### Machine Configuration Example Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/v1alpha1/config This snippet shows a basic machine configuration, specifying the machine type and installation disk. ```yaml machine: type: controlplane # InstallConfig represents the installation options for preparing a node. install: disk: /dev/sda # The disk used for installations. image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. ``` -------------------------------- ### Get Pods Output Example Source: https://docs.siderolabs.com/kubernetes-guides/security/pod-security This output shows a successfully created and running pod after applying a Deployment manifest. ```sh deployment.apps/example-workload created NAME READY STATUS RESTARTS AGE example-workload-6f847d64b9-jctkv 1/1 Running 0 10s ``` -------------------------------- ### InstallConfig: Basic Installation Options Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/v1alpha1/config Configure basic installation settings like the target disk, installer image, and whether to wipe the disk. Use `grubUseUKICmdline` to control GRUB bootloader behavior. ```yaml machine: install: disk: /dev/sda # The disk used for installations. image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. wipe: false # Indicates if the installation disk should be wiped at installation time. grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block//device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. ``` -------------------------------- ### Start Virtual Machine Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt Command to start the virtual machine after the DataVolume has been created and imported. ```bash kubectl virt start fedora-vm ``` -------------------------------- ### Create Local Talos Cluster with QEMU Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos Start a local Talos cluster using QEMU as the provisioner. This command configures registry mirrors for faster image pulls and specifies the installer image, control plane, and worker counts. It also disables boot from disk for a faster development cycle. ```bash sudo --preserve-env=HOME _out/talosctl- cluster create \ --provisioner=qemu \ --cidr=172.20.0.0/24 \ --registry-mirror docker.io=http://172.20.0.1:5000 \ --registry-mirror registry.k8s.io=http://172.20.0.1:5001 \ --registry-mirror gcr.io=http://172.20.0.1:5003 \ --registry-mirror ghcr.io=http://172.20.0.1:5004 \ --registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005 \ --install-image=127.0.0.1:5005/siderolabs/installer: \ --controlplanes 3 \ --workers 2 \ --with-bootloader=false ``` -------------------------------- ### EnvironmentConfig Example Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/runtime/environmentconfig This example demonstrates how to define environment variables within an EnvironmentConfig resource. All variables are set on PID 1 and propagated to services upon their initial start. ```yaml apiVersion: v1alpha1 kind: EnvironmentConfig # This field allows for the addition of environment variables. variables: GRPC_GO_LOG_SEVERITY_LEVEL: info GRPC_GO_LOG_VERBOSITY_LEVEL: "99" https_proxy: http://SERVER:PORT/ ``` -------------------------------- ### Install QEMU on Linux Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu Installs QEMU system and KVM for Linux systems, typically on Ubuntu. ```bash apt install qemu-system-x86 qemu-kvm ``` -------------------------------- ### Define and Start Talos Network Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/kvm These commands define the network configuration with libvirt and then start the network, ensuring it automatically starts on reboot. ```bash virsh net-define my-talos-net.xml ``` ```bash virsh net-start my-talos-net ``` ```bash virsh net-autostart my-talos-net ``` -------------------------------- ### Download Installation Media Source: https://docs.siderolabs.com/omni/reference/cli Downloads installer media from the server. Specify the image name and optionally architecture and extensions. ```bash omnictl download iso --arch amd64 ``` ```bash omnictl download iso --arch amd64 --extensions intel-ucode --extensions qemu-guest-agent ``` ```bash omnictl download "vultr" ``` ```bash omnictl download "rpi_generic" ``` -------------------------------- ### Install QEMU on macOS Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu Installs QEMU on macOS using the Homebrew package manager. ```bash brew install qemu ``` -------------------------------- ### Example Workload Success Message Source: https://docs.siderolabs.com/talos/v1.13/getting-started/deploy-first-workload This is the expected output upon successful deployment and access of the example workload, confirming the deployment. ```text 🎉 CONGRATULATIONS! 