Talos Linux

https://docs.siderolabs.com/talos/v1.12/
Admin
Talos Linux is a Kubernetes-optimized Linux distribution designed as a modern, minimal, secure, and...
Tokens:262,012
Snippets:3,140
Trust Score:8.8
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start QEMU VM with Cloud-Init ISO

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/nocloud

Example of starting a QEMU VM, ensuring the generated cloud-init ISO is attached as a CDROM.

```bash
qemu-system-x86_64 \
    ... \
    -cdrom iso/cidata.iso \
    ...
```

--------------------------------

### Machine Configuration Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/v1alpha1/config

Defines machine-specific configuration values, including the machine type and installation settings like disk, image, and wipe behavior.

```yaml
machine:
    type: controlplane
    # InstallConfig represents the installation options for preparing a node.
    install:
        disk: /dev/sda # The disk used for installations.
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.
        grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

```

--------------------------------

### Basic Virtual Machine with Default CNI

Source: https://docs.siderolabs.com/talos/v1.12/advanced-guides/install-kubevirt

Defines a basic Fedora 40 virtual machine with default CNI and installs a webserver. This example also includes cloud-init for user data and network configuration.

```yaml
---
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: fedora-vm
spec:
  running: false
  template:
    metadata:
      labels:
        kubevirt.io/vm: fedora-vm
      annotations:
        kubevirt.io/allow-pod-bridge-network-live-migration: "true"

    spec:
      evictionStrategy: LiveMigrate
      domain:
        cpu:
          cores: 2
        resources:
          requests:
            memory: 4G
        devices:
          disks:
            - name: fedora-vm-pvc
              disk:
                bus: virtio
            - name: cloudinitdisk
              disk:
                bus: virtio
          interfaces:
          - name: podnet
            masquerade: {}
      networks:
        - name: podnet
          pod: {}
      volumes:
        - name: fedora-vm-pvc
          persistentVolumeClaim:
            claimName: fedora-vm-pvc
        - name: cloudinitdisk
          cloudInitNoCloud:
            networkData: |
              network:
                version: 1
                config:
                  - type: physical
                    name: eth0
                    subnets:
                      - type: dhcp
            userData: |-
              #cloud-config
              users:
                - name: cloud-user
                  ssh_authorized_keys:
                    - ssh-rsa ....
                  sudo: ['ALL=(ALL) NOPASSWD:ALL']
                  groups: sudo
                  shell: /bin/bash
              runcmd:
                - "sudo touch /root/installed"
                - "sudo dnf update"
                - "sudo dnf install httpd fastfetch -y"
                - "sudo systemctl daemon-reload"
                - "sudo systemctl enable httpd"
                - "sudo systemctl start --no-block httpd"

  dataVolumeTemplates:
  - metadata:
      name: fedora-vm-pvc
    spec:
      storage:
        resources:
          requests:
            storage: 35Gi
        accessModes:
          - ReadWriteMany
        storageClassName: "nfs-csi"
      source:
        http:
          url: "https://fedora.mirror.wearetriple.com/linux/releases/40/Cloud/x86_64/images/Fedora-Cloud-Base-Generic.x86_64-40-1.14.qcow2"

```

--------------------------------

### Install QEMU on Ubuntu (x86)

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/local-platforms/qemu

Installs QEMU system emulator and KVM for x86 architecture on Ubuntu systems.

```bash
apt install qemu-system-x86 qemu-kvm
```

--------------------------------

### Start Virtual Machine

Source: https://docs.siderolabs.com/talos/v1.12/advanced-guides/install-kubevirt

Command to start a KubeVirt virtual machine after its DataVolume has been created.

```bash
kubectl virt start fedora-vm
```

--------------------------------

### Load and Push Installer Image using Docker

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/kernel-module

Alternatively, load the installer image tarball using Docker, tag it, and then push it to your registry if you do not have `crane` installed.

```bash
docker load -i _out/installer-amd64.tar
# note down sha256 or the image tag output from above command

docker tag $SHA256_OR_IMAGE_TAG $REGISTRY/$USER/installer:$TAG
docker push $REGISTRY/$USER/installer:$TAG
```

--------------------------------

### Download talosctl Installer

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/single-board-computers/rpi_generic

Fetches the latest talosctl installation script. This is a prerequisite for installing Talos.

```bash
curl -sL 'https://www.talos.dev/install' | bash
```

