### Helm Chart Installation with IPv6 Example Values

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Install the Talos Cloud Controller Manager using a Helm chart with example values for IPv6 support.

```shell
helm upgrade -i -n kube-system \
  -f https://raw.githubusercontent.com/siderolabs/talos-cloud-controller-manager/main/charts/talos-cloud-controller-manager/values-example.yaml \
  talos-cloud-controller-manager oci://ghcr.io/siderolabs/charts/talos-cloud-controller-manager
```

--------------------------------

### Basic Helm Chart Installation

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Install the Talos Cloud Controller Manager using the OCI-based Helm chart with basic configuration.

```shell
helm upgrade -i -n kube-system talos-cloud-controller-manager \
  oci://ghcr.io/siderolabs/charts/talos-cloud-controller-manager
```

--------------------------------

### Example Initialized Node Resource

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

An example Kubernetes Node resource after being initialized by the cloud-node controller with cloud metadata, labels, and addresses.

```yaml
apiVersion: v1
kind: Node
metadata:
  labels:
    node.cloudprovider.kubernetes.io/platform: metal
    node.cloudprovider.kubernetes.io/clustername: my-cluster
    node.cloudprovider.kubernetes.io/lifecycle: spot
    node.kubernetes.io/instance-type: t2.micro
    topology.kubernetes.io/region: us-west-1
    topology.kubernetes.io/zone: us-west-1f
  name: web-1
spec:
  providerID: aws:///us-east-1f/i-1234567890abcdef0
status:
  addresses:
  - address: 172.16.0.11
    type: InternalIP
  - address: 1.2.3.4
    type: ExternalIP
  - address: 2001:123:123:123::1
    type: ExternalIP
  - address: web-1
    type: Hostname
```

--------------------------------

### Talos CCM Deploy Example Configuration

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/charts/talos-cloud-controller-manager/README.md

Example values for the talos-ccm.yaml file to configure replica count and enabled controllers for the Talos Cloud Controller Manager.

```yaml
# talos-ccm.yaml

replicaCount: 2

enabledControllers:
  - cloud-node
  - node-csr-approval
```

--------------------------------

### Deploy CCM with Helm Values

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Complete configuration example for deploying the Talos CCM using a Helm values file.

```yaml
# talos-ccm-values.yaml
replicaCount: 2

image:
  repository: ghcr.io/siderolabs/talos-cloud-controller-manager
  pullPolicy: IfNotPresent
  tag: ""  # Uses chart appVersion by default

logVerbosityLevel: 4

enabledControllers:
  - cloud-node
  - node-csr-approval
  - node-ipam-controller

extraArgs:
  - --allocate-node-cidrs
  - --cidr-allocator-type=CloudAllocator
  - --node-cidr-mask-size-ipv4=24
  - --node-cidr-mask-size-ipv6=80

transformations:
  - name: web
    nodeSelector:
      - matchExpressions:
          - key: hostname
            operator: Regexp
            values:
              - ^web-.+$
    labels:
      node-role.kubernetes.io/web: ""

  - name: worker
    nodeSelector:
      - matchExpressions:
          - key: hostname
            operator: Regexp
            values:
              - ^worker-.+$
    labels:
      node-role.kubernetes.io/worker: ""

  - name: db
    nodeSelector:
      - matchExpressions:
          - key: hostname
            operator: Regexp
            values:
              - ^db-.+$
    labels:
      node-role.kubernetes.io/db: ""

# Deploy as DaemonSet (runs without CNI)
daemonSet:
  enabled: true
  k8s:
    serviceHost: ""
    servicePort: 6443

tolerations:
  - effect: NoSchedule
    operator: Exists

nodeSelector:
  node-role.kubernetes.io/control-plane: ""

resources:
  requests:
    cpu: 10m
    memory: 64Mi
```

--------------------------------

### Helm Chart Installation with Custom Values

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Install the Talos Cloud Controller Manager using a Helm chart with custom values defined in a local YAML file.

```shell
helm upgrade -i -n kube-system -f talos-ccm.yaml \
  talos-cloud-controller-manager oci://ghcr.io/siderolabs/charts/talos-cloud-controller-manager
```

--------------------------------

### Install Cloud Controller Manager via Helm Chart

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Upgrade or install the Talos Cloud Controller Manager using the Helm chart. Ensure you are in the `kube-system` namespace.

```shell
helm upgrade -i -n kube-system talos-cloud-controller-manager oci://ghcr.io/siderolabs/charts/talos-cloud-controller-manager
```

--------------------------------

### Example CSR Approval Count Metric

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Example output for talosccm_csr_approval_count, a counter metric that records the number of Certificate Signing Requests (CSRs) that have been approved or denied.

```txt
talosccm_csr_approval_count{status="approve"} 2
```

--------------------------------

### Check if String Has Prefix

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `hasPrefix` function to verify if a string starts with a given prefix. Example: `{{ hasPrefix "hello" "he" }}` returns `true`.

```yaml
{{ hasPrefix "hello" "he" }} -> true
```