🎉 ======================================== You successfully deployed the example workload! Resources: ---------- 🔗 Talos Linux: https://talos.dev 🔗 Omni: https://omni.siderolabs.com 🔗 Sidero Labs: https://siderolabs.com ======================================== ``` -------------------------------- ### Install VirtualBox on Ubuntu Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/virtualbox Installs VirtualBox using the apt package manager on Ubuntu systems. ```bash apt install virtualbox ``` -------------------------------- ### Start QEMU VM with cloud-init ISO Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/nocloud Launches a QEMU virtual machine, attaching the generated cloud-init ISO image for Talos configuration. ```bash qemu-system-x86_64 \ ... \ -cdrom iso/cidata.iso \ ... ``` -------------------------------- ### Retrieve Audit Log for Date Range via CLI Source: https://docs.siderolabs.com/omni/cluster-management/using-audit-log Retrieve audit logs for a specific date range by providing start and end dates in `YYYY-MM-DD` format to the `omnictl audit-log` command. For example, to get logs from August 1st to August 7th, 2024. ```bash omnictl audit-log 2024-08-01 2024-08-07 ``` -------------------------------- ### Start tsidp Service Source: https://docs.siderolabs.com/omni/security-and-authentication/oidc-login-with-tailscale Start only the tsidp service to begin the OIDC client setup process. This allows you to register Omni as a client. ```bash docker compose up tsidp ``` -------------------------------- ### Example Talos QEMU Launcher Process Output Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu Shows example output when searching for `talosctl qemu-launch` processes, indicating active VM launchers and their PIDs. ```bash 0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch 0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch ``` -------------------------------- ### Get Talos Node Version Source: https://docs.siderolabs.com/talos/v1.13/networking/host-dns Example command to get the version of a specific Talos node. This demonstrates how to interact with cluster members by name when `resolveMemberNames` is enabled. ```shell talosctl -n talos-default-worker-1 version ``` -------------------------------- ### Example QEMU VM Process Output Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu Illustrates the typical output when searching for `qemu-system` processes, showing PIDs and command-line arguments for running VMs. ```bash 2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm 2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm ``` -------------------------------- ### Set Up Cross-Build Environment Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos Run this command to set up the necessary QEMU user-mode emulation for cross-compilation. Note that some Ubuntu static QEMU binaries may be broken. ```bash docker run --rm --privileged multiarch/qemu-user-static --reset -p yes ``` -------------------------------- ### Example Kernel Arguments Status Output Source: https://docs.siderolabs.com/omni/infrastructure-and-extensions/modify-kernel-arguments This is an example of the output from `omnictl get kernelargsstatus`. It details the applied arguments, current arguments, unmet conditions, and the full command line. ```yaml event: updated metadata: namespace: default type: KernelArgsStatuses.omni.sidero.dev id: $MACHINE_ID version: 5 owner: KernelArgsStatusController phase: running created: 2025-10-29T12:58:17Z updated: 2025-10-29T13:28:32Z spec: args: - talos.environment=foo=bar currentargs: - console=tty0 - console=ttyS0 unmetconditions: [] currentcmdline: talos.platform=metal console=tty0 console=ttyS0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on selinux=1 siderolink.api=grpc://omni.example.org:8090?jointoken=w7uVuW3zbVKIYQ....VfCfSCD talos.events.sink=[fdae:41e4:649b:9303::1]:8090 talos.logging.kernel=tcp://[fdae:41e4:649b:9303::1]:8092 ``` -------------------------------- ### Hetzner Cloud CLI Context Setup Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/hetzner Command to create a new context for the Hetzner Cloud CLI, named 'talos-tutorial'. This is a prerequisite for managing Hetzner Cloud resources via the CLI. ```bash # Set hcloud context and api key hcloud context create talos-tutorial ``` -------------------------------- ### Azure Environment Setup Variables Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/azure Set these environment variables with your Azure-specific information before proceeding with the installation. ```bash # Storage account to use export STORAGE_ACCOUNT="StorageAccountName" # Storage container to upload to export STORAGE_CONTAINER="StorageContainerName" # Resource group name export GROUP="ResourceGroupName" # Location export LOCATION="centralus" # Get storage account connection string based on info above export CONNECTION=$(az storage account show-connection-string \ -n $STORAGE_ACCOUNT \ -g $GROUP \ -o tsv) ``` -------------------------------- ### Basic DummyLinkConfig