--------------------------------

### StaticHostConfig Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/network/statichostconfig

This example demonstrates how to configure a StaticHostConfig resource. It maps the IP address '10.5.0.2' to the hostnames 'my-server' and 'my-server.example.org'.

```yaml
apiVersion: v1alpha1
kind: StaticHostConfig
name: 10.5.0.2 # IP address (IPv4 or IPv6) to map the hostnames to.
# List of hostnames to map to the IP address.
hostnames:
    - my-server
    - my-server.example.org
```

--------------------------------

### Install talosctl via installer script

Source: https://docs.siderolabs.com/talos/v1.12/getting-started/talosctl

Automated installation script for macOS, Linux, and WSL on Windows. Requires manual re-execution for updates.

```bash
curl -sL https://talos.dev/install | sh
```

--------------------------------

### Build and Push Talos Installer Images

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/developing-talos

Builds and pushes the installer base image, imager, and installer for a development version of Talos to a specified registry.

```bash
make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make installer IMAGE_REGISTRY=127.0.0.1:5005
```

--------------------------------

### Basic Install Configuration

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/v1alpha1/config

Defines the essential parameters for Talos installation, such as the target disk, installation image, and whether to wipe the disk.

```yaml
machine:
    install:
        disk: /dev/sda # The disk used for installations.
        image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
        wipe: false # Indicates if the installation disk should be wiped at installation time.
        grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.

        # # Look up disk using disk attributes like model, size, serial and others.
        # diskSelector:
        #     size: 4GB # Disk size.
        #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
        #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

```

--------------------------------

### Build Installer Base and Imager

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/kernel-module

Build the `installer-base` and `imager` components for Talos installation media. Ensure you specify the correct kernel image and registry details.

```bash
make installer-base imager PLATFORM=linux/amd64 \
  INSTALLER_ARCH=amd64 \
  REGISTRY=127.0.0.1:5005 \
  PKG_KERNEL=${KERNEL_IMAGE} \
  PUSH=true
```

--------------------------------

### Push Installer Image to Registry

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/bare-metal-platforms/secureboot

After generating the installer image, push it to a container registry that Talos can access during installation. Replace <user> with your registry username or organization.

```sh
crane push _out/installer-amd64-secureboot.tar ghcr.io/<user>/installer-amd64-secureboot:${release_v1_12}
```

--------------------------------

### Build and Push Talos Installer Image

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/developing-talos

Builds the main installer image for Talos and pushes it to the specified local registry. This is a crucial step for creating deployable Talos installations.

```bash
make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
```

--------------------------------

### Install virtctl using Krew

Source: https://docs.siderolabs.com/talos/v1.12/advanced-guides/install-kubevirt

Install the `virtctl` client using `kubectl krew`. This provides a convenient way to integrate `virtctl` into your kubectl workflow.

```bash
kubectl krew install virt
```

--------------------------------

### Inspect logs during installation

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/local-platforms/qemu

Use this command to continuously monitor new log entries as they are written during installation.

```bash
tail -f ~/.talos/clusters/<cluster-name>/*.log
```

--------------------------------

### Build Installer Image with Local Registry

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/building-images

Builds the installer image using a local registry running on 127.0.0.1:5005 to avoid network transfer.

```bash
make installer REGISTRY=127.0.0.1:5005
```

--------------------------------

### Install QEMU on macOS via Homebrew

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/local-platforms/qemu

Installs QEMU on macOS using the Homebrew package manager.

```bash
brew install qemu
```

--------------------------------

### Install VirtualBox on Ubuntu

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/local-platforms/virtualbox

Installs VirtualBox using the apt package manager on Ubuntu systems.

```bash
apt install virtualbox
```

--------------------------------

### Full Network Configuration Example

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/bare-metal-platforms/metal-network-configuration