--------------------------------

### Install Cloud Controller Manager via Talos Machine Config

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Enable the external cloud provider by setting `cluster.externalCloudProvider.enabled` to true and providing the manifest URL.

```yaml
cluster:
  externalCloudProvider:
    enabled: true
    manifests:
      - https://raw.githubusercontent.com/siderolabs/talos-cloud-controller-manager/main/docs/deploy/cloud-controller-manager.yml
```

--------------------------------

### Configure Talos machine CIDR settings

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

Example configuration for Talos machine settings to manage CIDR ranges and disable default allocators.

```yaml
# Talos machine configuration
cluster:
  controllerManager:
    extraArgs:
      controllers: "*,tokencleaner,-node-ipam-controller"
  network:
    # Example of IPv4 and IPv6 CIDR ranges, podSubnets-v6 will use as fallback for IPv6
    podSubnets: ["10.32.0.0/12","fd00:10:32::/64"]
    serviceSubnets: ["10.200.0.0/22","fd40:10:200::/108"]
```

--------------------------------

### Kubernetes Node Resource Example

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/README.md

This YAML defines a Kubernetes Node resource, showcasing cloud provider-specific labels and the providerID format.

```yaml
apiVersion: v1
kind: Node
metadata:
  labels:
    ...
    node.cloudprovider.kubernetes.io/platform: someprovider
    node.kubernetes.io/instance-type: type-of-instance
    topology.kubernetes.io/region: region-2
    topology.kubernetes.io/zone: zone
  name: controlplane-1
spec:
  ...
  providerID: someproviderID:///e8e8c388-5812-4db0-87e2-ad1fee51a1c1
status:
  addresses:
  - address: 172.16.0.11
    type: InternalIP
  - address: 1.2.3.4
    type: ExternalIP
  - address: 2001:123:123:123::1
    type: ExternalIP
  - address: controlplane-1
    type: Hostname

```

--------------------------------

### Install Cloud Controller Manager via kubectl (Latest Release)

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Apply the latest release manifest for the Talos Cloud Controller Manager using kubectl.

```shell
kubectl apply -f https://raw.githubusercontent.com/siderolabs/talos-cloud-controller-manager/main/docs/deploy/cloud-controller-manager.yml
```

--------------------------------

### Example Talos API Request Duration Metrics

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Example output for talosccm_api_request_duration_seconds, a histogram metric tracking the duration of Talos API requests. It includes bucketed counts, the sum of durations, and the total count of requests.

```txt
talosccm_api_request_duration_seconds_bucket{request="addresses",le="0.1"} 10
talosccm_api_request_duration_seconds_bucket{request="addresses",le="0.25"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="0.5"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="1"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="2.5"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="5"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="10"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="30"} 16
talosccm_api_request_duration_seconds_bucket{request="addresses",le="+Inf"} 16
talosccm_api_request_duration_seconds_sum{request="addresses"} 1.369387789
talosccm_api_request_duration_seconds_count{request="addresses"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="0.1"} 14
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="0.25"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="0.5"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="1"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="2.5"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="5"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="10"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="30"} 16
talosccm_api_request_duration_seconds_bucket{request="platformmetadata",le="+Inf"} 16
talosccm_api_request_duration_seconds_sum{request="platformmetadata"} 1.2046141220000002
talosccm_api_request_duration_seconds_count{request="platformmetadata"} 16
```

--------------------------------

### Example Transformer Duration Metrics

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Example output for talosccm_transformer_duration_seconds, a histogram metric measuring the duration of transformation rules. It includes bucketed counts, sum of durations, and total count.

```txt
talosccm_transformer_duration_seconds_bucket{type="metadata",le="0.001"} 16
talosccm_transformer_duration_seconds_bucket{type="metadata",le="0.01"} 16
talosccm_transformer_duration_seconds_bucket{type="metadata",le="0.05"} 16
talosccm_transformer_duration_seconds_bucket{type="metadata",le="0.1"} 16
talosccm_transformer_duration_seconds_bucket{type="metadata",le="+Inf"} 16
talosccm_transformer_duration_seconds_sum{type="metadata"} 0.0012434149999999999
talosccm_transformer_duration_seconds_count{type="metadata"} 16
```

--------------------------------

### Install Cloud Controller Manager via kubectl (Latest Stable Edge)

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Apply the latest stable (edge) release manifest for the Talos Cloud Controller Manager using kubectl.

```shell
kubectl apply -f https://raw.githubusercontent.com/siderolabs/talos-cloud-controller-manager/main/docs/deploy/cloud-controller-manager-edge.yml
```

--------------------------------

### Get Platform Metadatas Command

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Command to retrieve all platform metadata for nodes in YAML format. Useful for inspecting available metadata for use in transformations.

```bash
talosctl get PlatformMetadatas -oyaml
```