Example Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/dummylinkconfig This example demonstrates the basic configuration of a DummyLinkConfig resource, including naming the link and assigning a static IP address. ```yaml apiVersion: v1alpha1 kind: DummyLinkConfig name: dummy1 # Name of the dummy link (interface). # Configure addresses to be statically assigned to the link. addresses: - address: 192.168.1.100/24 # IP address to be assigned to the link. # # Override the hardware (MAC) address of the link. # hardwareAddr: 2e:3c:4d:5e:6f:70 ``` -------------------------------- ### UserVolumeConfig with Directory Type Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/block/uservolumeconfig Example of UserVolumeConfig for a directory-based volume. This configuration does not involve disk provisioning or complex encryption setups. ```yaml apiVersion: v1alpha1 kind: UserVolumeConfig name: local-data # Name of the volume. volumeType: directory # Volume type. # # The encryption describes how the volume is encrypted. # encryption: # provider: luks2 # Encryption provider to use for the encryption. # # Defines the encryption keys generation and storage method. # keys: # - slot: 0 # Key slot number for LUKS2 encryption. # # Key which value is stored in the configuration file. # static: # passphrase: exampleKey # Defines the static passphrase value. # # # # KMS managed encryption key. # # kms: # # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. # - slot: 1 # Key slot number for LUKS2 encryption. # # KMS managed encryption key. # kms: # endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key. # cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider. # blockSize: 4096 # Defines the encryption sector size. # # Additional --perf parameters for the LUKS2 encryption. # options: # - no_read_workqueue # - no_write_workqueue ``` -------------------------------- ### Verify NVIDIA System Extensions Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/hardware-and-drivers/nvidia-gpu Confirm that the NVIDIA container toolkit and kernel modules extensions are installed and active using `talosctl get extensions`. ```bash talosctl get extensions ``` ```text NODE NAMESPACE TYPE ID VERSION NAME VERSION 172.31.41.27 runtime ExtensionStatus 000.ghcr.io-siderolabs-nvidia-container-toolkit-515.65.01-v1.10.0 1 nvidia-container-toolkit 515.65.01-v1.10.0 172.31.41.27 runtime ExtensionStatus 000.ghcr.io-siderolabs-nvidia-open-gpu-kernel-modules-515.65.01-v1.2.0 1 nvidia-open-gpu-kernel-modules 515.65.01-v1.2.0 ``` -------------------------------- ### Example Build Output Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module Observe the build output to confirm that both the kernel and your custom package images have been successfully pushed to the registry. This output provides the image tags needed for subsequent steps. ```bash => => pushing manifest for 127.0.0.1:5005/user/kernel:v1.11.0-alpha.0... ... => => pushing manifest for 127.0.0.1:5005/user/my-module-pkg:v1.11.0-alpha.0... ``` -------------------------------- ### Get Talos VM Disk Name Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/kvm Fetches the disk name of the Talos VM, which is required for installing Talos onto the VM's persistent storage. ```bash talosctl get disks --nodes $CP_IP --insecure ``` -------------------------------- ### Create ISO Filesystem for Talos Configuration Source: https://docs.siderolabs.com/talos/v1.13/reference/kernel This example demonstrates how to create an ISO filesystem with a specific volume ID and a `config.yaml` file, which Talos can load when the `talos.config=metal-iso` kernel parameter is set. ```sh mkdir iso/ cp config.yaml iso/ mkisofs -joliet -rock -volid 'metal-iso' -output config.iso iso/ ``` -------------------------------- ### Define Machine Configuration Source: https://docs.siderolabs.com/omni/reference/cluster-templates Specify machine-specific settings including labels, annotations, install disk, and system extensions. This example also includes a machine patch. ```yaml kind: Machine name: 27c16241-96bf-4f17-9579-ea3a6c4a3ca8 labels: my-label: my-value annotations: my-annotation: my-value locked: false install: disk: /dev/vda patches: - file: patches/example-machine-patch.yaml systemExtensions: - siderolabs/hello-world-service ``` -------------------------------- ### Power On Bootstrap Node Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/vmware Use `govc vm.power -on` to start the bootstrap control plane virtual machine. ```bash govc vm.power -on control-plane-1 ``` -------------------------------- ### Create cloud-init ISO image Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/nocloud Builds a bootable ISO image containing the cloud-init configuration files. This ISO can be attached to a VM to provide initial configuration. ```bash cd iso && genisoimage -output cidata.iso -V cidata -r -J user-data meta-data network-config ``` -------------------------------- ### Enable Break Glass Configuration on Omni Source: https://docs.siderolabs.com/omni/security-and-authentication/break-glass-emergency-access For on-premises Omni installations, enable break glass mode by passing the `--enable-break-glass-configs` flag when starting the Omni server. ```bash omnictl talosconfig --cluster --break-glass ``` -------------------------------- ### Get Available Disks Source: https://docs.siderolabs.com/talos/v1.13/getting-started/getting-started View all available disks on your control plane node to identify the target disk for Talos installation. Use the `--insecure` flag if not using TLS. ```bash talosctl get disks --insecure --nodes $CONTROL_PLANE_IP ``` -------------------------------- ### Deploy Kubernetes Audit Pod Example Source: https://docs.siderolabs.com/kubernetes-guides/security/seccomp-profiles Apply the example workload from the Kubernetes documentation to test Seccomp profiling. This command deploys a pod that utilizes a Seccomp profile. ```bash kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml ``` -------------------------------- ### Containerd Task Creation Error Source: https://docs.siderolabs.com/talos/v1.13/learn-more/process-capabilities This is an example error message that may appear when a pod attempts to start but is denied due to restricted process capabilities, specifically CAP_SYS_MODULE or CAP_SYS_BOOT. ```text Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply caps: operation not permitted: unknown ``` -------------------------------- ### Install virtctl using krew Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt Install the `virtctl` command-line tool using `krew`, the Kubernetes plugin manager, for seamless integration with `kubectl`. ```bash kubectl krew install virt ``` -------------------------------- ### Start Vagrant VMs with libvirt Provider Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/vagrant-libvirt Provision and start the virtual machines defined in your Vagrantfile using the libvirt provider. This command initiates the creation and boot process for all defined VMs. ```bash vagrant up --provider=libvirt ``` -------------------------------- ### Get Virtual Machine IP Address Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt This command retrieves the IP address of a running KubeVirt virtual machine. Use this after starting a VM to verify its network connectivity and IP assignment. ```bash kubectl get vmi -owide ``` -------------------------------- ### Create Network Ports for Control Plane Nodes Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/openstack Creates network ports for each control plane node in your OpenStack environment. Ensure the network name ('shared' in this example) is correct for your setup. ```bash # Create ports for control plane nodes, updating network name if necessary openstack port create --network shared talos-control-plane-1 openstack port create --network shared talos-control-plane-2 openstack port create --network shared talos-control-plane-3 ``` -------------------------------- ### Full Network Configuration Example Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/metal-network-configuration This is a comprehensive example of a Talos network configuration file, demonstrating settings for addresses, links, routes, hostnames, resolvers, and time servers. ```yaml addresses: - address: 147.75.61.43/31 linkName: bond0 family: inet4 scope: global flags: permanent layer: platform - address: 2604:1380:45f2:6c00::1/127 linkName: bond0 family: inet6 scope: global flags: permanent layer: platform - address: 10.68.182.1/31 linkName: bond0 family: inet4 scope: global flags: permanent layer: platform links: - name: eth0 up: true masterName: bond0 slaveIndex: 0 layer: platform - name: eth1 up: true masterName: bond0 slaveIndex: 1 layer: platform - name: bond0 logical: true up: true mtu: 0 kind: bond type: ether bondMaster: mode: 802.3ad xmitHashPolicy: layer3+4 lacpRate: slow arpValidate: none arpAllTargets: any primaryReselect: always failOverMac: 0 miimon: 100 updelay: 200 downdelay: 200 resendIgmp: 1 lpInterval: 1 packetsPerSlave: 1 numPeerNotif: 1 tlbLogicalLb: 1 adActorSysPrio: 65535 layer: platform routes: - family: inet4 gateway: 147.75.61.42 outLinkName: bond0 table: main priority: 1024 scope: global type: unicast protocol: static layer: platform - family: inet6 gateway: '2604:1380:45f2:6c00::' outLinkName: bond0 table: main priority: 2048 scope: global type: unicast protocol: static layer: platform - family: inet4 dst: 10.0.0.0/8 gateway: 10.68.182.0 outLinkName: bond0 table: main scope: global type: unicast protocol: static layer: platform hostnames: - hostname: ci-blue-worker-amd64-2 layer: platform resolvers: [] timeServers: [] ``` -------------------------------- ### SwapVolumeConfig Example Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/block/swapvolumeconfig