Talos

https://docs.siderolabs.com/talos/v1.13
Admin
Talos is a Kubernetes-native operating system designed for running Kubernetes clusters with an...
Tokens:280,735
Snippets:3,135
Trust Score:8.8
Update:1 month ago
Show doc for...
Tokens:
Raw
### Start interactive installer

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/system-configuration/editing-machine-configuration

Launches the interactive installer mode for applying machine configuration.

```bash
talosctl -n IP apply machineconfig --mode=interactive
```

--------------------------------

### Create the installer image

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module

Generates an installer image by combining the base installer and the custom system extension.

```bash
make image-installer \
  REGISTRY=127.0.0.1:5005 \
  IMAGER_ARGS="--base-installer-image=${BASE_INSTALLER_IMAGE} \
    --system-extension-image=${EXTENSION_IMAGE}"
```

--------------------------------

### Build and push installer images

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos

Commands to build the installer base, imager, and final installer image, pushing them to the local registry.

```bash
make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true INSTALLER_ARCH=targetarch
make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
```

--------------------------------

### Start the VirtualMachine

Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt

Command to start the defined virtual machine.

```bash
kubectl virt start fedora-vm
```

--------------------------------

### Start and enable network

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/kvm

Activate the network and ensure it starts automatically on system boot.

```bash
virsh net-start my-talos-net
virsh net-autostart my-talos-net
```

--------------------------------

### Install QEMU on Ubuntu

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu

Use the apt package manager to install QEMU and KVM support on Ubuntu systems.

```bash
apt install qemu-system-x86 qemu-kvm
```

--------------------------------

### Install QEMU on macOS

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu

Use Homebrew to install QEMU on macOS.

```bash
brew install qemu
```

--------------------------------

### Tail installation logs

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu

Follow the logs in real-time during the installation process. Replace <cluster-name> with your actual cluster name.

```bash
tail -f ~/.talos/clusters/<cluster-name>/*.log
```

--------------------------------

### Install dependencies

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/aws

Install the necessary tools including talosctl, kubectl, jq, curl, and xz using homebrew.

```bash
brew install siderolabs/tap/talosctl kubectl jq curl xz
```

--------------------------------

### Install talosctl via installer script

Source: https://docs.siderolabs.com/talos/v1.13/getting-started/talosctl

An alternative installation method for environments without Homebrew, supporting macOS, Linux, and WSL on Windows.

```bash
curl -sL https://talos.dev/install | sh
```

--------------------------------

### Start worker VM

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/opennebula

Starts a worker VM using the previously created template.

```bash
onevm create --name talos-worker-1 talos-node
```

--------------------------------

### Install VirtualBox on Ubuntu

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/virtualbox

Use the system package manager to install VirtualBox on Ubuntu x86 systems.

```bash
apt install virtualbox
```

--------------------------------

### Start control plane VM

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/opennebula

Starts a control plane VM using the previously created template.

```bash
onevm create --name talos-cp-1 talos-node
```

--------------------------------

### Push installer image

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/single-board-computers/rpi_generic

Push the generated installer tarball to a container registry.

```sh
crane push _out/metal-arm64-installer.tar ghcr.io/<username>/installer:${release_v1_13}
```

--------------------------------

### Install talosctl

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/single-board-computers/rpi_generic

Download and install the latest version of the talosctl CLI tool.

```bash
curl -sL 'https://www.talos.dev/install' | bash
```

--------------------------------

### Build the installer base and imager

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module

Builds the necessary base images for the installer using the previously built kernel image.

```bash
make installer-base imager PLATFORM=linux/amd64 \
  INSTALLER_ARCH=amd64 \
  REGISTRY=127.0.0.1:5005 \
  PKG_KERNEL=${KERNEL_IMAGE} \
  PUSH=true
```

--------------------------------

### Build and push installer image

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos

Builds and pushes the installer image for the development version of Talos.

```bash
make installer-base IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make imager IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true
make installer IMAGE_REGISTRY=127.0.0.1:5005
```

--------------------------------

### Generate custom installer image

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/single-board-computers/rpi_generic