--------------------------------

### Retrieve Platform Metadata via Talosctl

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Fetch platform metadata and system information using the `talosctl get` command for debugging or scripting purposes.

```shell
# Get platform metadata
talosctl get PlatformMetadatas -oyaml

# Example output:
# spec:
#   platform: aws
#   hostname: web-01
#   region: us-east-1
#   zone: us-east-1a
#   instanceType: t3.medium
#   instanceId: i-0123456789abcdef0
#   providerId: aws:///us-east-1a/i-0123456789abcdef0
#   spot: false

# Get system information (additional variables)
talosctl get SystemInformation -oyaml

# Example output:
# spec:
#   manufacturer: Amazon EC2
#   productName: t3.medium
#   uuid: ec2e8c38-5812-4db0-87e2-ad1fee51a1c1
#   skuNumber: t3.medium
```

--------------------------------

### Get System Information Command

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Command to retrieve system information for nodes in YAML format. Useful for inspecting hardware details for use in transformations.

```bash
talosctl get SystemInformation -oyaml
```

--------------------------------

### Example Talos Machine Config with IPv4/IPv6 Support

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

This configuration enables IPv4 and IPv6 support for pods, with IPv6 being used as a fallback. It also disables the node IPAM controller and configures API access.

```yaml
machine:
  kubelet:
    extraArgs:
      cloud-provider: external
      rotate-server-certificates: true
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - kube-system
cluster:
  controllerManager:
    extraArgs:
      # Disable node IPAM controller
      controllers: ",",tokencleaner,-node-ipam-controller"
  network:
    # Example of IPv4 and IPv6 CIDR ranges, podSubnets-v6 will use as fallback for IPv6
    podSubnets: ["10.32.0.0/12","fd00:10:32::/64"]
    serviceSubnets: ["10.200.0.0/22","fd40:10:200::/108"]
```

--------------------------------

### Example Transformer Errors Metric

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Example output for talosccm_transformer_errors_total, a counter metric tracking the total number of errors encountered during transformation rule processing.

```txt
talosccm_transformer_errors_total{type="metadata"} 6
```

--------------------------------

### Get Value from Map by Key

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `getValue` function to extract a value from a map-like string using a specified key. Example: `{{ getValue "ds=nocloud;i=1234" "i" }}` results in `1234`.

```yaml
{{ getValue "ds=nocloud;i=1234" "i" }} -> 1234
```

--------------------------------

### Deploy Cloud Controller Manager with Helm and Custom Values

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Deploy the Talos Cloud Controller Manager using Helm, specifying a custom values file for configuration. This example uses a values file that enables IPv4 and IPv6 support.

```shell
helm upgrade -i -n kube-system -f https://raw.githubusercontent.com/siderolabs/talos-cloud-controller-manager/main/charts/talos-cloud-controller-manager/values-example.yaml talos-cloud-controller-manager oci://ghcr.io/siderolabs/charts/talos-cloud-controller-manager
```

--------------------------------

### Example Talos API Request Errors Metric

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Example output for talosccm_api_request_errors_total, a counter metric tracking the total number of errors encountered during Talos API requests, categorized by the type of request.

```txt
talosccm_api_request_errors_total{request="addresses"} 0
talosccm_api_request_errors_total{request="platformmetadata"} 0
```

--------------------------------

### Verify Helm Chart Signature

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/cosign.md

Use this command to verify the keyless signature of the Helm chart using the Cosign protocol. Ensure you have Cosign installed.

```shell
cosign verify ghcr.io/siderolabs/charts/talos-cloud-controller-manager:0.2.1 --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/release-charts.yaml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

--------------------------------

### Convert String to Uppercase

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `upper` function to convert a string to its uppercase equivalent. Example: `{{ upper "hello" }}` results in `HELLO`.

```yaml
{{ upper "hello" }} -> HELLO
```

--------------------------------

### Base64 Decode String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `b64dec` function to decode a Base64 encoded string. Example: `{{ b64dec "aGVsbG8=" }}` results in `hello`.

```yaml
{{ b64dec "aGVsbG8=" }} -> hello
```

--------------------------------

### Base64 Encode String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `b64enc` function to encode a string into its Base64 representation. Example: `{{ b64enc "hello" }}` results in `aGVsbG8=`.

```yaml
{{ b64enc "hello" }} -> aGVsbG8=
```

--------------------------------

### Find First Regex Match

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use `regexFind` to return the first match of a regular expression in a string. Example: `{{ regexFind "[a-zA-Z][1-9]" "abcd1234" }}` results in `d1`.

```yaml
{{ regexFind "[a-zA-Z][1-9]" "abcd1234" }} -> d1
```

--------------------------------

### Convert String to Lowercase

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `lower` function to convert a string to its lowercase equivalent. Example: `{{ lower "HELLO" }}` results in `hello`.

```yaml
{{ lower "HELLO" }} -> hello
```

--------------------------------

### Trim Whitespace from String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `trim` function to remove leading and trailing whitespace from a string. Example: `{{ trim "  hello  " }}` results in `hello`.

```yaml
{{ trim "  hello  " }} -> hello
```

--------------------------------

### Available Metrics for Talos CCM

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Examples of available Prometheus metrics for monitoring Talos CCM performance, including API request durations, errors, CSR approvals, and transformer execution.

