Talos components — maintainer guide
One short page per Kustomize component, for whoever operates this later. Everything runs on
con-prod (Gardener/Calico): the host runner and platform in namespace con-ci, the
container runner in its own namespace con-ci-oci. The con-prod overlay
(manifests/overlays/con-prod) is synced by the talos ArgoCD Application;
overlays/con-ci-oci by the talos-oci Application.
| Component | What it is | Label / role | Status |
|---|---|---|---|
| runner | host-backend forgejo-runner | con-ci |
live |
| runner-oci | rootless container-backend runner | con-ci-oci |
live (own overlay/namespace, GitOps via talos-oci) |
| runner-secrets | SOPS+age secrets (connection, signing key) | — | live (manual secret + encrypted-in-git) |
| egress | default-deny egress + squid FQDN proxy | — | live |
| isolation | east-west deny + ResourceQuota/LimitRange | — | live |
| runner-build | rootless buildah on the host runner | con-ci |
dormant (builds moved to con-ci-oci, 2026-07-04) |
| gitops-delivery | ArgoCD AppProject + Application | — | live |
| ci-flows | smoke workflow + label guardrail | — | smoke proven |
Golden facts (cost real debugging — keep): CNI is Calico (ipBlock doesn't match
in-cluster; empty namespaceSelector {} matches nothing — use explicit kube-system selectors);
CoreDNS listens on 8053 (kube-dns Service 53→8053, Calico evaluates egress post-DNAT);
runner uses the v12 connection model (uuid+token, no register); we serve only
con-ci/con-ci-oci, never generic labels.
See also: onboarding.md (enrollment + ArgoCD bootstrap) and risk-acceptance-ci-on-prod.md.