A comprehensive example of a Talos network configuration file, including addresses, links, routes, hostnames, resolvers, and time servers.

```yaml
addresses:
    - address: 147.75.61.43/31
      linkName: bond0
      family: inet4
      scope: global
      flags: permanent
      layer: platform
    - address: 2604:1380:45f2:6c00::1/127
      linkName: bond0
      family: inet6
      scope: global
      flags: permanent
      layer: platform
    - address: 10.68.182.1/31
      linkName: bond0
      family: inet4
      scope: global
      flags: permanent
      layer: platform
links:
    - name: eth0
      up: true
      masterName: bond0
      slaveIndex: 0
      layer: platform
    - name: eth1
      up: true
      masterName: bond0
      slaveIndex: 1
      layer: platform
    - name: bond0
      logical: true
      up: true
      mtu: 0
      kind: bond
      type: ether
      bondMaster:
        mode: 802.3ad
        xmitHashPolicy: layer3+4
        lacpRate: slow
        arpValidate: none
        arpAllTargets: any
        primaryReselect: always
        failOverMac: 0
        miimon: 100
        updelay: 200
        downdelay: 200
        resendIgmp: 1
        lpInterval: 1
        packetsPerSlave: 1
        numPeerNotif: 1
        tlbLogicalLb: 1
        adActorSysPrio: 65535
      layer: platform
routes:
    - family: inet4
      gateway: 147.75.61.42
      outLinkName: bond0
      table: main
      priority: 1024
      scope: global
      type: unicast
      protocol: static
      layer: platform
    - family: inet6
      gateway: '2604:1380:45f2:6c00::'
      outLinkName: bond0
      table: main
      priority: 2048
      scope: global
      type: unicast
      protocol: static
      layer: platform
    - family: inet4
      dst: 10.0.0.0/8
      gateway: 10.68.182.0
      outLinkName: bond0
      table: main
      scope: global
      type: unicast
      protocol: static
      layer: platform
hostnames:
    - hostname: ci-blue-worker-amd64-2
      layer: platform
resolvers: []
timeServers: []

```

--------------------------------

### Build Bare-Metal Installer with Profile

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/boot-assets

Build a bare-metal installer asset by piping a profile.yaml to the Imager Docker container, ensuring necessary volumes are mounted.

```sh
cat profile.yaml | docker run --rm -i \
-v "$PWD/_out:/out" \
-v "$PWD/<your-extension>:/<your-extension>" \
ghcr.io/siderolabs/imager:${release_v1_12} -
```

--------------------------------

### Define and Start KVM Network

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/kvm

Defines the KVM network using the generated XML file and starts it. Also configures it to auto-start on reboot.

```bash
virsh net-define my-talos-net.xml
```

```bash
virsh net-start my-talos-net
```

```bash
virsh net-autostart my-talos-net
```

--------------------------------

### Start a Control Plane VM

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/opennebula

Use this command to start a control plane VM using the 'talos-node' template.

```bash
onevm create --name talos-cp-1 talos-node
```

--------------------------------

### Start a Worker VM

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/opennebula

Use this command to start a worker VM using the 'talos-node' template.

```bash
onevm create --name talos-worker-1 talos-node
```

--------------------------------

### Talos installer configuration for bare-metal

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/boot-assets

Example of a Talos machine configuration patch to specify the installer image for a bare-metal installation, using a schematic ID.

```yaml
# Talos machine configuration patch
machine:
install:
  image: factory.talos.dev/metal-installer/b8e8fbbe1b520989e6c52c8dc8303070cb42095997e76e812fa8892393e1d176:${release_v1_12}
```

--------------------------------

### Deploy sample workload

Source: https://docs.siderolabs.com/talos/v1.12/getting-started/deploy-first-workload

Deploys the example application and exposes it using a NodePort service.

```bash
kubectl apply -f https://raw.githubusercontent.com/siderolabs/example-workload/refs/heads/main/deploy/example-svc-nodeport.yaml
```

--------------------------------

### Set up Cross-Build Environment

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/developing-talos

Run this Docker command to set up the multi-architecture QEMU user static binaries for cross-compilation.

```bash
docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
```

--------------------------------

### Generate Talos Install Configuration with Custom Image

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/kernel-module

Use `talosctl gen config` to create an installation configuration that boots a machine from a specified installer image. This is essential for initial setup or testing custom images.

```bash
talosctl gen config --install-image $REGISTRY/$USER/installer:$TAG \
    test https://192.168.100.100:6443     # cluster name and endpoint

```

--------------------------------

### Push Installer Image using Crane

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/kernel-module

Push the generated installer image tarball to a registry using the `crane` tool. Replace placeholders with your registry, user, and tag.

```bash
crane push _out/installer-amd64.tar $REGISTRY/$USER/installer:$TAG
```

--------------------------------

### Get Talos Node Version

Source: https://docs.siderolabs.com/talos/v1.12/networking/host-dns

Example command to retrieve the version of a specific Talos node using `talosctl`.

```shell
talosctl -n talos-default-worker-1 version
```