```promql
# Talos API request duration histogram
talosccm_api_request_duration_seconds_bucket{request="addresses",le="0.1"} 10
talosccm_api_request_duration_seconds_sum{request="addresses"} 1.369387789
talosccm_api_request_duration_seconds_count{request="addresses"} 16

# Talos API request errors counter
talosccm_api_request_errors_total{request="addresses"} 0

# CSR approval counter
talosccm_csr_approval_count{status="approve"} 2
talosccm_csr_approval_count{status="deny"} 0

# Transformer execution metrics
talosccm_transformer_duration_seconds_bucket{type="metadata",le="0.001"} 16
talosccm_transformer_duration_seconds_sum{type="metadata"} 0.0012434149999999999
talosccm_transformer_errors_total{type="metadata"} 0
```

--------------------------------

### Trim Prefix from String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `trimPrefix` function to remove a specified prefix from a string. Example: `{{ trimPrefix "hello" "he" }}` results in `llo`.

```yaml
{{ trimPrefix "hello" "he" }} -> llo
```

--------------------------------

### Trim Suffix from String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `trimSuffix` function to remove a specified suffix from a string. Example: `{{ trimSuffix "hello" "lo" }}` results in `hel`.

```yaml
{{ trimSuffix "hello" "lo" }} -> hel
```

--------------------------------

### Check if String Has Suffix

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `hasSuffix` function to verify if a string ends with a given suffix. Example: `{{ hasSuffix "hello" "lo" }}` returns `true`.

```yaml
{{ hasSuffix "hello" "lo" }} -> true
```

--------------------------------

### Find Regex Submatch by Index

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use `regexFindString` to find a regex match and return a submatch at a specified index. Example: `{{ regexFindString "^type-([a-z0-9]+)-(.*)$" "type-metal1-asz" 1 }}` results in `metal1`.

```yaml
{{ regexFindString "^type-([a-z0-9]+)-(.*)$" "type-metal1-asz" 1 }} -> metal1
```

--------------------------------

### Check if String Contains Substring

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `contains` function to check if a string includes a specific substring. Example: `{{ contains "hello" "lo" }}` returns `true`.

```yaml
{{ contains "hello" "lo" }} -> true
```

--------------------------------

### Replace Substring in String

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use the `replace` function to replace all occurrences of a substring with another string. Example: `{{ replace "hello" "l" "L" }}` results in `heLLo`.

```yaml
{{ replace "hello" "l" "L" }} -> heLLo
```

--------------------------------

### Replace All Regex Matches

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Use `regexReplaceAll` to replace all occurrences matching a regex pattern with a replacement string. Example: `{{ regexReplaceAll "a(x*)b" "-ab-axxb-" "${1}W" }}` results in `-W-xxW-`.

```yaml
{{ regexReplaceAll "a(x*)b" "-ab-axxb-" "${1}W" }} -> -W-xxW-
```

--------------------------------

### Debug Node Initialization Issues

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Troubleshoot node initialization problems by scaling the deployment, increasing log verbosity, checking CCM logs, node status, labels, taints, providerID, and kubelet configuration.

```shell
# Scale to single replica for debugging
kubectl scale deployment talos-cloud-controller-manager -n kube-system --replicas=1
```

```shell
# Increase log verbosity
# Add --v=5 to deployment args
```

```shell
# Check CCM logs
kubectl logs -n kube-system -l app.kubernetes.io/name=talos-cloud-controller-manager -f
```

```shell
# Check node status
kubectl get nodes -o wide
```

```shell
# Verify node labels and taints
kubectl get nodes web-01 -o jsonpath='{.metadata.labels}' | jq
```

```shell
# Check node providerID
kubectl get nodes web-01 -o jsonpath='{.spec.providerID}'
```

```shell
# Check pod CIDRs
kubectl get nodes -o jsonpath='{.items[*].spec.podCIDRs}'; echo
```

```shell
# Verify kubelet cloud-provider flag is set
kubectl get nodes web-01 -o jsonpath='{.status.nodeInfo.kubeletVersion}'
```

--------------------------------

### Configure node-ipam-controller arguments

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

Recommended arguments to enable the CloudAllocator and configure CIDR mask sizes.

```shell
# Talos CCM args
--controllers=node-ipam-controller \
--allocate-node-cidrs --node-cidr-mask-size-ipv4=24 --node-cidr-mask-size-ipv6=80 --cidr-allocator-type=CloudAllocator
```

--------------------------------

### Enable node-ipam-controller

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

CLI flag to enable the node-ipam-controller.

```shell
--controllers=node-ipam-controller
```

--------------------------------

### Enable node-lifecycle-controller

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

CLI flag to enable the node-lifecycle-controller, primarily used for GCP spot instances.

```shell
--controllers=node-lifecycle-controller
```

--------------------------------

### System Information Variables

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Lists the available system hardware information fields accessible via Go templates.