This is a complete example of a SwapVolumeConfig resource. It defines the name, provisioning details including disk selection and size constraints, and encryption settings with a static passphrase. ```yaml apiVersion: v1alpha1 kind: SwapVolumeConfig name: swap1 # Name of the volume. # The provisioning describes how the volume is provisioned. provisioning: # The disk selector expression. diskSelector: match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk. minSize: 3GiB # The minimum size of the volume. maxSize: 4GiB # The maximum size of the volume, if not specified the volume can grow to the size of the # The encryption describes how the volume is encrypted. encryption: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - slot: 0 # Key slot number for LUKS2 encryption. # Key which value is stored in the configuration file. static: passphrase: swapsecret # Defines the static passphrase value. # # KMS managed encryption key. # kms: # endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key. # # Cipher to use for the encryption. Depends on the encryption provider. # cipher: aes-xts-plain64 # # Defines the encryption sector size. # blockSize: 4096 # # Additional --perf parameters for the LUKS2 encryption. # options: # - no_read_workqueue # - no_write_workqueue ``` -------------------------------- ### Retrieve Cluster UUID and Secret Source: https://docs.siderolabs.com/kubernetes-guides/csi/simplyblock-storage Inside the control plane pod, list clusters to get the UUID and then retrieve the associated secret. These are needed for adding storage pools and installing the Helm chart. ```bash kubectl -n simplyblock exec -it \ simplyblock-admin-control- -- bash sbctl cluster list sbctl cluster get-secret ``` -------------------------------- ### Interact with Talos Cluster using talosctl Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos Execute commands using `talosctl` to interact with your running Talos cluster. These examples show how to check the version, access the dashboard, and get member information. ```bash talosctl -n 172.20.0.2 version ``` ```bash talosctl -n 172.20.0.3,172.20.0.4 dashboard ``` ```bash talosctl -n 172.20.0.4 get members ``` -------------------------------- ### Talos Extension Service Configuration Example Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/extension-services Example configuration for an extension service named 'hello-world'. It specifies the container entrypoint, arguments, network dependencies, and restart policy. ```yaml name: hello-world container: entrypoint: ./hello args: - --config - config.ini depends: - network: - addresses restart: always ``` -------------------------------- ### Build Kernel and Initramfs Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/building-images Build the most basic boot assets, the kernel and initramfs. The results are stored in the _out directory. ```bash make kernel initramfs ``` -------------------------------- ### Display Talos Linux SBOM Resources Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/SBOM Use `talosctl get sboms` to list all available SBOM resources on a Talos Linux system. This command displays information about core components and installed extensions. ```sh talosctl get sboms NODE NAMESPACE TYPE ID VERSION VERSION LICENSE 172.20.0.2 runtime SBOMItem Talos 1 v1.13.0 172.20.0.2 runtime SBOMItem apparmor 1 v3.1.7 GPL-2.0-or-later 172.20.0.2 runtime SBOMItem cel.dev/expr 1 v0.24.0 ... ``` -------------------------------- ### Basic Fedora VM with Default CNI Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt This YAML defines a basic Fedora virtual machine with default CNI, including disk configuration, network interface, and cloud-init for initial setup and package installation. ```yaml --- apiVersion: kubevirt.io/v1 kind: VirtualMachine metadata: name: fedora-vm spec: running: false template: metadata: labels: kubevirt.io/vm: fedora-vm annotations: kubevirt.io/allow-pod-bridge-network-live-migration: "true" spec: evictionStrategy: LiveMigrate domain: cpu: cores: 2 resources: requests: memory: 4G devices: disks: - name: fedora-vm-pvc disk: bus: virtio - name: cloudinitdisk disk: bus: virtio interfaces: - name: podnet masquerade: {} networks: - name: podnet pod: {} volumes: - name: fedora-vm-pvc persistentVolumeClaim: claimName: fedora-vm-pvc - name: cloudinitdisk cloudInitNoCloud: networkData: | network: version: 1 config: - type: physical name: eth0 subnets: - type: dhcp userData: |- #cloud-config users: - name: cloud-user ssh_authorized_keys: - ssh-rsa .... sudo: ['ALL=(ALL) NOPASSWD:ALL'] groups: sudo shell: /bin/bash runcmd: - "sudo touch /root/installed" - "sudo dnf update" - "sudo dnf install httpd fastfetch -y" - "sudo systemctl daemon-reload" - "sudo systemctl enable httpd" - "sudo systemctl start --no-block httpd" dataVolumeTemplates: - metadata: name: fedora-vm-pvc spec: storage: resources: requests: storage: 35Gi accessModes: - ReadWriteMany storageClassName: "nfs-csi" source: http: url: "https://fedora.mirror.wearetriple.com/linux/releases/40/Cloud/x86_64/images/Fedora-Cloud-Base-Generic.x86_64-40-1.14.qcow2" ``` -------------------------------- ### Create Installation ISO with Kernel Arguments Source: https://docs.siderolabs.com/omni/self-hosted/run-omni-airgapped Generates a bootable ISO image using `imager` with kernel arguments that include the compressed and base64 encoded Trusted Roots Config and Omni join token. SELinux must not be in enforcing mode. ```sh docker run --rm -t \ -v "${PWD}/_out:/out" \ --privileged \ ${REGISTRY_ENDPOINT}/siderolabs/imager:${release} \ iso \ --extra-kernel-arg "talos.config.early=${TRUSTED_ROOT_CONFIG} $OMNI_KERNEL_ARGS" ``` -------------------------------- ### List System Extensions with talosctl Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/system-extensions Use `talosctl get extensions` to retrieve a list of all system extensions installed on a node. The output includes basic information like node, namespace, type, ID, version, and name. ```bash $ talosctl get extensions NODE NAMESPACE TYPE ID VERSION NAME VERSION 172.20.0.2 runtime ExtensionStatus 000.ghcr.io-talos-systems-gvisor-54b831d 1 gvisor 20220117.0-v1.0.0 172.20.0.2 runtime ExtensionStatus 001.ghcr.io-talos-systems-intel-ucode-54b831d 1 intel-ucode microcode-20210608-v1.0.0 ``` -------------------------------- ### Create vCenter Content Library Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/vmware Use the `govc library.create` command to create a new content library in vCenter if one does not already exist. Replace `` with your desired name. ```bash govc library.create ``` -------------------------------- ### Example Cluster Template Structure Source: https://docs.siderolabs.com/omni/reference/cluster-templates This YAML defines a multi-document cluster template, including Cluster, ControlPlane, Workers, and Machine configurations. It demonstrates features like labels, Kubernetes and Talos versions, disk encryption, patches, system extensions, kernel arguments, and machine-specific installations. ```yaml kind: Cluster name: example labels: my-label: my-value kubernetes: version: v1.26.0 talos: version: v1.3.2 features: diskEncryption: true patches: - name: kubespan-enabled inline: machine: network: kubespan: enabled: true systemExtensions: - siderolabs/hello-world-service kernelArgs: - talos.dashboard.disabled=1 --- kind: ControlPlane machines: - 27c16241-96bf-4f17-9579-ea3a6c4a3ca8 - 4bd92fba-998d-4ef3-ab43-638b806dd3fe - 8fdb574a-a252-4d7d-94f0-5cdea73e140a --- kind: Workers machines: - b885f565-b64f-4c7a-a1ac-d2c8c2781373 - a54f21dc-6e48-4fc1-96aa-3d7be5e2612b --- kind: Workers name: xlarge machines: - 1f721dee-6dbb-4e71-9832-226d73da3841 systemExtensions: - siderolabs/hello-world-service --- kind: Machine name: 27c16241-96bf-4f17-9579-ea3a6c4a3ca8 --- kind: Machine name: 4bd92fba-998d-4ef3-ab43-638b806dd3fe install: disk: /dev/vda --- kind: Machine name: 8fdb574a-a252-4d7d-94f0-5cdea73e140a install: disk: /dev/vda --- kind: Machine name: b885f565-b64f-4c7a-a1ac-d2c8c2781373 install: disk: /dev/vda systemExtensions: - siderolabs/hello-world-service --- kind: Machine name: a54f21dc-6e48-4fc1-96aa-3d7be5e2612b locked: true install: disk: /dev/vda --- kind: Machine name: 1f721dee-6dbb-4e71-9832-226d73da3841 install: disk: /dev/vda kernelArgs: - net.ifnames=0 - talos.dashboard.disabled=1 ``` -------------------------------- ### Configure Link Alias and Physical Interface Source: https://docs.siderolabs.com/talos/v1.13/networking/configuration/physical This example demonstrates how to create a user-friendly alias for a physical link using a MAC address selector, and then configure the aliased interface. This allows for more readable configuration referencing. ```yaml apiVersion: v1alpha1 kind: LinkAliasConfig name: mgmt selector: match: mac(link.permanent_addr) == "00:1a:2b:3c:4d:5e" --- apiVersion: v1alpha1 kind: LinkConfig name: mgmt mtu: 9000 up: true ``` -------------------------------- ### Prepare cloud-init configuration files Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/nocloud Organizes Talos machine configuration and network settings into cloud-init compatible files (user-data, meta-data, network-config). ```bash mkdir -p iso mv _out/controlplane.yaml iso/user-data echo "local-hostname: controlplane-1" > iso/meta-data cat > iso/network-config << EOF version: 1 config: - type: physical name: eth0 mac_address: "52:54:00:12:34:00" subnets: - type: static address: 192.168.1.10 netmask: 255.255.255.0 gateway: 192.168.1.254 EOF ``` -------------------------------- ### Push Installer Image to Container Registry Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/secureboot Push the generated installer image to a container registry using the 'crane' tool. This