--------------------------------

### SwapVolumeConfig Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/block/swapvolumeconfig

This example demonstrates a basic SwapVolumeConfig resource. It specifies a name, provisioning details including a disk selector and size constraints, and encryption using LUKS2 with a static passphrase.

```yaml
apiVersion: v1alpha1
kind: SwapVolumeConfig
name: swap1 # Name of the volume.
# The provisioning describes how the volume is provisioned.
provisioning:
    # The disk selector expression.
    diskSelector:
        match: disk.transport == "nvme" # The Common Expression Language (CEL) expression to match the disk.
    minSize: 3GiB # The minimum size of the volume.
    maxSize: 4GiB # The maximum size of the volume, if not specified the volume can grow to the size of the
# The encryption describes how the volume is encrypted.
encryption:
    provider: luks2 # Encryption provider to use for the encryption.
    # Defines the encryption keys generation and storage method.
    keys:
        - slot: 0 # Key slot number for LUKS2 encryption.
          # Key which value is stored in the configuration file.
          static:
            passphrase: swapsecret # Defines the static passphrase value.

    # # Cipher to use for the encryption. Depends on the encryption provider.
    # cipher: aes-xts-plain64

    # # Defines the encryption sector size.
    # blockSize: 4096

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue

```

--------------------------------

### Get VM Disk Name

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/kvm

Fetches the disk name of the VM, which is required for installing Talos onto the VM's persistent storage.

```bash
talosctl  get disks --nodes $CP_IP --insecure
```

--------------------------------

### Create Cloud-Init ISO Image (QEMU)

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/nocloud

Creates a bootable ISO image containing the cloud-init configuration files. This ISO will be attached to the QEMU VM.

```bash
cd iso && genisoimage -output cidata.iso -V cidata -r -J user-data meta-data network-config
```

--------------------------------

### Profile Configuration for Bare-Metal Installer

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/boot-assets

Define a profile.yaml to configure the Imager for building a bare-metal installer, referencing a system extension from a local tarball.

```yaml
# profile.yaml
arch: amd64
platform: metal
secureboot: false
version: ${release_v1_12}
input:
kernel:
path: /usr/install/amd64/vmlinuz
initramfs:
path: /usr/install/amd64/initramfs.xz
baseInstaller:
imageRef: ghcr.io/siderolabs/installer:${release_v1_12}
systemExtensions:
- tarballPath: <your-extension>  # notice we use 'tarballPath' instead of 'imageRef'
output:
kind: installer
outFormat: raw
```

--------------------------------

### Get Control Plane Node IP

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/gcp

Retrieves the public IP address of the first control plane node. Requires `jq` to be installed.

```bash
CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \
                     --zone $REGION-b \
                     --format json \
                     | jq -r '.networkInterfaces[0].accessConfigs[0].natIP')
```

--------------------------------

### Prepare Cloud-Init Config Files (QEMU)

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/nocloud

Organizes the generated Talos machine config and network information into the standard cloud-init 'user-data' and 'network-config' files.

```bash
mkdir -p iso
mv _out/controlplane.yaml iso/user-data
echo "local-hostname: controlplane-1" > iso/meta-data
cat > iso/network-config << EOF
version: 1
config:
   - type: physical
     name: eth0
     mac_address: "52:54:00:12:34:00"
     subnets:
        - type: static
          address: 192.168.1.10
          netmask: 255.255.255.0
          gateway: 192.168.1.254
EOF
```

--------------------------------

### Create Working Directory for Talos KVM Setup

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/kvm

Sets up the necessary directory structure for Talos KVM cluster configuration files and navigates into the project directory.

```bash
mkdir -p ~/talos-kvm/configs
cd ~/talos-kvm
```

--------------------------------

### List Talos Cluster Members

Source: https://docs.siderolabs.com/talos/v1.12/networking/host-dns

Example output from `talosctl get members` command, showing cluster member details including IP addresses and hostnames.

```sh
$ talosctl get members
NODE         NAMESPACE   TYPE     ID                             VERSION   HOSTNAME                       MACHINE TYPE   OS                        ADDRESSES
172.20.0.2   cluster     Member   talos-default-controlplane-1   1         talos-default-controlplane-1   controlplane   Talos ${release_v1_12}   ["172.20.0.2"]
172.20.0.2   cluster     Member   talos-default-worker-1         1         talos-default-worker-1         worker         Talos ${release_v1_12}   ["172.20.0.3"]
```

--------------------------------

### List System Extensions

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/system-extensions

Use `talosctl get extensions` to retrieve a list of all installed system extensions on a node. This command provides a summary view of each extension.

```bash
talosctl get extensions
```