Run the imager to create a custom installer image containing the necessary system extensions.

```sh
$ docker run --rm -t -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_13} installer \
    --arch arm64 \
    --overlay-image ghcr.io/siderolabs/sbc-raspberrypi:v0.1.0@sha256:849ace01b9af514d817b05a9c5963a35202e09a4807d12f8a3ea83657c76c863 \
    --overlay-name=rpi_generic \
    --overlay-option="configTxt=$(cat <<EOF
    gpu_mem=128
    kernel=u-boot.bin
    arm_64bit=1
    arm_boost=1
    enable_uart=1
    dtoverlay=disable-bt
    dtoverlay=disable-wifi
    avoid_warnings=2
    dtoverlay=vc4-kms-v3d,noaudio
    EOF
    )" \
    --system-extension-image ghcr.io/siderolabs/vc4:v0.1.4@sha256:548b2b121611424f6b1b6cfb72a1669421ffaf2f1560911c324a546c7cee655e
    ...
    output asset path: /out/metal-arm64-installer.tar
```

--------------------------------

### Cluster members output example

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/system-configuration/discovery

Example output showing the ID, version, hostname, machine type, OS, and addresses of cluster members.

```sh

    ID                             VERSION   HOSTNAME                       MACHINE TYPE   OS                ADDRESSES
    talos-default-controlplane-1   2         talos-default-controlplane-1   controlplane   Talos ${release_v1_12}   ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"]
    talos-default-controlplane-2   1         talos-default-controlplane-2   controlplane   Talos ${release_v1_12}   ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"]
    talos-default-controlplane-3   1         talos-default-controlplane-3   controlplane   Talos ${release_v1_12}   ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"]
    talos-default-worker-1         1         talos-default-worker-1         worker         Talos ${release_v1_12}   ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"]
    talos-default-worker-2         1         talos-default-worker-2         worker         Talos ${release_v1_12}   ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"]
    
```

--------------------------------

### Install virtctl via krew

Source: https://docs.siderolabs.com/talos/v1.13/advanced-guides/install-kubevirt

Alternatively, install the virtctl plugin for kubectl using the krew package manager.

```bash
kubectl krew install virt
```

--------------------------------

### UserVolumeConfig directory volume example

Source: https://docs.siderolabs.com/talos/v1.13/reference/configuration/block/uservolumeconfig

A configuration example for a directory-based user volume with LUKS2 encryption using static passphrases and KMS endpoints.

```yaml
apiVersion: v1alpha1
kind: UserVolumeConfig
name: local-data # Name of the volume.
volumeType: directory # Volume type.

# # The encryption describes how the volume is encrypted.
# encryption:
#     provider: luks2 # Encryption provider to use for the encryption.
#     # Defines the encryption keys generation and storage method.
#     keys:
#         - slot: 0 # Key slot number for LUKS2 encryption.
#           # Key which value is stored in the configuration file.
#           static:
#             passphrase: exampleKey # Defines the static passphrase value.
#
#           # # KMS managed encryption key.
#           # kms:
#           #     endpoint: https://192.168.88.21:4443 # KMS endpoint to Seal/Unseal the key.
#         - slot: 1 # Key slot number for LUKS2 encryption.
#           # KMS managed encryption key.
#           kms:
#             endpoint: https://example-kms-endpoint.com # KMS endpoint to Seal/Unseal the key.
#     cipher: aes-xts-plain64 # Cipher to use for the encryption. Depends on the encryption provider.
#     blockSize: 4096 # Defines the encryption sector size.
#     # Additional --perf parameters for the LUKS2 encryption.
#     options:
#         - no_read_workqueue
#         - no_write_workqueue
```

--------------------------------

### Configure hugepages for Talos Linux

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/hardware-and-drivers/tenstorrent

Use this configuration in your Talos machine install settings to reserve 1 GB hugepages. The example shows the 36-page requirement for a 1-chip setup.

```yaml
machine:
  install:
    extraKernelArgs:
      - hugepagesz=1G
      - hugepages=36
```

--------------------------------

### QEMU VM Startup with CDROM

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/nocloud

Start the QEMU VM with the generated cidata ISO attached.

```bash
qemu-system-x86_64 \
    ...
    -cdrom iso/cidata.iso \
    ...
```

--------------------------------

### Deploy sample application

Source: https://docs.siderolabs.com/talos/v1.13/getting-started/deploy-first-workload

Deploys the example workload and exposes it via a NodePort using kubectl.

```bash
kubectl apply -f https://raw.githubusercontent.com/siderolabs/example-workload/refs/heads/main/deploy/example-svc-nodeport.yaml
```

--------------------------------

### Example output for kubectl get nodes

Source: https://docs.siderolabs.com/talos/v1.13/getting-started/quickstart

The expected output after running the kubectl get nodes command.

```sh
 NAME            STATUS   ROLES           AGE     VERSION             INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                    KERNEL-VERSION   CONTAINER-RUNTIME
talos-cfx-nh0   Ready    <none>          2m53s   v1.37.0     10.5.13.47    <none>        Talos v1.13.7      <host kernel>    containerd://2.1.6
talos-vb5-xfr   Ready    control-plane   2m51s   v1.37.0     10.5.13.46    <none>        Talos v1.13.7      <host kernel>    containerd://2.1.6 
```

--------------------------------

### Disk resource specification example

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/storage-and-disk-management/disk-management/common

Example output of a disk resource specification as retrieved by talosctl get disks -o yaml.

```yaml
dev_path: /dev/nvme0n1
size: 10485760000
pretty_size: 10 GB
io_size: 512
sector_size: 512
readonly: false
cdrom: false
model: QEMU NVMe Ctrl
serial: deadbeef
wwid: nvme.1b36-6465616462656566-51454d55204e564d65204374726c-00000001
bus_path: /pci0000:00/0000:00:09.0/nvme
sub_system: /sys/class/block
transport: nvme
symlinks:
    - /dev/disk/by-diskseq/11
    - /dev/disk/by-id/ata-QEMU_HARDDISK_QM00001
    - /dev/disk/by-path/pci-0000:00:1f.2-ata-1
    - /dev/disk/by-path/pci-0000:00:1f.2-ata-1.0
```

--------------------------------

### QEMU Cloud-Init File Preparation

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/nocloud

Prepare the user-data, meta-data, and network-config files for the ISO image.

```bash
mkdir -p iso
mv _out/controlplane.yaml iso/user-data
echo "local-hostname: controlplane-1" > iso/meta-data
cat > iso/network-config << EOF
version: 1
config:
   - type: physical
     name: eth0
     mac_address: "52:54:00:12:34:00"
     subnets:
        - type: static
          address: 192.168.1.10
          netmask: 255.255.255.0
          gateway: 192.168.1.254
EOF
```

--------------------------------

### Clone the pkgs repository and create a module directory

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module

Initial setup steps to prepare the local environment for adding a new package.

```bash
git clone https://github.com/siderolabs/pkgs.git
cd pkgs
mkdir my-module
```

--------------------------------

### Get VM disk information

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/kvm

Queries the Talos node to identify available disks for installation.

```bash
talosctl  get disks --nodes $CP_IP --insecure
```

--------------------------------

### Get AddressSpec resources

Source: https://docs.siderolabs.com/talos/v1.13/learn-more/networking-resources

Example of listing address specifications generated by operators in the network-config namespace.

```sh
$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config
NODE         NAMESPACE        TYPE          ID                              VERSION
172.20.0.2   network-config   AddressSpec   dhcp4/eth0/eth0/172.20.0.2/24   1
```

--------------------------------

### Get OperatorSpec resources

Source: https://docs.siderolabs.com/talos/v1.13/learn-more/networking-resources

Example of retrieving an OperatorSpec resource for a DHCP4 configuration on eth0 using talosctl.

```yaml
# talosctl get operatorspecs -o yaml
node: 172.20.0.2
metadata:
    namespace: network
    type: OperatorSpecs.net.talos.dev
    id: dhcp4/eth0
    version: 1
    owner: network.OperatorConfigController
    phase: running
    created: 2021-06-29T20:23:18Z
    updated: 2021-06-29T20:23:18Z
spec:
    operator: dhcp4
    linkName: eth0
    requireUp: true
    dhcp4:
        routeMetric: 1024
```

--------------------------------

### Kernel and package build output

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/kernel-module

Example output showing the successful push of the kernel and package images to the registry.

```bash
=> => pushing manifest for 127.0.0.1:5005/user/kernel:v1.11.0-alpha.0...
...
=> => pushing manifest for 127.0.0.1:5005/user/my-module-pkg:v1.11.0-alpha.0...
```

--------------------------------

### Bring up Vagrant environment

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/vagrant-libvirt

Initialize the Vagrant environment using the libvirt provider.

```bash
vagrant up --provider=libvirt
```

--------------------------------

### Set environment variables for GCP setup

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/gcp

Define the storage bucket and region variables used throughout the installation process.

```bash
# Storage account to use
export STORAGE_BUCKET="StorageBucketName"
# Region
export REGION="us-central1"
```

--------------------------------

### Configure hugepages for Omni

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/hardware-and-drivers/tenstorrent

Use this configuration in your Omni machine definition to reserve 1 GB hugepages and include the Tenstorrent system extension. The example shows the 36-page requirement for a 1-chip setup.

```yaml
kind: Machine
name: <machine-uuid>
systemExtensions:
  - siderolabs/tenstorrent
kernelArgs:
  - hugepagesz=1G
  - hugepages=36
```