makes the installer accessible to Talos during the installation process. ```shell crane push _out/installer-amd64-secureboot.tar ghcr.io//installer-amd64-secureboot:${release_v1_13} ``` -------------------------------- ### Full Omni Configuration Example Source: https://docs.siderolabs.com/omni/self-hosted/omni-configuration-example A complete, annotated Omni configuration file including account, authentication, services, storage, etcd backup, and feature flags. Replace placeholders with your deployment values. ```yaml # Account identification. # Generate this UUID once and never change it after initial setup. account: id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 # Authentication configuration. auth: auth0: enabled: true clientID: your-auth0-client-id domain: your-tenant.auth0.com initialUsers: - admin@example.com - operator@example.com initialServiceAccount: enabled: true # Service endpoints and TLS configuration. services: api: endpoint: 0.0.0.0:443 advertisedURL: https://omni.example.com certFile: /etc/omni/tls/tls.crt keyFile: /etc/omni/tls/tls.key kubernetesProxy: endpoint: 0.0.0.0:8095 advertisedURL: https://omni-k8s.example.com certFile: /etc/omni/tls/tls.crt keyFile: /etc/omni/tls/tls.key machineAPI: advertisedURL: grpc://omni-siderolink.example.com:8090 siderolink: joinTokensMode: strict wireGuard: advertisedEndpoint: 203.0.113.10:50180 workloadProxy: enabled: true subdomain: proxy useOmniSubdomain: true # Storage backends. storage: default: kind: etcd etcd: embedded: true embeddedDBPath: /var/lib/omni/etcd/ privateKeySource: "vault://secret/omni-private-key" sqlite: path: /var/lib/omni/sqlite.db # Etcd backup configuration with S3 storage. etcdBackup: s3Enabled: true # Feature flags. features: enableBreakGlassConfigs: true ``` -------------------------------- ### Install sbctl CLI Source: https://docs.siderolabs.com/kubernetes-guides/csi/simplyblock-storage Install the Simplyblock control plane CLI using pip. Ensure you have Python and pip installed. ```bash pip install sbctl --upgrade ``` -------------------------------- ### Talos Secure Boot Installer Image Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/xenorchestra Use this value in your Talos machine configuration when installing with the Secure Boot installer image. ```text factory.talos.dev/nocloud-installer-secureboot/53b20d86399013eadfd44ee49804c1fef069bfdee3b43f3f3f5a2f57c03338ac:v1.13 ``` -------------------------------- ### Install Talos Dependencies with Homebrew Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/aws Installs necessary tools for the Talos installation tutorial using Homebrew. Ensure you are on macOS or Linux. ```bash brew install siderolabs/tap/talosctl kubectl jq curl xz ``` -------------------------------- ### Xen Secure Boot Setup Mode Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/xen Use these commands to force Xen VMs into setup mode for Secure Boot configuration. Remember to re-enable Secure Boot after the initial boot. ```bash varstore-sb-state setup ``` ```bash xe vm-set-uefi-mode mode=setup uuid= ``` -------------------------------- ### Install cert-manager Helm Chart Source: https://docs.siderolabs.com/omni/self-hosted/run-omni-on-k8s Installs cert-manager using Helm, a Kubernetes add-on manager. Ensure cert-manager is installed in its own namespace. ```bash helm install \ cert-manager oci://quay.io/jetstack/charts/cert-manager \ --version v1.19.2 \ --namespace cert-manager \ --create-namespace \ --set crds.enabled=true \ --set global.leaderElection.namespace=cert-manager \ --set enableCertificateOwnerRef=true \ --set "extraArgs[0]=--dns01-recursive-nameservers-only" \ --set-string "extraArgs[1]=--dns01-recursive-nameservers=1.1.1.1:53\,8.8.8.8:53" ``` -------------------------------- ### Create Local QEMU VM with Omni Source: https://docs.siderolabs.com/omni/getting-started/getting-started Create temporary virtual machines locally using QEMU and connect them to your Omni instance. Requires Talosctl v1.12+. ```bash talosctl cluster create qemu --omni-api-endpoint $COPY_FROM_OMNI ``` -------------------------------- ### Deploy Example Workload Source: https://docs.siderolabs.com/kubernetes-guides/advanced-guides/hpa Apply the sample workload manifest to your Kubernetes cluster. This sets up the deployment and service that will be used for autoscaling. ```bash kubectl apply -f https://raw.githubusercontent.com/siderolabs/example-workload/refs/heads/main/deploy/example-svc-nodeport.yaml ``` -------------------------------- ### Service Start Source: https://docs.siderolabs.com/talos/v1.13/reference/api Starts a specified service by its ID. ```APIDOC ## ServiceStart ### Description Starts a service. ### Method POST ### Endpoint /machine/servicestart ### Parameters #### Request Body - **id** (string) - Required - The ID of the service to start. ### Request Example ```json { "id": "service-id-123" } ``` ### Response #### Success Response (200) - **messages** (repeated ServiceStart) - Contains information about the start operation. ``` -------------------------------- ### Sample Provider Log Output Source: https://docs.siderolabs.com/omni/omni-cluster-setup/setting-up-the-bare-metal-infrastructure-provider Example log output from the bare metal infrastructure provider, showing initialization messages and component startup. ```json {"level":"info","ts":1734439242.1502001,"caller":"provider/provider.go:80","msg":"starting provider","options":{"Name":"Bare Metal","Description":"Bare metal infrastructure provider","OmniAPIEndpoint":"..."