--------------------------------

### Get Load Balancer Public IP and Generate Talos Config

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/gcp

Retrieves the public IP address of the load balancer and generates the Talos cluster configuration. Requires `jq` to be installed.

```bash
LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \
               --global \
               --format json \
               | jq -r .IPAddress)

talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443
```

--------------------------------

### Create Metal-ISO Filesystem for Configuration

Source: https://docs.siderolabs.com/talos/v1.12/reference/kernel

Example commands to create an ISO filesystem containing a config.yaml file, labeled 'metal-iso', for Talos to load machine configuration.

```bash
mkdir iso/
cp config.yaml iso/
mkisofs -joliet -rock -volid 'metal-iso' -output config.iso iso/
```

--------------------------------

### Bring Up Vagrant Environment

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/vagrant-libvirt

Initiates and starts the virtual machines defined in the Vagrantfile using the libvirt provider. This command provisions the VMs and boots them up.

```bash
vagrant up --provider=libvirt
```

--------------------------------

### Retrieve Node Information Securely

Source: https://docs.siderolabs.com/talos/v1.12/configure-your-talos-cluster/system-configuration/insecure

After initial configuration is applied, use 'talosctl get' without the --insecure flag to retrieve node information securely. This example retrieves disk information.

```bash
# After configuration is applied, subsequent commands are secure

talosctl get disks --nodes 192.168.1.100 --talosconfig=./talosconfig
```

--------------------------------

### servicestart

Source: https://docs.siderolabs.com/talos/v1.12/reference/api

Starts a specific service by its ID.

```APIDOC
## RPC servicestart

### Description
Starts a service identified by the provided ID.

### Request
- **id** (string) - Required - The ID of the service to start.

### Response
- **messages** (ServiceStart) - Response containing the start operation status.
```

--------------------------------

### Apply Control Plane Configuration

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/local-platforms/virtualbox

Applies the generated control plane configuration to the specified IP address. This command initiates the Talos installation and Kubernetes control plane setup on the VirtualBox VM.

```bash
talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml
```

--------------------------------

### Create a Minimal Talos VM Template

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/opennebula

Create a minimal VM template for booting Talos in maintenance mode with a static IP. Adjust resource values, disk size, and network names as needed.

```bash
onetemplate create --name talos-node << 'EOF'
NAME = "talos-node"

CPU = "2"
VCPU = "2"
MEMORY = "4096"

DISK = [
  IMAGE = "TALOS_IMAGE_NAME",
  SIZE = "20480"
]

NIC = [
  NETWORK = "YOUR_NETWORK_NAME",
  IP = "YOUR_STATIC_IP"
]

CONTEXT = [
  NETWORK = "YES"
]

GRAPHICS = [
  LISTEN = "0.0.0.0",
  TYPE = "VNC"
]

OS = [
  BOOT = "disk0"
]
EOF
```

--------------------------------

### Get Load Balancer Public IP and Generate Talos Config

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/openstack

Retrieves the public IP address of the load balancer and generates the Talos cluster configuration file. Ensure `jq` is installed for JSON parsing.

```bash
LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address)

talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443
```

--------------------------------

### Displaying Talos Linux SBOM Resources

Source: https://docs.siderolabs.com/talos/v1.12/advanced-guides/SBOM

Use `talosctl get sboms` to list all available SBOM resources on a running Talos Linux system. This command shows details for core components and installed extensions.

```sh
talosctl get sboms
NODE         NAMESPACE   TYPE       ID              VERSION   VERSION                LICENSE
172.20.0.2   runtime     SBOMItem   Talos           1         v1.12.7
172.20.0.2   runtime     SBOMItem   apparmor        1         v3.1.7                 GPL-2.0-or-later
172.20.0.2   runtime     SBOMItem   cel.dev/expr    1         v0.24.0
...
```

--------------------------------

### Example Equinix Metal Device Creation

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/bare-metal-platforms/equinix-metal

An example of creating a device using the Equinix Metal CLI with specific parameters for project, metro, plan, hostname, user data, and iPXE script URL.

```sh
{`metal device create -p <projectID> -f da11 -O custom_ipxe -P c3.small.x86 -H steve.test.11 --userdata-file ./controlplane.yaml --ipxe-script-url "https://pxe.factory.talos.dev/pxe/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/${release_v1_12}/equinixMetal-amd64"`}
```