--------------------------------

### Example output for qemu-system cleanup

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu

Shows the process identification and termination commands for QEMU system processes.

```bash
ps -elf | grep qemu-system
2 S root     1061663 1061168 26  80   0 - 1786238 -    14:05 ?        01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm
2 S root     1061663 1061170 67  80   0 - 621014 -     21:23 ?        00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm
sudo kill -s SIGTERM 1061663
sudo kill -s SIGTERM 1061663
```

--------------------------------

### Push installer image to registry

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/secureboot

Pushes the generated installer image to a container registry for use during installation.

```sh
crane push _out/installer-amd64-secureboot.tar ghcr.io/<user>/installer-amd64-secureboot:${release_v1_13}
```

--------------------------------

### Apply configuration and secure access

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/system-configuration/insecure

Demonstrates applying an initial configuration using --insecure, followed by a secure command once the node is configured.

```bash
# First time applying configuration (requires --insecure)

talosctl apply-config --insecure --nodes 192.168.1.100 --file controlplane.yaml

# After configuration is applied, subsequent commands are secure

talosctl get disks --nodes 192.168.1.100 --talosconfig=./talosconfig
```

--------------------------------

### Retrieve Talos Installer Image

Source: https://docs.siderolabs.com/talos/v1.13/learn-more/image-factory

Use this registry path to fetch the customized installer image for Talos Linux installation or upgrades.

```sh
factory.talos.dev/installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:${release_v1_12}
```

--------------------------------

### Example Equinix Metal CLI device creation

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/equinix-metal

A concrete example of the metal device create command with placeholder values for project ID, plan, hostname, and the PXE script URL.

```bash
metal device create -p <projectID> -f da11 -O custom_ipxe -P c3.small.x86 -H steve.test.11 --userdata-file ./controlplane.yaml --ipxe-script-url "https://pxe.factory.talos.dev/pxe/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/${release_v1_13}/equinixMetal-amd64"
```

--------------------------------

### Build kernel and initramfs

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/building-images

Build the basic boot assets for Talos.

```bash
make kernel initramfs
```

--------------------------------

### Setup Load Balancer and Health Probes

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/azure

Create a public IP, load balancer, and health probe for the control plane.

```bash
# Create public ip
az network public-ip create \
  --resource-group $GROUP \
  --name talos-public-ip \
  --allocation-method static

# Create lb
az network lb create \
  --resource-group $GROUP \
  --name talos-lb \
  --public-ip-address talos-public-ip \
  --frontend-ip-name talos-fe \
  --backend-pool-name talos-be-pool

# Create health check
az network lb probe create \
  --resource-group $GROUP \
  --lb-name talos-lb \
  --name talos-lb-health \
  --protocol tcp \
  --port 6443

# Create lb rule for 6443
az network lb rule create \
  --resource-group $GROUP \
  --lb-name talos-lb \
  --name talos-6443 \
  --protocol tcp \
  --frontend-ip-name talos-fe \
  --frontend-port 6443 \
  --backend-pool-name talos-be-pool \
  --backend-port 6443 \
  --probe-name talos-lb-health
```

--------------------------------

### Example output for VM launcher cleanup

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/local-platforms/qemu

Shows the process identification and termination commands for specific PIDs.

```bash
ps -elf | grep '[t]alosctl qemu-launch'
0 S root      157615    2835  0  80   0 - 184934 -     07:53 ?        00:00:00 talosctl qemu-launch
0 S root      157617    2835  0  80   0 - 185062 -     07:53 ?        00:00:00 talosctl qemu-launch
sudo kill -s SIGTERM 157615
sudo kill -s SIGTERM 157617
```

--------------------------------

### Install cert-manager

Source: https://docs.siderolabs.com/talos/v1.13/security/iam-roles-for-service-accounts

Installs the cert-manager Helm chart into the cert-manager namespace with CRDs enabled.

```bash
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --set crds.enabled=true \
  --create-namespace
```

