Talos Linux

https://docs.siderolabs.com
Admin
Talos Linux is a Kubernetes-optimized, minimal, and secure Linux distribution designed for efficient...
Tokens:635,685
Snippets:7,000
Trust Score:8.8
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start Omni Instance with Docker

Source: https://docs.siderolabs.com/omni/self-hosted/expose-omni-with-nginx-https

Example command to start an Omni instance using Docker with the necessary network configurations and flags for an Nginx setup.

```bash
docker run \
    --net=host \
    --cap-add=NET_ADMIN \
    --device /dev/net/tun \
    -v $PWD/etcd:/_out/etcd \
    -v $PWD/omni.asc:/omni.asc \
    ghcr.io/siderolabs/omni:<tag> \
        --name=$OMNI_NAME \
        --private-key-source=file:///omni.asc \
        --bind-addr=127.0.0.1:8080 \
        --advertised-api-url=https://$OMNI_DOMAIN_NAME/ \
        --siderolink-api-bind-addr=127.0.0.1:8090 \
        --siderolink-api-advertised-url=https://api.$OMNI_DOMAIN_NAME:443 \
        --k8s-proxy-bind-addr=127.0.0.1:8100 \
        --advertised-kubernetes-proxy-url=https://kube.$OMNI_DOMAIN_NAME/ \
        --account-id=$OMNI_ACCOUNT_UUID \
        --auth-auth0-enabled=true \
        --auth-auth0-domain=<Auth0 domain> \
        --auth-auth0-client-id=<Auth0 client ID> \
        --initial-users=<email address>
```

--------------------------------

### UnattendedInstallConfig document example

Source: https://docs.siderolabs.com/talos/v1.14/configure-your-talos-cluster/lifecycle-management/unattended-install

Example configuration to install Talos to a specific disk using a stable path.

```yaml
apiVersion: v1alpha1
kind: UnattendedInstallConfig
installer:
  image: factory.talos.dev/metal-installer/<schematic-id>:<talos-version>
provisioning:
  diskSelector:
    match: disk.dev_path == "/dev/sda"
  wipe: true
```

--------------------------------

### Download the example secret

Source: https://docs.siderolabs.com/kubernetes-guides/csi/dell-powerstore

Download the Dell example secret configuration file.

```bash
curl -sL -o config.yaml https://raw.githubusercontent.com/dell/csi-powerstore/main/samples/secret/secret.yaml
```

--------------------------------

### Install QEMU on Ubuntu

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/local-platforms/qemu

Install the necessary QEMU packages on an Ubuntu x86 system.

```bash
apt install qemu-system-x86 qemu-kvm
```

--------------------------------

### Inspect logs during installation

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/local-platforms/qemu

Use the tail command to follow logs in real-time during the installation process.

```bash
tail -f ~/.talos/clusters/<cluster-name>/*.log
```

--------------------------------

### Start and autostart network

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/virtualized-platforms/kvm

Start the network and ensure it automatically starts after a reboot.

```bash
virsh net-start my-talos-net
virsh net-autostart my-talos-net
```

--------------------------------

### Start the VirtualMachine

Source: https://docs.siderolabs.com/talos/v1.14/advanced-guides/install-kubevirt

Command to start the defined virtual machine.

```bash
kubectl virt start fedora-vm
```

--------------------------------

### Talos OAuth device flow initiation logs

Source: https://docs.siderolabs.com/talos/v1.14/security/machine-config-oauth

Example console output showing the start of the OAuth device authentication flow, including client ID, URLs, and required variables.

```text
[talos] downloading config {"component": "controller-runtime", "controller": "config.AcquireController", "platform": "metal"}
[talos] waiting for network to be ready
[talos] [OAuth] starting the authentication device flow with the following settings:
[talos] [OAuth]  - client ID: "<REDACTED>"
[talos] [OAuth]  - device auth URL: "https://oauth2.googleapis.com/device/code"
[talos] [OAuth]  - token URL: "https://oauth2.googleapis.com/token"
[talos] [OAuth]  - extra variables: ["uuid" "mac"]
[talos] waiting for variables: [uuid mac]
[talos] waiting for variables: [mac]
[talos] [OAuth] please visit the URL https://www.google.com/device and enter the code <REDACTED>
[talos] [OAuth] waiting for the device to be authorized (expires at 14:46:55)...
```