```APIDOC
## System Information Variables

### Description
Fields available in the SystemInformationSpec struct for use in transformation templates.

### Fields
- **Manufacturer** (string) - Hardware manufacturer.
- **ProductName** (string) - Product name.
- **Version** (string) - Version information.
- **SerialNumber** (string) - Serial number.
- **UUID** (string) - System UUID.
- **WakeUpType** (string) - Wake-up type.
- **SKUNumber** (string) - SKU number.
```

--------------------------------

### Enable cloud-node controller

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

CLI flag to enable the cloud-node controller, which is enabled by default.

```shell
--controllers=cloud-node
```

--------------------------------

### Verify Common Node Initialization Issues

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Diagnose common node initialization problems by checking for uninitialized taints, provided-node-ip annotations, and ensuring Talos API access is configured. Delete and recreate the node if it remains stuck.

```shell
# 1. Check node has uninitialized taint (before CCM processes it)
kubectl get node web-01 -o jsonpath='{.spec.taints}' | jq
```

```shell
# 2. Check node has provided-node-ip annotation
kubectl get node web-01 -o jsonpath='{.metadata.annotations.alpha\.kubernetes\.io/provided-node-ip}'
```

```shell
# 3. If node stuck uninitialized, delete and let kubelet recreate
kubectl delete node web-01
# Then restart kubelet on the node
```

```shell
# 4. Verify Talos API access is configured
kubectl get serviceaccount -n kube-system talos-cloud-controller-manager
kubectl get secret -n kube-system | grep talos-cloud-controller-manager
```

--------------------------------

### Enable Node IPAM Controller via CLI Flags

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Enable the node-ipam-controller and configure CIDR allocation for IPv4 and IPv6 with a CloudAllocator type using CLI flags.

```shell
--controllers=node-ipam-controller \
--allocate-node-cidrs \
--node-cidr-mask-size-ipv4=24 \
--node-cidr-mask-size-ipv6=80 \
--cidr-allocator-type=CloudAllocator
```

--------------------------------

### Configure Kubelet for Server Certificate Rotation

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

Add these extra arguments to the Talos machine configuration to enable server certificate rotation on nodes.

```yaml
machine:
  kubelet:
    extraArgs:
      rotate-server-certificates: true
```

--------------------------------

### Check service account permissions

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/charts/talos-cloud-controller-manager/templates/NOTES.txt

Use this command to verify the authorization capabilities of the service account in the release namespace.

```bash
kubectl auth can-i --list --as system:serviceaccount:{{ .Release.Namespace }}:{{ include "talos-cloud-controller-manager.serviceAccountName" . }}
```

--------------------------------

### Check Node Status and Labels

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Verify the status of Kubernetes nodes and inspect their labels, particularly `node.cloudprovider.kubernetes.io/platform` and `node.kubernetes.io/instance-type`.

```shell
# kubectl get nodes -owide
NAME               STATUS   ROLES           AGE   VERSION   INTERNAL-IP    EXTERNAL-IP                 OS-IMAGE         KERNEL-VERSION   CONTAINER-RUNTIME
controlplane-01a   Ready    control-plane   61d   v1.30.2   172.16.0.142   2a01:4f8:0:3064:1::2d02   Talos (v1.7.4)   6.6.32-talos     containerd://1.7.16
web-01a            Ready    web             61d   v1.30.2   172.16.0.129   2a01:4f8:0:3064:2::2c0c   Talos (v1.7.4)   6.6.32-talos     containerd://1.7.16
web-02a            Ready    web             61d   v1.30.2   172.16.0.145   2a01:4f8:0:30ac:3::2ff4   Talos (v1.7.4)   6.6.32-talos     containerd://1.7.16

# kubectl get nodes web-01a -o jsonpath='{.metadata.labels}' | jq
{
  "beta.kubernetes.io/arch": "amd64",
  "beta.kubernetes.io/instance-type": "2VCPU-2GB",
  "beta.kubernetes.io/os": "linux",
  "failure-domain.beta.kubernetes.io/region": "region-1",
  "failure-domain.beta.kubernetes.io/zone": "region-1a",
  "kubernetes.io/arch": "amd64",
  "kubernetes.io/hostname": "web-01a",
  "kubernetes.io/os": "linux",
  "node-role.kubernetes.io/web": "",
  "node.cloudprovider.kubernetes.io/platform": "nocloud",
  "node.kubernetes.io/instance-type": "2VCPU-2GB",
  "topology.kubernetes.io/region": "region-1",
  "topology.kubernetes.io/zone": "region-1a"
}
```

--------------------------------

### Enable Node Lifecycle Controller via Helm Values

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Enable the cloud-node and cloud-node-lifecycle controllers by specifying them in Helm values.

```yaml
enabledControllers:
  - cloud-node
  - cloud-node-lifecycle
```

--------------------------------

### Deploy Talos Cloud Controller Manager with Helm

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/charts/talos-cloud-controller-manager/README.md

Command to deploy or upgrade the Talos Cloud Controller Manager Helm chart, specifying the namespace and a custom values file.

```shell
helm upgrade -i --namespace=kube-system -f talos-ccm.yaml \
  talos-cloud-controller-manager charts/talos-cloud-controller-manager
```

--------------------------------

### Enable CSR Approving Controller via CLI

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

Use this flag to enable the certificate signing request approving controller in the Talos CCM.