--------------------------------

### Talos Installer Image URL

Source: https://docs.siderolabs.com/talos/v1.12/learn-more/image-factory

Construct the URL for the Talos installer image, which can be used for initial installation or upgrades.

```sh
factory.talos.dev/installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v1.12
```

--------------------------------

### Retrieve QEMU guest agent ISO and installer image URLs

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/proxmox

Reference URLs for downloading custom ISOs with QEMU guest agent support and the corresponding installer image path.

```sh

    Metal ISO

    amd64 ISO
      https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/${release_v1_12}/metal-amd64.iso
    arm64 ISO
      https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/${release_v1_12}/metal-arm64.iso

    Installer Image

    For the initial Talos install or upgrade use the following installer image:
    factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:{release_v1_12}
    
```

--------------------------------

### Set up Hetzner Cloud CLI Context

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/hetzner

Command to create a new context for the Hetzner Cloud CLI, named 'talos-tutorial', which is necessary for managing resources via the CLI.

```bash
# Set hcloud context and api key
hcloud context create talos-tutorial

```

--------------------------------

### Full Bond Interface Configuration Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/kernel

Creates a bond interface with specified slaves, bonding mode, transmit hash policy, and MTU.

```bash
bond=bond1:eth3,eth4:mode=802.3ad,xmit_hash_policy=layer2+3:1450
```

--------------------------------

### Build Kernel and Initramfs

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/building-images

Build the most basic boot assets, the kernel and initramfs. The build results will be stored in the '_out/' directory.

```bash
make kernel initramfs
```

--------------------------------

### Generate Raspberry Pi installer image with GPU support

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/single-board-computers/rpi_generic

Create a custom Talos installer image for Raspberry Pi, including the `rpi_generic` overlay and `vc4` system extension. This installer image can then be used to install Talos onto the device.

```sh
$ docker run --rm -t -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_12} installer \
--arch arm64 \
--overlay-image ghcr.io/siderolabs/sbc-raspberrypi:v0.1.0@sha256:849ace01b9af514d817b05a9c5963a35202e09a4807d12f8a3ea83657c76c863 \
--overlay-name=rpi_generic \
--overlay-option="configTxt=$(cat <<EOF
gpu_mem=128
kernel=u-boot.bin
arm_64bit=1
arm_boost=1
enable_uart=1
dtoverlay=disable-bt
dtoverlay=disable-wifi
avoid_warnings=2
dtoverlay=vc4-kms-v3d,noaudio
EOF
)" \
--system-extension-image ghcr.io/siderolabs/vc4:v0.1.4@sha256:548b2b121611424f6b1b6cfb72a1669421ffaf2f1560911c324a546c7cee655e
... 
output asset path: /out/metal-arm64-installer.tar

```

--------------------------------

### Power On VM

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/vmware

Turns on a specified virtual machine.

```bash
govc vm.power -on control-plane-1
```

--------------------------------

### Extension Service Configuration Example

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/extension-services

Defines an extension service named 'hello-world' with specified entrypoint, arguments, dependencies, and restart policy. This configuration is discovered by Talos at a specific path.

```yaml
name: hello-world
container:
  entrypoint: ./hello
  args:
    - --config
    - config.ini
depends:
  - network:
    - addresses
restart: always
```

--------------------------------

### Generate SecureBoot Installer Image

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/bare-metal-platforms/secureboot

This command generates the installer image required for installing Talos on a SecureBoot-enabled system. It uses the same output directory and release version.

```sh
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_12} secureboot-installer
profile ready:
arch: amd64
platform: metal
secureboot: true
version: ${release_v1_12}
input:
kernel:
  path: /usr/install/amd64/vmlinuz
initramfs:
  path: /usr/install/amd64/initramfs.xz
sdStub:
  path: /usr/install/amd64/systemd-stub.efi
sdBoot:
  path: /usr/install/amd64/systemd-boot.efi
baseInstaller:
  imageRef: ghcr.io/siderolabs/installer:${release_v1_12}
secureboot:
  signingKeyPath: /secureboot/uki-signing-key.pem
  signingCertPath: /secureboot/uki-signing-cert.pem
  pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
  pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
  platformKeyPath: /secureboot/PK.auth
  keyExchangeKeyPath: /secureboot/KEK.auth
  signatureKeyPath: /secureboot/db.auth
output:
kind: installer
outFormat: raw
skipped initramfs rebuild (no system extensions)
kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
UKI ready
installer container image ready
output asset path: /out/installer-amd64-secureboot.tar
```