--------------------------------

### Install components after bootstrap

Source: https://docs.siderolabs.com/kubernetes-guides/monitoring-and-observability/deploy-metrics-server

Install the cert approver and metrics-server using kubectl after the cluster is online.

```sh
kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
```

--------------------------------

### PTP Configuration Example

Source: https://docs.siderolabs.com/talos/v1.14/reference/configuration/network/timesyncconfig

Example configuration for synchronizing system time using PTP devices.

```yaml
apiVersion: v1alpha1
kind: TimeSyncConfig
# Specific PTP (Precision Time Protocol) configuration to sync the time over PTP devices.
ptp:
    # description: |
    devices:
        - /dev/ptp0
```

--------------------------------

### Install virtctl via krew

Source: https://docs.siderolabs.com/talos/v1.14/advanced-guides/install-kubevirt

Install the virtctl plugin for kubectl using krew.

```bash
kubectl krew install virt
```

--------------------------------

### NTP Configuration Example

Source: https://docs.siderolabs.com/talos/v1.14/reference/configuration/network/timesyncconfig

Example configuration for synchronizing system time using NTP servers.

```yaml
apiVersion: v1alpha1
kind: TimeSyncConfig
# Specifies NTP configuration to sync the time over network.
ntp:
    # Specifies time (NTP) servers to use for setting the system time.
    servers:
        - pool.ntp.org
```

--------------------------------

### Install QEMU via Homebrew

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/local-platforms/qemu

Install QEMU on macOS using the Homebrew package manager.

```bash
brew install qemu
```

--------------------------------

### Install sidero-tools via Homebrew

Source: https://docs.siderolabs.com/omni/getting-started/getting-started

Install the required talosctl and omnictl tools using Homebrew.

```bash
  brew tap siderolabs/tap
  brew trust siderolabs/tap
  brew install siderolabs/tap/sidero-tools
```

--------------------------------

### Deploy sample application

Source: https://docs.siderolabs.com/talos/v1.14/getting-started/deploy-first-workload

Deploys the example workload and exposes it via a NodePort using kubectl.

```bash
kubectl apply -f https://raw.githubusercontent.com/siderolabs/example-workload/refs/heads/main/deploy/example-svc-nodeport.yaml
```

--------------------------------

### Start QEMU VM with Cloud-Init ISO

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/cloud-platforms/nocloud

Launch the QEMU virtual machine using the generated cloud-init ISO.

```bash
qemu-system-x86_64 \
    ...
    -cdrom iso/cidata.iso \
    ...
```

--------------------------------

### Start tsidp Service

Source: https://docs.siderolabs.com/omni/security-and-authentication/oidc-login-with-tailscale

Start only the tsidp service to begin the OIDC client setup process. This allows you to register Omni as a client.

```bash
docker compose up tsidp
```

--------------------------------

### UnattendedInstallConfig with symlink selector

Source: https://docs.siderolabs.com/talos/v1.14/configure-your-talos-cluster/lifecycle-management/unattended-install

Example configuration using a disk symlink for the installer image.

```yaml
apiVersion: v1alpha1
kind: UnattendedInstallConfig
installer:
  image: factory.talos.dev/metal-installer/<schematic-id>:v1.14.0
provisioning:
  diskSelector:
    match: '"/dev/disk/by-id/nvme-SAMSUNG_MZQL21T9" in disk.symlinks'
```

--------------------------------

### Example build output

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/kernel-module

Shows the expected output when pushing the kernel and package images to the registry.

```bash
=> => pushing manifest for 127.0.0.1:5005/user/kernel:v1.11.0-alpha.0...
...
=> => pushing manifest for 127.0.0.1:5005/user/my-module-pkg:v1.11.0-alpha.0...
```

--------------------------------

### Example output for kubectl get nodes

Source: https://docs.siderolabs.com/talos/v1.14/getting-started/quickstart

The expected output when verifying the cluster nodes.

```sh
 NAME            STATUS   ROLES           AGE     VERSION             INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                    KERNEL-VERSION   CONTAINER-RUNTIME
talos-cfx-nh0   Ready    <none>          2m53s   v1.37.0     10.5.13.47    <none>        Talos v1.14.0      <host kernel>    containerd://2.1.6
talos-vb5-xfr   Ready    control-plane   2m51s   v1.37.0     10.5.13.46    <none>        Talos v1.14.0      <host kernel>    containerd://2.1.6 
```