```shell
--controllers=certificatesigningrequest-approving-controller
```

--------------------------------

### SystemInformationSpec Go Struct

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Defines the structure for system information, including hardware details like manufacturer, product name, serial number, and UUID. Used to access hardware-specific information for nodes.

```go
type SystemInformationSpec struct {
	Manufacturer string `yaml:"manufacturer,omitempty" protobuf:"1"
	ProductName  string `yaml:"productName,omitempty" protobuf:"2"
	Version      string `yaml:"version,omitempty" protobuf:"3"
	SerialNumber string `yaml:"serialnumber,omitempty" protobuf:"4"
	UUID         string `yaml:"uuid,omitempty" protobuf:"5"
	WakeUpType   string `yaml:"wakeUpType,omitempty" protobuf:"6"
	SKUNumber    string `yaml:"skuNumber,omitempty" protobuf:"7"
}
```

--------------------------------

### Check default controller state

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/controllers.md

Use this command to inspect the available controllers and their default enabled/disabled status.

```shell
docker run --rm -ti ghcr.io/siderolabs/talos-cloud-controller-manager:edge --help | grep -A 2 'controllers'
```

```shell
      --controllers strings                      A list of controllers to enable. '*' enables all on-by-default controllers, 'foo' enables the controller named 'foo', '-foo' disables the controller named 'foo'.
                                                 All controllers: certificatesigningrequest-approving-controller, cloud-node-controller, cloud-node-lifecycle-controller, node-ipam-controller, node-route-controller, service-lb-controller
                                                 Disabled-by-default controllers: certificatesigningrequest-approving-controller, node-ipam-controller, node-lifecycle-controller (default [*])
```

--------------------------------

### Platform Metadata Variables

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Lists the available platform metadata fields accessible via Go templates during node transformations.

```APIDOC
## Platform Metadata Variables

### Description
Fields available in the PlatformMetadataSpec struct for use in transformation templates.

### Fields
- **Platform** (string) - Talos platform (e.g., aws, gcp, azure).
- **Hostname** (string) - Node hostname.
- **Region** (string) - Node region (e.g., us-east-1).
- **Zone** (string) - Node zone (e.g., us-west-1f).
- **InstanceType** (string) - Instance type (e.g., t2.micro).
- **InstanceID** (string) - Instance ID.
- **ProviderID** (string) - Provider-specific ID.
- **Spot** (boolean) - Indicates if it is a spot instance.
- **InternalDNS** (string) - Internal cloud DNS name.
- **ExternalDNS** (string) - External cloud DNS name.
```

--------------------------------

### Verify Container Image Signature (Release)

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/cosign.md

Verify the keyless signature for a specific release container image using Cosign. This command targets a versioned tag and includes identity and OIDC issuer details.

```shell
# Releases
cosign verify ghcr.io/siderolabs/talos-cloud-controller-manager:v1.4.1 --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/release.yaml@refs/tags/v1.4.1 --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

--------------------------------

### PlatformMetadataSpec Go Struct

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Defines the structure for platform metadata, including details like platform, hostname, region, zone, instance type, and provider ID. Used to access cloud provider specific information for nodes.

```go
type PlatformMetadataSpec struct {
	Platform     string `yaml:"platform,omitempty" protobuf:"1"
	Hostname     string `yaml:"hostname,omitempty" protobuf:"2"
	Region       string `yaml:"region,omitempty" protobuf:"3"
	Zone         string `yaml:"zone,omitempty" protobuf:"4"
	InstanceType string `yaml:"instanceType,omitempty" protobuf:"5"
	InstanceID   string `yaml:"instanceId,omitempty" protobuf:"6"
	ProviderID   string `yaml:"providerId,omitempty" protobuf:"7"
	Spot         bool   `yaml:"spot,omitempty" protobuf:"8"
	InternalDNS  string `yaml:"internalDNS,omitempty" protobuf:"9"
	ExternalDNS  string `yaml:"externalDNS,omitempty" protobuf:"10"
}
```

--------------------------------

### Verify Container Images with Cosign

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Verify Talos Cloud Controller Manager container images using keyless signatures with Cosign, specifying certificate identity and OIDC issuer for both edge and release versions.

```shell
# Verify edge version
cosign verify ghcr.io/siderolabs/talos-cloud-controller-manager:edge \
  --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/build-edge.yaml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Verify release version
cosign verify ghcr.io/siderolabs/talos-cloud-controller-manager:v1.12.0 \
  --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/release.yaml@refs/tags/v1.12.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

--------------------------------

### Apply String Modification Functions

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Go template functions for modifying metadata strings like casing, trimming, and replacement.

