feat: add k3s feature management and debugging options in Terraform c…

3eb6425

…onfig

move cloudinit to locals block for debugging purpose

9aaf605

feat: add clusterId to hcloud-cloud-controller-manager installation c…

8803154

…ommand

Merge remote-tracking branch 'refs/remotes/fork/feature/k3s-features'…

d2e0f2b

… into feature/k3s-features

Apply jceb's review suggestions for k3s features

76a7ff0

	description = "Configurable k3s features that can be enabled or disabled. Each feature can have enabled flag and optional custom configuration content that will be written to /etc/rancher/k3s/{feature}-config.yaml"
	description = "Configurable k3s features that can be enabled or disabled. Each feature has an enabled flag and optional custom configuration content"

	### Enabling k3s Features
	### Enabling additional k3s Features


		### Enabling k3s Features

		k3s comes with various features by default, which are disabled by default in this Terraform module to ensure maximum control and flexibility. These features can be enabled as needed using the `k3s_features` variable:

	k3s comes with various features by default, which are disabled by default in this Terraform module to ensure maximum control and flexibility. These features can be enabled as needed using the `k3s_features` variable:
	terraform-hcloud-k3s provides a fully functional default configuration. Enabling additional features requires a comprehensive understanding of how k3s is configured and is an advanced use case! Features can be enabled as needed using the `k3s_features` variable:

	- Traefik Ingress Controller: Can be enabled for ingress management
	- traefik: Enable to use the built-in Traefik ingress controller

	- Kube-proxy, Helm Controller, Cloud Controller: Additional configurable features
	- kube-proxy: Is enabled by default, a custom configuration can be provided
	- helm-controller: Enable to install the built-in helm controller


		The variable `k3s_feature_list` defines which features are evaluated for enabling or disabling within the cluster.

		Terraform generates `k3s_disable_flags` automatically from this list combined with the `local.k3s_features` map:

Enable Built-in k3s Features (Traefik, Helm-Chart-Controller) #39

Are you sure you want to change the base?

Enable Built-in k3s Features (Traefik, Helm-Chart-Controller) #39

Uh oh!

Conversation

gthieleb commented Sep 17, 2025

Uh oh!

jceb commented Sep 26, 2025

Uh oh!

gthieleb commented Sep 30, 2025

Uh oh!

jceb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gthieleb commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants