[{"data":1,"prerenderedAt":822},["ShallowReactive",2],{"blog-\u002Fposts\u002Funderstanding-talos":3,"blog-sidebar-posts":770},{"id":4,"title":5,"body":6,"category":754,"date":755,"description":756,"draft":757,"extension":758,"icon":759,"meta":760,"navigation":761,"order":736,"path":762,"section":754,"seo":763,"sidebarTitle":764,"stem":765,"tags":766,"updated":764,"__hash__":769},"blog\u002Fposts\u002Funderstanding-talos.md","Understanding Talos",{"type":7,"value":8,"toc":735},"minimark",[9,16,21,40,49,65,72,83,87,91,99,112,118,143,159,163,170,173,190,194,564,568,575,579,593,635,638,646,650,667,682,686,693,717,731],[10,11,12],"warning",{},[13,14,15],"p",{},"Booting into an air-gapped environment is not easy, and will not be covered by this guide.",[17,18,20],"h2",{"id":19},"about-talos","About Talos",[22,23,24,27],"blockquote",{},[13,25,26],{},"Talos Linux is Linux designed for Kubernetes – secure, immutable, and minimal.",[13,28,29],{},[30,31,32,33],"em",{},"Developed by ",[34,35,39],"a",{"href":36,"rel":37},"https:\u002F\u002Fwww.siderolabs.com\u002F",[38],"nofollow","Siderolabs",[41,42,44,45,48],"h3",{"id":43},"why-should-you-use-talos","Why ",[30,46,47],{},"should","  you use Talos?",[50,51,52,56,59,62],"ul",{},[53,54,55],"li",{},"Talos is a container optimized linux distro; it is designed to be as minimal as possible while still maintaining practicality.",[53,57,58],{},"Talos allows customization through the means of a machine config file that is generated along with the secrets needed to authenticate with your cluster.",[53,60,61],{},"Talos will always end up configured exactly the same every time (it is immutable).",[53,63,64],{},"Talos can be managed declaritively just like kubernetes. Making it easier to automate and maintain at scale.",[41,66,44,68,71],{"id":67},"why-shouldnt-i-used-ubuntu-or-debian",[30,69,70],{},"shouldn't","  I used Ubuntu or Debian?",[50,73,74,77,80],{},[53,75,76],{},"Debian-based Operating Systems are designed to be a general-purpose operating system.",[53,78,79],{},"Higher attack surface. Ubuntu server is a full linux distribution with a shell, multiple packages and services enabled by default. It is harder to guarantee that the system running kubernetes hasn't been tampered with.",[53,81,82],{},"For larger clusters, managing nodes will require more complex configurations, automation, and oversight.",[17,84,86],{"id":85},"getting-started-with-talos","Getting Started with Talos",[41,88,90],{"id":89},"prerequisites","Prerequisites",[13,92,93,94,98],{},"Almost all of the configuration will be over the Command-Line Interface or ",[95,96,97],"code",{},"CLI"," for short.",[13,100,101,102,107,108,111],{},"I highly recommend installing ",[34,103,106],{"href":104,"rel":105},"https:\u002F\u002Fbrew.sh\u002F",[38],"homebrew\u002Fbrew.sh"," if you don't have it installed. Updating ",[95,109,110],{},"talosctl"," manually is difficult and tiring.",[13,113,114,115,117],{},"If you have homebrew installed, you can install ",[95,116,110],{}," via:",[119,120,125],"pre",{"className":121,"code":122,"language":123,"meta":124,"style":124},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","brew install siderolabs\u002Ftap\u002Ftalosctl\n","bash","",[95,126,127],{"__ignoreMap":124},[128,129,132,136,140],"span",{"class":130,"line":131},"line",1,[128,133,135],{"class":134},"sBMFI","brew",[128,137,139],{"class":138},"sfazB"," install",[128,141,142],{"class":138}," siderolabs\u002Ftap\u002Ftalosctl\n",[13,144,145,146,148,149,154,155,158],{},"Windows users can also use the brew command above if brew is installed, otherwise you