--------------------------------

### Clone the pkgs repository and create a module directory

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/kernel-module

Initial setup steps to prepare the local environment for adding a new package.

```bash
git clone https://github.com/siderolabs/pkgs.git
cd pkgs
mkdir my-module
```

--------------------------------

### Verify local environment setup

Source: https://docs.siderolabs.com/kubernetes-guides/advanced-guides/deploy-traefik

Check that kubectl and helm are installed and configured to communicate with your cluster.

```bash
kubectl get nodes
helm version
```

--------------------------------

### Apply configuration and verify secure access

Source: https://docs.siderolabs.com/talos/v1.14/configure-your-talos-cluster/system-configuration/insecure

Example showing the initial insecure configuration application followed by a secure command execution.

```bash
# First time applying configuration (requires --insecure)

talosctl apply-config --insecure --nodes 192.168.1.100 --file controlplane.yaml

# After configuration is applied, subsequent commands are secure

talosctl get disks --nodes 192.168.1.100 --talosconfig=./talosconfig
```

--------------------------------

### UnattendedInstallConfig YAML Configuration

Source: https://docs.siderolabs.com/talos/v1.14/reference/configuration/runtime/unattendedinstallconfig

A complete example of an UnattendedInstallConfig resource, specifying the installer image and disk provisioning rules.

```yaml
apiVersion: v1alpha1
kind: UnattendedInstallConfig
# The installer describes the source of the installation.
installer:
    image: factory.talos.dev/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:latest # Allows for supplying the image used to perform the installation.
# The provisioning describes how the installation disk should be provisioned.
provisioning:
    # Matches disks to initialize as physical volumes.
    diskSelector:
        match: disk.dev_path == "/dev/sda" # CEL expression matching a disk.
    wipe: true # Indicates if the installation disk should be wiped at installation time.
```

--------------------------------

### KubeCredentialProviderConfig YAML configuration

Source: https://docs.siderolabs.com/talos/v1.14/reference/configuration/kubernetes/kubecredentialproviderconfig

Example configuration for the Kubelet credential provider, specifically showing the setup for the ECR credential provider.

```yaml
apiVersion: v1alpha1
kind: KubeCredentialProviderConfig
# Kubelet credential provider configuration (used for image registry authentication).
configuration:
    apiVersion: kubelet.config.k8s.io/v1
    kind: CredentialProviderConfig
    providers:
        - apiVersion: credentialprovider.kubelet.k8s.io/v1
          defaultCacheDuration: 12h
          matchImages:
            - '*.dkr.ecr.*.amazonaws.com'
            - '*.dkr.ecr.*.amazonaws.com.cn'
            - '*.dkr.ecr-fips.*.amazonaws.com'
            - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
            - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
          name: ecr-credential-provider
```

--------------------------------

### Build installer with local registry

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/building-images

Use a local registry running on 127.0.0.1:5005 to avoid network overhead.

```bash
make installer REGISTRY=127.0.0.1:5005
```