--------------------------------

### Example Generated `talosconfig` File

Source: https://docs.siderolabs.com/talos/v1.12/reference/talosconfig

A sample `talosconfig` file demonstrating the structure with contexts, endpoints, and base64-encoded certificates.

```yaml
contexts:
  my-cluster:
    endpoints:
      - 192.168.0.10
    nodes:
      - 192.168.0.10
    ca: <base64-encoded-ca>
    crt: <base64-encoded-client-cert>
    key: <base64-encoded-client-key>
```

--------------------------------

### Generate Custom Installer Image

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/boot-assets

Create a custom installer container image by running the Talos imager with specified system extension and overlay images. This image can then be used for installation.

```sh
docker run --rm -t \
    -v "$PWD/_out:/out" \
    ghcr.io/siderolabs/imager:${release_v1_12} \
    installer \
    --arch arm64 \
    --system-extension-image ghcr.io/siderolabs/iscsi-tools:v0.1.4@sha256:548b2b121611424f6b1b6cfb72a1669421ffaf2f1560911c324a546c7cee655e \
    --overlay-image ghcr.io/siderolabs/sbc-raspberrypi:v0.1.0@sha256:849ace01b9af514d817b05a9c5963a35202e09a4807d12f8a3ea83657c76c863 \
    --overlay-name=rpi_generic
```

--------------------------------

### Create vCenter Content Library

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/vmware

Use `govc` to create a new content library in vCenter if one does not already exist.

```bash
govc library.create <library name>
```

--------------------------------

### Install Talos CLI and Dependencies

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/cloud-platforms/aws

Installs the necessary command-line tools for Talos, kubectl, jq, curl, and xz using Homebrew. Ensure Homebrew is installed on macOS or Linux.

```bash
brew install siderolabs/tap/talosctl kubectl jq curl xz
```

--------------------------------

### Install NVIDIA Device Plugin using Helm

Source: https://docs.siderolabs.com/talos/v1.12/configure-your-talos-cluster/hardware-and-drivers/nvidia-gpu-proprietary

Install the NVIDIA device plugin using Helm, specifying the custom runtime class. Ensure Helm repositories are updated before installation.

```bash
helm repo add nvdp https://nvidia.github.io/k8s-device-plugin
helm repo update
helm install nvidia-device-plugin nvdp/nvidia-device-plugin --version=0.13.0 --set=runtimeClassName=nvidia
```

--------------------------------

### EventSinkConfig Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/runtime/eventsinkconfig

This is an example of an EventSinkConfig resource. It specifies the endpoint for the event sink.

```yaml
apiVersion: v1alpha1
kind: EventSinkConfig
endpoint: 192.168.10.3:3247 # The endpoint for the event sink as 'host:port'.
```

--------------------------------

### Install talosctl on macOS or Linux

Source: https://docs.siderolabs.com/talos/v1.12/getting-started/quickstart

Use Homebrew to install the talosctl command-line tool.

```bash
brew tap siderolabs/tap
brew trust siderolabs/tap
brew install siderolabs/tap/talosctl
```

--------------------------------

### Talos CLI Cluster Create QEMU Synopsis

Source: https://docs.siderolabs.com/talos/v1.12/reference/cli

Provides the synopsis for creating a QEMU-based Talos cluster. It outlines the command structure and mentions available presets for configuration.

```bash
talosctl cluster create qemu [flags]
```

--------------------------------

### Bootstrap the node

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/single-board-computers/libretech_all_h3_cc_h5

Connects to the interactive installer on the node to complete the configuration.

```bash
talosctl apply-config --insecure --mode=interactive --nodes <node IP or DNS name>
```

--------------------------------

### Logging Endpoint Example (TCP)

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/v1alpha1/config

Example of configuring a TCP endpoint for Talos logging.

```yaml
machine:
    logging:
        destinations:
            - endpoint: tcp://1.2.3.4:12345
```

--------------------------------

### Logging Endpoint Example (UDP)

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/v1alpha1/config

Example of configuring a UDP endpoint for Talos logging.

```yaml
machine:
    logging:
        destinations:
            - endpoint: udp://127.0.0.1:12345
```

--------------------------------

### Logging Endpoint Example (HTTPS)

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/v1alpha1/config

Example of configuring an HTTPS endpoint for Talos logging.

```yaml
machine:
    logging:
        destinations:
            - endpoint: https://1.2.3.4:6443
```