```yaml
transformations:
  - name: string-examples
    nodeSelector:
      - matchExpressions:
          - key: platform
            operator: Exists
    annotations:
      # Convert to uppercase
      platform-upper: "{{ upper .Platform }}"  # "metal" -> "METAL"

      # Convert to lowercase
      hostname-lower: "{{ lower .Hostname }}"  # "WEB-01" -> "web-01"

      # Trim whitespace
      trimmed: "{{ trim .Hostname }}"  # "  web-01  " -> "web-01"

      # Remove suffix
      no-suffix: "{{ trimSuffix .Hostname \"-prod\" }}"  # "web-01-prod" -> "web-01"

      # Remove prefix
      no-prefix: "{{ trimPrefix .Hostname \"server-\" }}"  # "server-web-01" -> "web-01"

      # Replace characters
      replaced: "{{ replace .Hostname \"-\" \"_\" }}"  # "web-01" -> "web_01"
```

--------------------------------

### Configure Control Plane Nodes for External Cloud Provider

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Configure Talos machine settings for control plane nodes to enable external cloud provider mode and Talos API access.

```yaml
machine:
  kubelet:
    extraArgs:
      cloud-provider: external
      rotate-server-certificates: true
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - kube-system
```

--------------------------------

### Verify Helm Chart Signatures with Cosign

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Use Cosign to verify the signature of the Talos Cloud Controller Manager Helm chart. Ensure the certificate identity and OIDC issuer match your release process.

```shell
cosign verify ghcr.io/siderolabs/charts/talos-cloud-controller-manager:0.5.4 \
  --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/release-charts.yaml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

--------------------------------

### Transformation Parameters Configuration

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

Defines the structure and fields available for configuring node transformations within the Talos Cloud Controller Manager.

```APIDOC
## Transformation Parameters

### Description
Defines how nodes are selected and transformed using metadata, labels, annotations, and taints.

### Parameters
- **nodeSelector** (object) - Requirements for node selection based on platform metadata.
  - **matchExpressions** (array) - List of requirements.
    - **key** (string) - Selector key (case insensitive).
    - **operator** (string) - Relationship (In, NotIn, Exists, DoesNotExist, Gt, Lt, Regexp).
    - **values** (array) - String values.
- **annotations** (map) - Key-value pairs to add to matching nodes. Supports Go templates.
- **labels** (map) - Key-value pairs to add to matching nodes. Supports Go templates.
- **taints** (map) - Key-value pairs to add to matching nodes. Format '<value>:<effect>'.
- **platformMetadata** (map) - Key-value pairs to replace platform metadata variables.
- **features** (object) - Enable/disable node features.
  - **publicIPDiscovery** (boolean) - Discover public IP address (default: disable).
```

--------------------------------

### Configure Helm Chart for Metrics

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Set Helm chart values to expose Talos CCM metrics, specifying the container port and Prometheus scrape annotations.

```yaml
service:
  containerPort: 50258
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/scheme: "https"
    prometheus.io/port: "50258"
```

--------------------------------

### Apply Regex Transformation Functions

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Go template functions for extracting and replacing metadata values using regular expressions.

```yaml
transformations:
  - name: regex-examples
    nodeSelector:
      - matchExpressions:
          - key: hostname
            operator: Regexp
            values:
              - ^type-[a-z0-9]+-.*$
    annotations:
      # Find first match
      found: "{{ regexFind \"[a-zA-Z][1-9]\" .Hostname }}"  # "abcd1234" -> "d1"

      # Extract submatch by index (hostname: "type-metal1-asz")
      submatch: "{{ regexFindString \"^type-([a-z0-9]+)-(.*)$\" .Hostname 1 }}"  # -> "metal1"

      # Replace with regex
      normalized: "{{ regexReplaceAll \"a(x*)b\" .Hostname \"${1}W\" }}"  # "-ab-axxb-" -> "-W-xxW-"
```

--------------------------------

### Enable Talos CCM Metrics

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/metrics.md

Configure the Talos CCM to expose metrics by setting the secure port and allowing access to the metrics endpoint. This is typically done via command-line flags.

```yaml
talos-cloud-controller-manager
  --authorization-always-allow-paths="/metrics"
  --secure-port=50258
```

--------------------------------

### Configure Worker Nodes for External Cloud Provider

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Configure Talos machine settings for worker nodes to enable external cloud provider mode.

```yaml
machine:
  kubelet:
    extraArgs:
      cloud-provider: external
      rotate-server-certificates: true
```

--------------------------------

### Configure Global CCM Settings

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Global settings for the cloud controller manager defined in the configuration file.

```yaml
# CCM config file (ccm-config.yaml)
global:
  # Prefer IPv6 addresses over IPv4
  PreferIPv6: false
```

--------------------------------

### Enable Node CSR Approval Controller

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Methods to enable the CSR approval controller via CLI flags or Helm values.

```shell
# Enable via CLI flag
--controllers=certificatesigningrequest-approving-controller
```

```yaml
# Helm values to enable
enabledControllers:
  - cloud-node
  - node-csr-approval
```

--------------------------------

### Enable Metrics Endpoint Configuration

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Configure the CCM to expose Prometheus metrics by setting Helm values for the service or using CLI flags.

```yaml
# Helm values for metrics
service:
  containerPort: 50258
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/scheme: "https"
    prometheus.io/port: "50258"
```

```shell
# CLI flags for metrics
--secure-port=50258
--authorization-always-allow-paths="/healthz,/livez,/readyz,/metrics"
```