--------------------------------

### Example Syscall Audit Log Output

Source: https://docs.siderolabs.com/kubernetes-guides/security/seccomp-profiles

This is the expected output format in the terminal running the talosctl dmesg command after the pod starts.

```text
10.5.0.3: kern:    info: [2022-07-28T11:49:42.489473063Z]: cni0: port 1(veth32488a86) entered blocking state
10.5.0.3: kern:    info: [2022-07-28T11:49:42.490852063Z]: cni0: port 1(veth32488a86) entered disabled state
10.5.0.3: kern:    info: [2022-07-28T11:49:42.492470063Z]: device veth32488a86 entered promiscuous mode
10.5.0.3: kern:    info: [2022-07-28T11:49:42.503105063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
10.5.0.3: kern:    info: [2022-07-28T11:49:42.503944063Z]: IPv6: ADDRCONF(NETDEV_CHANGE): veth32488a86: link becomes ready
10.5.0.3: kern:    info: [2022-07-28T11:49:42.504764063Z]: cni0: port 1(veth32488a86) entered blocking state
10.5.0.3: kern:    info: [2022-07-28T11:49:42.505423063Z]: cni0: port 1(veth32488a86) entered forwarding state
10.5.0.3: kern: warning: [2022-07-28T11:49:44.873616063Z]: kauditd_printk_skb: 14 callbacks suppressed
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.873619063Z]: audit: type=1326 audit(1659008985.445:25): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.876609063Z]: audit: type=1326 audit(1659008985.445:26): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.878789063Z]: audit: type=1326 audit(1659008985.449:27): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=257 compat=0 ip=0x55ec0657bdaa code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.886693063Z]: audit: type=1326 audit(1659008985.461:28): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.888764063Z]: audit: type=1326 audit(1659008985.461:29): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=202 compat=0 ip=0x55ec06532b43 code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.891009063Z]: audit: type=1326 audit(1659008985.461:30): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=1 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.893162063Z]: audit: type=1326 audit(1659008985.461:31): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=3 compat=0 ip=0x55ec0657bd3b code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.895365063Z]: audit: type=1326 audit(1659008985.461:32): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=39 compat=0 ip=0x55ec066eb68b code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.898306063Z]: audit: type=1326 audit(1659008985.461:33): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="runc:[2:INIT]" exe="/" sig=0 arch=c000003e syscall=59 compat=0 ip=0x55ec0657be16 code=0x7ffc0000
10.5.0.3: kern:  notice: [2022-07-28T11:49:44.901518063Z]: audit: type=1326 audit(1659008985.473:34): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2784 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=158 compat=0 ip=0x455f35 code=0x7ffc0000
```

--------------------------------

### Configure BGPInstanceConfig with installRoutes disabled

Source: https://docs.siderolabs.com/talos/v1.14/networking/bgp/overview

Example of a BGPInstanceConfig where installRoutes is set to false, preventing Talos from installing learned paths into the Linux FIB.

```yaml
apiVersion: v1alpha1
kind: BGPInstanceConfig
name: workload
vrf: vrf-workload
localASN: 4200000002
routerID: 10.0.0.10
installRoutes: false
neighbors:
  - address: "fda1:b2c3:d4e5:1::"
    peerASN: 4200000003
    passive: true
```

--------------------------------

### Download ISO with PXE boot URL output

Source: https://docs.siderolabs.com/omni/omni-cluster-setup/how-to-set-initial-machine-labels

Example of using the --pxe flag to output a PXE boot URL with initial labels applied.

```bash
omnictl download iso --initial-labels environment=production,region=us-west --pxe
```

--------------------------------

### Create device via Equinix Metal CLI example

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/bare-metal-platforms/equinix-metal

An example invocation of the metal device create command with specific project, plan, and hostname parameters.

```bash
metal device create -p <projectID> -f da11 -O custom_ipxe -P c3.small.x86 -H steve.test.11 --userdata-file ./controlplane.yaml --ipxe-script-url "https://pxe.factory.talos.dev/pxe/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v1.14.0/equinixMetal-amd64"
```

--------------------------------

### DiscoveredVolumes resource specification

Source: https://docs.siderolabs.com/talos/v1.14/configure-your-talos-cluster/storage-and-disk-management/disk-management/common

Example output of a DiscoveredVolumes resource, which can be retrieved using talosctl get discoveredvolumes -o yaml to inspect available fields for the volume selector.

```yaml
metadata:
    namespace: runtime
    type: DiscoveredVolumes.block.talos.dev
    id: vda4
    version: 1
    owner: block.DiscoveryController
    phase: running
    created: 2025-07-21T13:10:56Z
    updated: 2025-07-21T13:10:56Z
spec:
    dev_path: /dev/vda4
    type: partition
    device_path: /sys/devices/pci0000:00/0000:00:07.0/virtio4/block/vda/vda4
    parent: vda
    parent_dev_path: /dev/vda
    size: 5179965440
    pretty_size: 5.2 GB
    sector_size: 512
    io_size: 512
    name: xfs
    uuid: 2f115241-781f-4817-a373-fc957d63326f
    label: EPHEMERAL
    block_size: 512
    filesystem_block_size: 4096
    probed_size: 5112856576
    partition_uuid: 73111630-87ed-4aad-bffb-af6d0f55ab3c
    partition_type: 0fc63daf-8483-4772-8e79-3d69d8477de4
    partition_label: EPHEMERAL
    partition_index: 4
```

--------------------------------

### Build and push installer images

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/developing-talos

Builds the base, imager, and installer components and pushes them to the local registry.

```bash
make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true INSTALLER_ARCH=targetarch
make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
```