--------------------------------

### Example affiliates output

Source: https://docs.siderolabs.com/talos/v1.12/configure-your-talos-cluster/system-configuration/discovery

The table output showing known affiliates, their hostnames, machine types, and network addresses.

```bash
ID                                             VERSION   HOSTNAME                       MACHINE TYPE   ADDRESSES
2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF    2         talos-default-controlplane-2   controlplane   ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"]
6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA   2         talos-default-worker-1         worker         ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"]
NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB   2         talos-default-worker-2         worker         ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"]
Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd    4         talos-default-controlplane-1   controlplane   ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"]
b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C   2         talos-default-controlplane-3   controlplane   ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"]
```

--------------------------------

### SideroLinkConfig Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/siderolink/siderolinkconfig

This is an example of a SideroLinkConfig document. It specifies the API URL for the SideroLink service.

```yaml
apiVersion: v1alpha1
kind: SideroLinkConfig
apiUrl: https://siderolink.api/jointoken?token=secret # SideroLink API URL to connect to.
```

--------------------------------

### Configure Xen VM for Secure Boot Setup Mode

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/xen

Use this command to force a Xen VM into Secure Boot setup mode, which is necessary for initial configuration. Remember to re-enable Secure Boot after the first boot.

```bash
xe vm-set-uefi-mode mode=setup uuid=<VM_UUID>
```

--------------------------------

### KmsgLogConfig Example

Source: https://docs.siderolabs.com/talos/v1.12/reference/configuration/runtime/kmsglogconfig

Example of a KmsgLogConfig resource. Use this to define a remote logging endpoint.

```yaml
apiVersion: v1alpha1
kind: KmsgLogConfig
name: remote-log # Name of the config document.
url: tcp://192.168.3.7:3478/ # The URL encodes the log destination.
```

--------------------------------

### Example Strategic Merge Patch

Source: https://docs.siderolabs.com/talos/v1.12/configure-your-talos-cluster/system-configuration/patching

A basic example of a strategic merge patch for a HostnameConfig.

```yaml
apiVersion: v1alpha1
kind: HostnameConfig
hostname: my-custom-hostname
auto: off
```

--------------------------------

### Generate Custom Installer Image

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/boot-assets

Generate a custom installer image that includes required system extensions. Note that kernel arguments cannot be specified directly with the installer image but are set via machine configuration.

```sh
docker run --rm -t \
        -v "$PWD/_out:/out" \
        ghcr.io/siderolabs/imager:${release_v1_12} \
        installer \
        --platform=metal \

```

--------------------------------

### Install virtctl Client

Source: https://docs.siderolabs.com/talos/v1.12/advanced-guides/install-kubevirt

Download the `virtctl` client binary directly from the KubeVirt releases. This client is necessary for CLI communication with the KubeVirt API server.

```bash
export VERSION=$(curl https://storage.googleapis.com/kubevirt-prow/release/kubevirt/kubevirt/stable.txt)
wget https://github.com/kubevirt/kubevirt/releases/download/${VERSION}/virtctl-${VERSION}-linux-amd64
```

--------------------------------

### Upgrade Talos Machine with Installer Image

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/kernel-module

Upgrade an existing Talos machine by applying the installer image using `talosctl upgrade`. This method is used to install extensions or update the system with custom components.

```bash
talosctl upgrade -i $REGISTRY/$USER/installer:$TAG

```

--------------------------------

### Build and Push Talos Installer Base Image

Source: https://docs.siderolabs.com/talos/v1.12/build-and-extend-talos/custom-images-and-development/developing-talos

Builds the installer-base image for Talos and pushes it to the specified local registry. Ensure the local registry is running before executing.

```bash
make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
```

--------------------------------

### Configure IMAGECACHE Volume for ISO Installation

Source: https://docs.siderolabs.com/talos/v1.12/configure-your-talos-cluster/images-container-runtime/image-cache

Configure the IMAGECACHE volume for ISO installations to specify the disk selection, minimum, and maximum size for the image cache. This ensures the image cache is copied to the disk during installation.

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: IMAGECACHE
provisioning:
  diskSelector:
    match: 'system_disk'
  minSize: 2GB
  maxSize: 2GB
```

--------------------------------

### Bootstrap Talos Cluster

Source: https://docs.siderolabs.com/talos/v1.12/platform-specific-installations/virtualized-platforms/kvm

Initiates the first-time startup of the Kubernetes cluster by bootstrapping it with Talos.

```bash
talosctl -n $CP_IP bootstrap
```
Tokens:
Raw