--------------------------------

### Verify Container Image Signature (Edge)

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/cosign.md

Verify the keyless signature for the edge container image using Cosign. This command specifies the image tag and the expected identity and OIDC issuer from GitHub Actions.

```shell
# Edge version
cosign verify ghcr.io/siderolabs/talos-cloud-controller-manager:edge --certificate-identity https://github.com/siderolabs/talos-cloud-controller-manager/.github/workflows/build-edge.yaml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

--------------------------------

### Talos Control Plane Machine Configuration

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/charts/talos-cloud-controller-manager/README.md

Configure the control plane with these machine settings, ensuring cloud-provider is set to external and server certificate rotation is enabled.

```yaml
machine:
  kubelet:
    extraArgs:
      cloud-provider: external
      # For security reasons, it is recommended to enable the rotation of server certificates.
      rotate-server-certificates: true
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - kube-system
```

--------------------------------

### Talos CCM Configuration File

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/config.md

This YAML file defines the configuration for the Talos CCM, including global parameters and transformation rules for applying labels, annotations, taints, and platform metadata to nodes based on selectors.

```yaml
# Global parameters
global:
  # PreferIPv6 uses to prefer IPv6 addresses over IPv4 addresses
  PreferIPv6: false

# Transformations rules for nodes
transformations:
  # All rules are applied in order, all matched rules are applied to the node

  - name: nocloud-nodes
    # Match nodes by nodeSelector
    nodeSelector:
      - matchExpressions:
          - key: platform           <- talos platform metadata variable case insensitive
            operator: In            <- In, NotIn, Exists, DoesNotExist, Gt, Lt, Regexp
            values:                 <- array of string values
              - nocloud
    # Set labels for matched nodes
    labels:
      pvc-storage-class/name: "my-storage-class"

  - name: web-nodes                 <- transformation name, optional
    nodeSelector:
      # Or condition for nodeSelector
      - matchExpressions:
          # And condition for matchExpressions
          - key: platform           <- talos platform metadata variable case insensitive
            operator: In            <- In, NotIn, Exists, DoesNotExist, Gt, Lt, Regexp
            values:                 <- array of string values
              - metal
          - key: hostname
            operator: Regexp
            values:
              - ^web-[W]+
      - matchExpressions:
          - key: hostname
            operator: Regexp
            values:
              - ^web-cloud-.+$

    # Add/replace annotations, labels and taints for nodes that match the transformation
    annotations:
      # You can use the Go template to get the value of the platform metadata variable
      custom-annotation/instance-id: "id-{{ .InstanceID }}"
      # You can use the functions to modify the values
      # If hostname is "web-<id>-<name>", then set the cloud-id annotation to "<id>"
      custom-annotation/cloud-id: "{{ regexFindString "^web-([a-z0-9]+)-(.*)$" .Hostname 1 }}"
    labels:
      # Add label to the node, in this case, we add well-known node role label
      node-role.kubernetes.io/web: ""
      # Set capacity-type spot/on-demand
      node-role.kubernetes.io/capacity-type: "{{ if .Spot }}spot{{ else }}on-demand{{ end }}"
    taints:
      # Add taint to the node
      node.cloudprovider.kubernetes.io/storage-type: "ceph:NoSchedule"

    # Replace platform metadata variables for nodes that match the transformation
    platformMetadata:
      Region: "{{ .Region }}-on-metal"
      Zone: "us-west-1f"
      # SKUNumber is a system information variable "t2.micro"
      InstanceType: "{{ .SKUNumber }}"
      # UUID is a system information variable "e8e8c388-5812-4db0-87e2-ad1fee51a1c1"
      ProviderID: "someproviderID:///{{ .UUID }}"

    # Features flags for nodes that match the transformation
    features:
      # Try to discover the public IP address of the node
      publicIPDiscovery: true

```

--------------------------------

### Enable Talos API Access from Kubernetes

Source: https://github.com/siderolabs/talos-cloud-controller-manager/blob/main/docs/install.md

Enable Talos API access from Kubernetes by configuring `kubernetesTalosAPIAccess` in the machine configuration. This allows specific roles and namespaces to access the Talos API.

```yaml
machine:
  kubelet:
    extraArgs:
      # For security reasons, it is recommended to enable the rotation of server certificates.
      rotate-server-certificates: true
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - kube-system
```

--------------------------------

### Configure Talos Machine for Node IPAM and Network Subnets

Source: https://context7.com/siderolabs/talos-cloud-controller-manager/llms.txt

Configure Talos machine settings to disable the default Kubernetes IPAM and specify pod and service subnets, including IPv6 ranges.

```yaml
cluster:
  controllerManager:
    extraArgs:
      controllers: ",",tokencleaner,-node-ipam-controller"
  network:
    podSubnets: ["10.32.0.0/12","fd00:10:32::/64"]
    serviceSubnets: ["10.200.0.0/22","fd40:10:200::/108"]
```