--------------------------------

### Configure a numbered BGP peer

Source: https://docs.siderolabs.com/talos/v1.14/networking/bgp/overview

Example configuration for a numbered BGP peer that advertises an address from the loopback interface, peers with 192.0.2.1, and installs routes into the main routing table.

```yaml
apiVersion: v1alpha1
kind: LinkConfig
name: lo
addresses:
  - address: 10.0.0.10/32
---
apiVersion: v1alpha1
kind: BGPInstanceConfig
name: fabric
localASN: 65001
routerID: 10.0.0.10
routeSource: 10.0.0.10
advertise:
  - lo
neighbors:
  - address: 192.0.2.1
    peerASN: 65000
    holdTime: 90s
```

--------------------------------

### Set up cross-build environment

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/developing-talos

Configures the cross-build environment using multiarch/qemu-user-static.

```bash
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
```

--------------------------------

### Example output of talosctl get members

Source: https://docs.siderolabs.com/talos/v1.14/configure-your-talos-cluster/system-configuration/discovery

This shows the expected output format when querying cluster members, displaying node ID, version, hostname, machine type, OS version, and IP addresses.

```sh

    ID                             VERSION   HOSTNAME                       MACHINE TYPE   OS                ADDRESSES
    talos-default-controlplane-1   2         talos-default-controlplane-1   controlplane   Talos ${release_v1_14}   ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"]
    talos-default-controlplane-2   1         talos-default-controlplane-2   controlplane   Talos ${release_v1_14}   ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"]
    talos-default-controlplane-3   1         talos-default-controlplane-3   controlplane   Talos ${release_v1_14}   ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"]
    talos-default-worker-1         1         talos-default-worker-1         worker         Talos ${release_v1_14}   ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"]
    talos-default-worker-2         1         talos-default-worker-2         worker         Talos ${release_v1_14}   ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"]
    
```

--------------------------------

### Prepare Cloud-Init Configuration Files

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/cloud-platforms/nocloud

Create the user-data, meta-data, and network-config files required for the NoCloud ISO.

```bash
mkdir -p iso
mv _out/controlplane.yaml iso/user-data
echo "local-hostname: controlplane-1" > iso/meta-data
cat > iso/network-config << EOF
version: 1
config:
   - type: physical
     name: eth0
     mac_address: "52:54:00:12:34:00"
     subnets:
        - type: static
          address: 192.168.1.10
          netmask: 255.255.255.0
          gateway: 192.168.1.254
EOF
```

--------------------------------

### Upgrade existing machine with installer

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/kernel-module

Upgrade an existing Talos installation using the custom installer image.

```bash
talosctl upgrade -i $REGISTRY/$USER/installer:$TAG
```

--------------------------------

### Install Local Path Provisioner

Source: https://docs.siderolabs.com/kubernetes-guides/csi/local-storage

Apply the kustomization configuration to the cluster.

```bash
kustomize build | kubectl apply -f -
```

--------------------------------

### Create installer image

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/kernel-module

Generates the final installer image by combining the base installer and the system extension.

```bash
make image-installer \
  REGISTRY=127.0.0.1:5005 \
  IMAGER_ARGS="--base-installer-image=${BASE_INSTALLER_IMAGE} \
    --system-extension-image=${EXTENSION_IMAGE}"
```

--------------------------------

### Deploy sample application

Source: https://docs.siderolabs.com/omni/getting-started/getting-started

Deploys a sample service to the cluster using kubectl.

```bash
 kubectl apply -f \
    https://raw.githubusercontent.com/siderolabs/example-workload/refs/heads/main/deploy/example-svc-nodeport.yaml
```

--------------------------------

### Create working directory

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/virtualized-platforms/kvm

Initialize the project directory for storing configuration files.

```bash
mkdir -p ~/talos-kvm/configs
cd ~/talos-kvm
```

--------------------------------

### CLI install Cilium with kube-proxy

Source: https://docs.siderolabs.com/kubernetes-guides/cni/deploying-cilium

Installs Cilium directly using helm install with kube-proxy enabled.

```bash
helm repo add cilium https://helm.cilium.io/
helm repo update

helm install \
    cilium \
    cilium/cilium \
    --version 1.18.0 \
    --namespace kube-system \
    --set ipam.mode=kubernetes \
    --set kubeProxyReplacement=false \
    --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
    --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
    --set cgroup.autoMount.enabled=false \
    --set cgroup.hostRoot=/sys/fs/cgroup
```