} {"level":"info","ts":1734439242.1973493,"caller":"ipxe/handler.go:310","msg":"patch iPXE binaries","component":"ipxe_handler"} {"level":"info","ts":1734439242.2833045,"caller":"ipxe/handler.go:316","msg":"successfully patched iPXE binaries","component":"ipxe_handler"} {"level":"info","ts":1734439242.2870164,"caller":"provider/provider.go:221","msg":"start component","component":"COSI runtime"} {"level":"info","ts":1734439242.28702,"caller":"provider/provider.go:221","msg":"start component","component":"TFTP server"} {"level":"info","ts":1734439242.287044,"caller":"provider/provider.go:221","msg":"start component","component":"DHCP proxy"} {"level":"info","ts":1734439242.2870617,"caller":"provider/provider.go:221","msg":"start component","component":"machine status poller"} {"level":"info","ts":1734439242.2870378,"caller":"provider/provider.go:221","msg":"start component","component":"server"} ``` -------------------------------- ### Talos Installer SecureBoot Image Reference Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/secureboot Reference for the Talos installer container image that supports SecureBoot. This is used when generating machine configurations for installation. ```yaml factory.talos.dev/installer-secureboot/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:${release_v1_13} ``` -------------------------------- ### Upgrade Existing Machine with Installer Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module Use this command to upgrade an existing Talos machine with your installer image, allowing the extension to be installed during the upgrade process. ```bash talosctl upgrade -i $REGISTRY/$USER/installer:$TAG ``` -------------------------------- ### Define Extension Build Steps (pkg.yaml) Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module Configure the build process for your extension in `pkg.yaml`, specifying dependencies, shell, and installation steps. This includes copying kernel modules to the rootfs. ```yaml name: my-module variant: scratch shell: /bin/sh dependencies: - stage: base - image: "${PKG_IMAGE}" # the image we built in the first step steps: - install: - mkdir -p /rootfs/usr/lib/modules - cp -R /usr/lib/modules/* /rootfs/usr/lib/modules/ finalize: - from: /rootfs to: /rootfs - from: /pkg/manifest.yaml # make sure you add the metadata file to: / ``` -------------------------------- ### Generate Installer Image Configuration Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module Use this command to generate a Talos configuration that includes your custom installer image. This is typically done for a fresh installation. ```bash talosctl gen config --install-image $REGISTRY/$USER/installer:$TAG \ test https://192.168.100.100:6443 # cluster name and endpoint ``` -------------------------------- ### talosctl get Command Synopsis Source: https://docs.siderolabs.com/talos/v1.13/reference/cli Synopsis for the 'talosctl get' command, used to retrieve specific resources or lists of resources from the OS. Similar to 'kubectl get'. ```bash talosctl get [] [flags] ``` -------------------------------- ### Install virtctl Client Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt Download the `virtctl` client binary for Linux AMD64 by first determining the latest KubeVirt release version and then using `wget` to fetch the executable. ```bash export VERSION=$(curl https://storage.googleapis.com/kubevirt-prow/release/kubevirt/kubevirt/stable.txt) wget https://github.com/kubevirt/kubevirt/releases/download/${VERSION}/virtctl-${VERSION}-linux-amd64 ``` -------------------------------- ### Generate Talos Installer Image Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/boot-assets Creates a custom Talos installer image containing specified system extensions and overlays. This image is used for installing Talos on machines. ```sh docker run --rm -t \ -v "$PWD/_out:/out" \ ghcr.io/siderolabs/imager:${release_v1_13} \ installer \ --arch arm64 \ --system-extension-image ghcr.io/siderolabs/iscsi-tools:v0.1.4@sha256:548b2b121611424f6b1b6cfb72a1669421ffaf2f1560911c324a546c7cee655e \ --overlay-image ghcr.io/siderolabs/sbc-raspberrypi:v0.1.0@sha256:849ace01b9af514d817b05a9c5963a35202e09a4807d12f8a3ea83657c76c863 \ --overlay-name=rpi_generic ```