--------------------------------

### Generate SecureBoot installer image

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/secureboot

Generates an installer image configured for SecureBoot-enabled systems.

```sh
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_13} secureboot-installer
    profile ready:
    arch: amd64
    platform: metal
    secureboot: true
    version: ${release_v1_13}
    input:
    kernel:
      path: /usr/install/amd64/vmlinuz
    initramfs:
      path: /usr/install/amd64/initramfs.xz
    sdStub:
      path: /usr/install/amd64/systemd-stub.efi
    sdBoot:
      path: /usr/install/amd64/systemd-boot.efi
    baseInstaller:
      imageRef: ghcr.io/siderolabs/installer:${release_v1_13}
    secureboot:
      signingKeyPath: /secureboot/uki-signing-key.pem
      signingCertPath: /secureboot/uki-signing-cert.pem
      pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
      pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
      platformKeyPath: /secureboot/PK.auth
      keyExchangeKeyPath: /secureboot/KEK.auth
      signatureKeyPath: /secureboot/db.auth
    output:
    kind: installer
    outFormat: raw
    skipped initramfs rebuild (no system extensions)
    kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
    UKI ready
    installer container image ready
    output asset path: /out/installer-amd64-secureboot.tar
```

--------------------------------

### Install talosctl on macOS or Linux

Source: https://docs.siderolabs.com/talos/v1.13/getting-started/quickstart

Use Homebrew to install the talosctl command-line tool.

```bash
brew tap siderolabs/tap
brew trust siderolabs/tap
brew install siderolabs/tap/talosctl
```

--------------------------------

### Create content library

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/vmware

Create a new content library in vCenter.

```bash
govc library.create <library name>
```

--------------------------------

### Install ROCm GPU operator

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/hardware-and-drivers/amd-gpu

Install the ROCm GPU operator into the kube-system namespace.

```bash
helm install rocm-gpu-operator rocm/gpu-operator -n kube-system
```

--------------------------------

### Create a Docker buildx builder

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos

Sets up a builder with host network access and insecure entitlement permissions required for building Talos.

```bash
docker buildx create --driver docker-container  --driver-opt network=host --name local1 --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use
```

--------------------------------

### Run short integration tests against QEMU

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos

Execute short integration tests using a QEMU provisioned cluster.

```bash
_out/integration-test-linux-amd64 \
    -talos.provisioner=qemu \
    -test.v \
    -test.short \
    -talos.talosctlpath=$PWD/_out/talosctl-linux-amd64
```

--------------------------------

### Create working directory

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/virtualized-platforms/kvm

Initialize the project directory for storing Talos configuration files.

```bash
mkdir -p ~/talos-kvm/configs
cd ~/talos-kvm
```

--------------------------------

### Configure network infrastructure

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/gcp

Set up the instance group, load balancer, health checks, and firewall rules required for the cluster.

```bash
# Create Instance Group
gcloud compute instance-groups unmanaged create talos-ig \
  --zone $REGION-b

# Create port for IG
gcloud compute instance-groups set-named-ports talos-ig \
    --named-ports tcp6443:6443 \
    --zone $REGION-b

# Create health check
gcloud compute health-checks create tcp talos-health-check --port 6443

# Create backend
gcloud compute backend-services create talos-be \
    --global \
    --protocol TCP \
    --health-checks talos-health-check \
    --timeout 5m \
    --port-name tcp6443

# Add instance group to backend
gcloud compute backend-services add-backend talos-be \
    --global \
    --instance-group talos-ig \
    --instance-group-zone $REGION-b

# Create tcp proxy
gcloud compute target-tcp-proxies create talos-tcp-proxy \
    --backend-service talos-be \
    --proxy-header NONE

# Create LB IP
gcloud compute addresses create talos-lb-ip --global

# Forward 443 from LB IP to tcp proxy
gcloud compute forwarding-rules create talos-fwd-rule \
    --global \
    --ports 443 \
    --address talos-lb-ip \
    --target-tcp-proxy talos-tcp-proxy

# Create firewall rule for health checks
gcloud compute firewall-rules create talos-controlplane-firewall \
     --source-ranges 130.211.0.0/22,35.191.0.0/16 \
     --target-tags talos-controlplane \
     --allow tcp:6443

# Create firewall rule to allow talosctl access
gcloud compute firewall-rules create talos-controlplane-talosctl \
  --source-ranges 0.0.0.0/0 \
  --target-tags talos-controlplane \
  --allow tcp:50000
```

--------------------------------

### NetworkRuleConfig example

Source: https://docs.siderolabs.com/talos/v1.13/troubleshooting/talosctl-debug

Example configuration for a network rule blocking access to port 5005.

```yaml
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: test
portSelector:
    ports:
        - 5005
    protocol: tcp
ingress:
    - subnet: 192.168.0.0/16
```