--------------------------------

### Push installer image to registry

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot

Push the generated installer container image to a registry accessible by Talos during installation.

```sh
crane push _out/installer-amd64-secureboot.tar ghcr.io/<user>/installer-amd64-secureboot:${release_v1_14}
```

--------------------------------

### Generate SecureBoot installer image

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot

Generate an installer image configured for SecureBoot to facilitate Talos installation to disk.

```sh
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_14} secureboot-installer
    profile ready:
    arch: amd64
    platform: metal
    secureboot: true
    version: ${release_v1_14}
    input:
    kernel:
      path: /usr/install/amd64/vmlinuz
    initramfs:
      path: /usr/install/amd64/initramfs.xz
    sdStub:
      path: /usr/install/amd64/systemd-stub.efi
    sdBoot:
      path: /usr/install/amd64/systemd-boot.efi
    baseInstaller:
      imageRef: ghcr.io/siderolabs/installer-base:${release_v1_14}
    secureboot:
      signingKeyPath: /secureboot/uki-signing-key.pem
      signingCertPath: /secureboot/uki-signing-cert.pem
      pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
      pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
      platformKeyPath: /secureboot/PK.auth
      keyExchangeKeyPath: /secureboot/KEK.auth
      signatureKeyPath: /secureboot/db.auth
    output:
    kind: installer
    outFormat: raw
    skipped initramfs rebuild (no system extensions)
    kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
    UKI ready
    installer container image ready
    output asset path: /out/installer-amd64-secureboot.tar
```

--------------------------------

### Create and configure instance profile

Source: https://docs.siderolabs.com/omni/cluster-management/scale-your-cluster/cluster-autoscaler-aws

Create an instance profile and associate the IAM role with it, then wait for propagation.

```bash
aws iam create-instance-profile \
  --instance-profile-name $AUTOSCALER_INSTANCE_PROFILE_NAME

aws iam add-role-to-instance-profile \
  --instance-profile-name $AUTOSCALER_INSTANCE_PROFILE_NAME \
  --role-name $AUTOSCALER_ROLE_NAME

echo "Waiting for IAM instance profile propagation..."
sleep 20
```

--------------------------------

### SecureBoot Installer Image Path

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot

The installer image path to be used in the Talos machine configuration for SecureBoot installations.

```text
factory.talos.dev/metal-installer-secureboot/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:${release_v1_14}
```

--------------------------------

### Download amd64 ISO with initial labels

Source: https://docs.siderolabs.com/omni/omni-cluster-setup/how-to-set-initial-machine-labels

An example command to download an amd64 ISO image with environment and region labels applied.

```bash
omnictl download iso --arch amd64 \
  --initial-labels environment=production,region=us-west
```

--------------------------------

### Flash and boot from eMMC

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/single-board-computers/turing_rk1

Flash the raw image to the eMMC and power on the node using the tpi CLI.

```bash
tpi flash -n <NODENUMBER> -i metal-arm64.raw
tpi power on -n <NODENUMBER>
```

--------------------------------

### Generate custom installer image

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/single-board-computers/rpi_generic

Create a custom installer image containing the required system extensions for installation or upgrades.

```bash
$ docker run --rm -t -v $PWD/_out:/out ghcr.io/siderolabs/imager:v1.14.0 installer   --arch arm64   --overlay-image ghcr.io/siderolabs/sbc-raspberrypi:v0.1.0@sha256:849ace01b9af514d817b05a9c5963a35202e09a4807d12f8a3ea83657c76c863   --overlay-name=rpi_generic   --overlay-option="configTxt=$(cat <<EOF
  gpu_mem=128
  kernel=u-boot.bin
  arm_64bit=1
  arm_boost=1
  enable_uart=1
  dtoverlay=disable-bt
  dtoverlay=disable-wifi
  avoid_warnings=2
  dtoverlay=vc4-kms-v3d,noaudio
  EOF
  )"   --system-extension-image ghcr.io/siderolabs/vc4:v0.1.4@sha256:548b2b121611424f6b1b6cfb72a1669421ffaf2f1560911c324a546c7cee655e
  ...
  output asset path: /out/metal-arm64-installer.tar
```

--------------------------------

### CLI install Cilium without kube-proxy

Source: https://docs.siderolabs.com/kubernetes-guides/cni/deploying-cilium

Installs Cilium directly using helm install with kube-proxy replacement enabled.

```bash
helm repo add cilium https://helm.cilium.io/
helm repo update

helm install \
    cilium \
    cilium/cilium \
    --version 1.18.0 \
    --namespace kube-system \
    --set ipam.mode=kubernetes \
    --set kubeProxyReplacement=true \
    --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
    --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
    --set cgroup.autoMount.enabled=false \
    --set cgroup.hostRoot=/sys/fs/cgroup \
    --set k8sServiceHost=localhost \
    --set k8sServicePort=7445
```

--------------------------------

### Bring up Vagrant environment

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/virtualized-platforms/vagrant-libvirt

Provision the Vagrant environment using the libvirt provider.

```bash
vagrant up --provider=libvirt
```

--------------------------------

### Example config.yaml configuration

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/cloud-platforms/gcp

An example configuration file for the GCP deployment manager, defining resources and properties like node counts and versions.

```bash
imports:
- path: talos-ha.jinja

resources:
- name: talos-ha
  type: talos-ha.jinja
  properties:
    zone: us-west1-b
    talosVersion: ${release_v1_14}
    externalCloudProvider: false
    controlPlaneNodeCount: 5
    controlPlaneNodeType: n1-standard-1
    workerNodeCount: 3
    workerNodeType: n1-standard-1
outputs:
- name: bucketName
  value: $(ref.talos-ha.bucketName)
```

--------------------------------

### Install talosctl via installer script

Source: https://docs.siderolabs.com/talos/v1.14/getting-started/talosctl

An alternative installation method for environments without Homebrew, supporting macOS, Linux, and WSL on Windows.

```bash
curl -sL https://talos.dev/install | sh
```

--------------------------------

### Install Wiz connector via Helm

Source: https://docs.siderolabs.com/kubernetes-guides/security/wiz-kubernetes-connector

Step 4 of the Helm installation process: install the connector using the Helm chart and your values file.

```bash
helm install wiz-kubernetes-connector wiz/wiz-kubernetes-connector \
    --namespace wiz \
    --values wiz-values.yaml
```

--------------------------------

### Configure config.txt for vc4 system extension

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/single-board-computers/rpi_generic

Example configuration for the vc4 extension, including setting GPU memory and enabling the overlay.

```text
...
gpu_mem=128 # <== Add or edit this line
...
hdmi_safe:0=1 # <== Remove this line
hdmi_safe:1=1 # <== Remove this line
...
avoid_warnings=2 # <== Add this line
dtoverlay=vc4-kms-v3d,noaudio # <== Add this line
...
```

--------------------------------

### Build an overlay with default settings

Source: https://docs.siderolabs.com/talos/v1.14/build-and-extend-talos/custom-images-and-development/overlays

Builds the specified overlay using default registry and username settings.

```bash
make sbc-rockchip PUSH=true
```

--------------------------------

### InstallerSpec Configuration

Source: https://docs.siderolabs.com/talos/v1.14/reference/configuration/runtime/unattendedinstallconfig

Defines the installer image source for the installation process.

```yaml
installer:
    image: factory.talos.dev/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:latest # Allows for supplying the image used to perform the installation.
```

--------------------------------

### Verify installation pods

Source: https://docs.siderolabs.com/kubernetes-guides/csi/simplyblock-storage

Monitor the status of the Simplyblock pods after installation.

```bash
kubectl --namespace=simplyblock get pods \
  --selector="release=simplyblock-csi" --watch
```

--------------------------------

### Install Rook Operator

Source: https://docs.siderolabs.com/kubernetes-guides/csi/ceph-with-rook

Installs the Rook operator into the rook-ceph namespace.

```bash
helm install --create-namespace --namespace rook-ceph rook-ceph rook-release/rook-ceph
```

--------------------------------

### Install dependencies via Homebrew

Source: https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/cloud-platforms/aws

Install the necessary tools including talosctl, kubectl, jq, curl, and xz.

```bash
brew install siderolabs/tap/talosctl kubectl jq curl xz
```

--------------------------------

### Configure Proxy via Kernel Command Line

Source: https://docs.siderolabs.com/talos/v1.14/networking/corporate-proxies

Apply proxy settings during initial boot by passing them as kernel command line arguments.

```text
talos.environment=http_proxy=<http-proxy> talos.environment=https_proxy=<https-proxy>
```
Tokens:
Raw