can download the latest ",[95,147,110],{}," binary from ",[34,150,153],{"href":151,"rel":152},"https:\u002F\u002Fgithub.com\u002Fsiderolabs\u002Ftalos\u002Freleases\u002F",[38],"here"," and put it in your ",[95,156,157],{},"$PATH"," each time it updates.",[41,160,162],{"id":161},"building-your-factory-image","Building Your Factory Image",[13,164,165,166],{},"Talos provides this awesome factory that helps configure and package various boot assets required for each node: ",[34,167,168],{"href":168,"rel":169},"https:\u002F\u002Ffactory.talos.dev\u002F",[38],[13,171,172],{},"The factory will guide you through creating the ideal image for your node by configuring:",[50,174,175,178,181,184,187],{},[53,176,177],{},"The Hardware Type",[53,179,180],{},"Talos Version",[53,182,183],{},"Architecture",[53,185,186],{},"Secure Boot",[53,188,189],{},"Extensions",[41,191,193],{"id":192},"deciding-what-extensions-you-need","Deciding What Extensions You Need",[195,196,197,289,403,506],"accordion",{},[198,199,201],"accordion-item",{"label":200},"Firmware Extensions",[202,203,204,217],"table",{},[205,206,207],"thead",{},[208,209,210,214],"tr",{},[211,212,213],"th",{},"Extension Name",[211,215,216],{},"Description",[218,219,220,233,241,249,257,265,273,281],"tbody",{},[208,221,222,226],{},[223,224,225],"td",{},"amdgpu-firmware",[223,227,228,229,232],{},"Provides AMD GPU firmware binaries required for the ",[95,230,231],{},"amdgpu"," driver.",[208,234,235,238],{},[223,236,237],{},"amd-ucode",[223,239,240],{},"Provides AMD CPU microcode binaries.",[208,242,243,246],{},[223,244,245],{},"chelsio-firmware",[223,247,248],{},"Provides firmware for Chelsio NICs.",[208,250,251,254],{},[223,252,253],{},"i915-ucode",[223,255,256],{},"Provides Intel GPU microcode binaries.",[208,258,259,262],{},[223,260,261],{},"intel-ice-firmware",[223,263,264],{},"Provides Intel Ice network firmware binaries.",[208,266,267,270],{},[223,268,269],{},"intel-ucode",[223,271,272],{},"Provides Intel CPU microcode binaries.",[208,274,275,278],{},[223,276,277],{},"qlogic-firmware",[223,279,280],{},"Provides firmware for QLogic devices.",[208,282,283,286],{},[223,284,285],{},"realtek-firmware",[223,287,288],{},"Provides Realtek firmware binaries.",[198,290,292],{"label":291},"Kernel Modules",[202,293,294,302],{},[205,295,296],{},[208,297,298,300],{},[211,299,213],{},[211,301,216],{},[218,303,304,315,323,331,339,347,355,363,371,379,387,395],{},[208,305,306,309],{},[223,307,308],{},"binfmt-misc",[223,310,311,312,314],{},"Provides the kernel module for ",[95,313,308],{},", enabling execution of different binary formats.",[208,316,317,320],{},[223,318,319],{},"bnx2-bnx2x",[223,321,322],{},"Provides network drivers for Broadcom network devices (bnx2 and bnx2x).",[208,324,325,328],{},[223,326,327],{},"btrfs",[223,329,330],{},"Provides the BTRFS filesystem kernel module.",[208,332,333,336],{},[223,334,335],{},"chelsio-drivers",[223,337,338],{},"Provides network drivers for Chelsio NICs.",[208,340,341,344],{},[223,342,343],{},"drbd",[223,345,346],{},"Provides Distributed Replicated Block Device (DRBD) kernel module.",[208,348,349,352],{},[223,350,351],{},"gasket-driver",[223,353,354],{},"Provides Google gasket driver kernel modules for PCIe and M.2 Google Coral accelerators.",[208,356,357,360],{},[223,358,359],{},"nvidia-open-gpu-kernel-modules",[223,361,362],{},"Provides Nvidia open-source GPU driver kernel modules.",[208,364,365,368],{},[223,366,367],{},"thunderbolt",[223,369,370],{},"Provides Thunderbolt\u002FUSB4 driver kernel modules.",[208,372,373,376],{},[223,374,375],{},"usb-modem-drivers",[223,377,378],{},"Provides USB modem driver kernel modules.",[208,380,381,384],{},[223,382,383],{},"v4l-uvc-drivers",[223,385,386],{},"Provides Video4Linux drivers for USB Video Class devices.",[208,388,389,392],{},[223,390,391],{},"zfs",[223,393,394],{},"Provides ZFS filesystem kernel modules. (Pool must exist before booting)",[208,396,397,400],{},[223,398,399],{},"nonfree-kmod-nvidia",[223,401,402],{},"Provides proprietary Nvidia kernel modules.",[198,404,406],{"label":405},"Container and Virtualization Extensions",[202,407,408,416],{},[205,409,410],{},[208,411,412,414],{},[211,413,213],{},[211,415,216],{},[218,417,418,426,434,442,450,458,466,474,482,490,498],{},[208,419,420,423],{},[223,421,422],{},"ecr-credential-provider",[223,424,425],{},"Provides credentials for Kubelet to authenticate against AWS Elastic Container Registry.",[208,427,428,431],{},[223,429,430],{},"gvisor",[223,432,433],{},"Provides gVisor as a sandboxed container runtime.",[208,435,436,439],{},[223,437,438],{},"gvisor-debug",[223,440,441],{},"Enables gVisor debug logging.",[208,443,444,447],{},[223,445,446],{},"kata-containers",[223,448,449],{},"Provides Kata Containers runtime for lightweight virtualized containers.",[208,451,452,455],{},[223,453,454],{},"nvidia-container-toolkit",[223,456,457],{},"Provides Nvidia runtime and its dependencies using NVIDIA's runtime handler.",[208,459,460,463],{},[223,461,462],{},"qemu-guest-agent",[223,464,465],{},"Provides the QEMU Guest Agent service.",[208,467,468,471],{},[223,469,470],{},"spin",[223,472,473],{},"Provides runtime support for WebAssembly (WASM) containers using Spin.",[208,475,476,479],{},[223,477,478],{},"stargz-snapshotter",[223,480,481],{},"Provides Stargz Snapshotter using containerd's runtime handler.",[208,483,484,487],{},[223,485,486],{},"vmtoolsd-guest-agent",[223,488,489],{},"Provides the VMToolsd Guest Agent for interacting with virtual machine hosts.",[208,491,492,495],{},[223,493,494],{},"wasmedge",[223,496,497],{},"Provides support for the WasmEdge WebAssembly runtime.",[208,499,500,503],{},[223,501,502],{},"xen-guest-agent",[223,504,505],{},"Provides the Xen Guest Agent for communication with Xen hypervisor hosts.",[198,507,509],{"label":508},"Networking and System Tools",[202,510,511,519],{},[205,512,513],{},[208,514,515,517],{},[211,516,213],{},[211,518,216],{},[218,520,521,529,540,548,556],{},[208,522,523,526],{},[223,524,525],{},"iscsi-tools",[223,527,528],{},"Provides tools for iSCSI (Internet Small Computer System Interface).",[208,530,531,534],{},[223,532,533],{},"mdadm",[223,535,536,537,539],{},"Provides the ",[95,538,533],{}," tool for managing RAID arrays.",[208,541,542,545],{},[223,543,544],{},"nut-client",[223,546,547],{},"Provides the Network UPS Tools (NUT) client for monitoring UPS devices. (Requires Config)",[208,549,550,553],{},[223,551,552],{},"tailscale",[223,554,555],{},"Tailscale connects your team's devices and development environments for easy access to remote resources. (Requires Config)",[208,557,558,561],{},[223,559,560],{},"util-linux-tools",[223,562,563],{},"Provides a minimal util-linux package.",[41,565,567],{"id":566},"flashing-your-image","Flashing Your Image",[13,569,570,571,574],{},"Assuming you have somehow managed to coerce your machine into booting from the ISO, Talos will be running in ",[30,572,573],{},"mainteance"," mode. It is running in RAM and will not install itself to any disk without a configuration.",[41,576,578],{"id":577},"finding-your-disks","Finding Your Disks",[13,580,581,582,585,586,588,589,592],{},"While your machine is in ",[30,583,584],{},"mainteance mode",", you can use the ",[95,587,97],{}," to fetch details about the machine. You will need to use the ",[95,590,591],{},"--insecure"," flag as the machine does not have any configuration associated with it.",[119,594,596],{"className":121,"code":595,"language":123,"meta":124,"style":124},"talosctl disks -n \u003Cyour_node_ip> -e \u003Cyour_node_ip> --insecure\n",[95,597,598],{"__ignoreMap":124},[128,599,600,602,605,608,612,615,618,621,624,626,628,630,632],{"class":130,"line":131},[128,601,110],{"class":134},[128,603,604],{"class":138}," disks",[128,606,607],{"class":138}," -n",[128,609,611],{"class":610},"sMK4o"," \u003C",[128,613,614],{"class":138},"your_node_i",[128,616,13],{"class":617},"sTEyZ",[128,619,620],{"class":610},">",[128,622,623],{"class":138}," -e",[128,625,611],{"class":610},[128,627,614],{"class":138},[128,629,13],{"class":617},[128,631,620],{"class":610},[128,633,634],{"class":138}," --insecure\n",[13,636,637],{},"Here is the output if the machine has Talos installed:",[119,639,644],{"className":640,"code":642,"language":643},[641],"language-text","NODE        DEV            MODEL                      SERIAL             TYPE   UUID                                   WWID                                                                   MODALIAS   NAME   SIZE     BUS_PATH                                                   SUBSYSTEM          READ_ONLY   SYSTEM_DISK\n10.69.0.2   \u002Fdev\u002Fnvme0n1   CT1000P3SSD8               2318E6D1E1A3       NVME   -                                      nvme.c0a9-323331384536443145314133-435431303030503353534438-00000001   -          -      1.0 TB   \u002Fpci0000:00\u002F0000:00:1c.4\u002F0000:58:00.0\u002Fnvme\u002Fnvme0\u002Fnvme0n1   \u002Fsys\u002Fclass\u002Fblock\n10.69.0.2   \u002Fdev\u002Fnvme1n1   KINGSTON OM8PGP41024Q-A0   50026B7382F40A20   NVME   00000000-0000-0000-0026-b7382f40a205   eui.00000000000000000026b7382f40a205                                   -          -      1.0 TB   \u002Fpci0000:00\u002F0000:00:06.0\u002F0000:01:00.0\u002Fnvme\u002Fnvme1\u002Fnvme1n1   \u002Fsys\u002Fclass\u002Fblock               *\n10.69.0.2   \u002Fdev\u002Fnvme2n1   CT1000P3SSD8               2318E6D1804E       NVME   -\n","text",[95,645,642],{"__ignoreMap":124},[41,647,649],{"id":648},"scouring-your-talos-filesystem","Scouring Your Talos Filesystem",[13,651,652,654,655,658,659,662,663,666],{},[95,653,110],{}," provides the ",[95,656,657],{},"read",", ",[95,660,661],{},"list"," & ",[95,664,665],{},"copy"," commands for looking and pulling information from the filesystem.",[13,668,669,670,675,676,681],{},"This is particularly helpful for searching for the disk id's for your drives when setting up a storage engine like ",[34,671,674],{"href":672,"rel":673},"https:\u002F\u002Flonghorn.io\u002F",[38],"longhorn"," or ",[34,677,680],{"href":678,"rel":679},"https:\u002F\u002Frook.io",[38],"rook-ceph",".",[41,683,685],{"id":684},"accessing-the-node-through-other-means","Accessing The Node (through other means)",[13,687,688,689,692],{},"In the case you need to interact with the node, you can create a privileged pod and enter an interactive session with it using the ",[95,690,691],{},"kubectl"," tool.",[119,694,696],{"className":121,"code":695,"language":123,"meta":124,"style":124},"kubectl run toolbox --image=debian:latest --privileged=true -it\n",[95,697,698],{"__ignoreMap":124},[128,699,700,702,705,708,711,714],{"class":130,"line":131},[128,701,691],{"class":134},[128,703,704],{"class":138}," run",[128,706,707],{"class":138}," toolbox",[128,709,710],{"class":138}," --image=debian:latest",[128,712,713],{"class":138}," --privileged=true",[128,715,716],{"class":138}," -it\n",[50,718,719,725],{},[53,720,721,724],{},[95,722,723],{},"-i"," will