--------------------------------

### Example config.yaml configuration

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/gcp

A sample configuration file for GCP Deployment Manager defining cluster resources and properties.

```sh

    imports:
    - path: talos-ha.jinja

    resources:
    - name: talos-ha
      type: talos-ha.jinja
      properties:
        zone: us-west1-b
        talosVersion: ${release_v1_13}
        externalCloudProvider: false
        controlPlaneNodeCount: 5
        controlPlaneNodeType: n1-standard-1
        workerNodeCount: 3
        workerNodeType: n1-standard-1
    outputs:
    - name: bucketName
      value: $(ref.talos-ha.bucketName)
    
```

--------------------------------

### Example CONTROL_PLANE_IP Bash array

Source: https://docs.siderolabs.com/talos/v1.13/getting-started/prodnotes

An example of the CONTROL_PLANE_IP array populated with specific IP addresses.

```bash
CONTROL_PLANE_IP=("192.168.0.2" "192.168.0.3" "192.168.0.4")
```

--------------------------------

### Install amazon-eks-pod-identity-webhook

Source: https://docs.siderolabs.com/talos/v1.13/security/iam-roles-for-service-accounts

Installs the Amazon EKS Pod Identity Webhook Helm chart into the kube-system namespace.

```bash
helm install amazon-eks-pod-identity-webhook jkroepke/amazon-eks-pod-identity-webhook \
  --namespace kube-system \
  set config.defaultAwsRegion=${AWS_REGION}
```

--------------------------------

### Initialize and Build Packer Image

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/upcloud

Run these commands to initialize the Packer plugins and build the custom image.

```bash
packer init .
packer build .
```

--------------------------------

### Build an overlay with custom registry settings

Source: https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/overlays

Builds the specified overlay and pushes it to a custom registry and username.

```bash
make sbc-rockchip PUSH=true REGISTRY=<registry> USERNAME=<username>
```

--------------------------------

### Flash and boot from eMMC

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/single-board-computers/turing_rk1

Flashes the raw Talos image to the specified node's eMMC and powers it on.

```bash
tpi flash -n <NODENUMBER> -i metal-arm64.raw
tpi power on -n <NODENUMBER> 
```

--------------------------------

### Configure SecureBoot installer image

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/bare-metal-platforms/secureboot

Specify the SecureBoot installer image within the Talos machine configuration.

```text
factory.talos.dev/installer-secureboot/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:${release_v1_13}
```

--------------------------------

### Create Oracle Cloud Network via OCI CLI

Source: https://docs.siderolabs.com/talos/v1.13/platform-specific-installations/cloud-platforms/oracle

Set up a VCN, subnet, internet gateway, and security list for the cluster.

```bash
export cidr_block=10.0.0.0/16
export subnet_block=10.0.0.0/24
export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/vcn/create.html#cmdoption-compartment-id

export vcn_id=$(oci network vcn create --cidr-block $cidr_block --display-name talos-example --compartment-id $compartment_id --query data.id --raw-output)
export rt_id=$(oci network subnet create --cidr-block $subnet_block --display-name kubernetes --compartment-id $compartment_id --vcn-id $vcn_id --query data.route-table-id --raw-output)
export ig_id=$(oci network internet-gateway create --compartment-id $compartment_id --is-enabled true --vcn-id $vcn_id --query data.id --raw-output)

oci network route-table update --rt-id $rt_id --route-rules "[{\"cidrBlock\":\"0.0.0.0/0\",\"networkEntityId\":\"$ig_id\"}]" --force

# disable firewall
export sl_id=$(oci network vcn list --compartment-id $compartment_id --query 'data[0]."default-security-list-id"' --raw-output)

oci network security-list update --security-list-id $sl_id --egress-security-rules '[{"destination": "0.0.0.0/0", "protocol": "all", "isStateless": false}]' --ingress-security-rules '[{"source": "0.0.0.0/0", "protocol": "all", "isStateless": false}]' --force
```

--------------------------------

### Verify installed extensions

Source: https://docs.siderolabs.com/talos/v1.13/configure-your-talos-cluster/hardware-and-drivers/nvidia-gpu-proprietary

List the installed system extensions to ensure the NVIDIA container toolkit is present.

```bash
talosctl get extensions
```

```text
NODE           NAMESPACE   TYPE              ID                                                                 VERSION   NAME                       VERSION
172.31.41.27   runtime     ExtensionStatus   000.ghcr.io-frezbo-nvidia-container-toolkit-510.60.02-v1.9.0       1         nvidia-container-toolkit   510.60.02-v1.9.0
```
Tokens:
Raw