keep the output open regardless if nothing is attached.",[53,726,727,730],{},[95,728,729],{},"-t"," will allocate a output for the container.",[732,733,734],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":124,"searchDepth":736,"depth":736,"links":737},2,[738,745],{"id":19,"depth":736,"text":20,"children":739},[740,743],{"id":43,"depth":741,"text":742},3,"Why should  you use Talos?",{"id":67,"depth":741,"text":744},"Why shouldn't  I used Ubuntu or Debian?",{"id":85,"depth":736,"text":86,"children":746},[747,748,749,750,751,752,753],{"id":89,"depth":741,"text":90},{"id":161,"depth":741,"text":162},{"id":192,"depth":741,"text":193},{"id":566,"depth":741,"text":567},{"id":577,"depth":741,"text":578},{"id":648,"depth":741,"text":649},{"id":684,"depth":741,"text":685},"guides","2024-09-17","Talos provides a secure, immutable, minimal and confusing operating system for new users.",false,"md","i-ph-bird",{},true,"\u002Fposts\u002Funderstanding-talos",{"title":5,"description":756},null,"posts\u002Funderstanding-talos",[767,768],"talos","kubernetes","6-1FPy5OoCcCvA0LMDGAx71abcwsIRlWQtrJLwYMjCg",[771,779,786,792,797,798,803,808,813,817],{"title":772,"sidebarTitle":764,"description":773,"path":774,"icon":775,"order":764,"section":776,"category":777,"date":778},"Hello, world","The site has a blog now. Here's what to expect.","\u002Fposts\u002Fhello-world","i-ph-hand-waving","blog","meta","2026-10-05",{"title":780,"sidebarTitle":764,"description":781,"path":782,"icon":783,"order":736,"section":784,"category":784,"date":785},"Github Repository","Some of the things I do in my github repository that isn't shown","\u002Fposts\u002Fgithub-repository","i-ph-github-logo","homelab","2024-09-21",{"title":787,"sidebarTitle":788,"description":124,"path":789,"icon":790,"order":791,"section":754,"category":754,"date":755},"Allowing Custom Secure Boot Keys on the Minisforum MS-01","MS-01 Secure Boot","\u002Fposts\u002Fms01-secure-boot","i-ph-key",4,{"title":793,"sidebarTitle":764,"description":794,"path":795,"icon":796,"order":741,"section":754,"category":754,"date":755},"Proxy DHCP PXE Booting","Utilize dnsmasq to allow PXE bootstraping your Kubernetes nodes seamlessly.","\u002Fposts\u002Fproxy-dhcp-booting","i-ph-arrows-left-right",{"title":5,"sidebarTitle":764,"description":756,"path":762,"icon":759,"order":736,"section":754,"category":754,"date":755},{"title":799,"sidebarTitle":764,"description":124,"path":800,"icon":801,"order":131,"section":784,"category":784,"date":802},"Cloud Dependencies","\u002Fposts\u002Fcloud-dependencies","i-ph-cloud","2024-09-16",{"title":804,"sidebarTitle":764,"description":805,"path":806,"icon":775,"order":131,"section":784,"category":807,"date":802},"Introduction","The nodes and the bees.","\u002Fposts\u002Fintroduction","welcome",{"title":809,"sidebarTitle":764,"description":810,"path":811,"icon":812,"order":791,"section":784,"category":784,"date":802},"Janky Networking","See how my network comes to a crawl once RSTP is disabled...","\u002Fposts\u002Fnetworking","i-ph-network",{"title":814,"sidebarTitle":764,"description":124,"path":815,"icon":816,"order":736,"section":784,"category":807,"date":802},"Special Thanks","\u002Fposts\u002Fspecial-thanks","i-ph-medal",{"title":818,"sidebarTitle":764,"description":124,"path":819,"icon":820,"order":736,"section":784,"category":821,"date":802},"TrueNAS","\u002Fposts\u002Ftruenas","i-simple-icons-truenas","storage",1792630416666]