This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Reference

1: API
2: CLI
3: Configuration
4: Kernel
5: Platform

1 - API

Talos gRPC API reference.

common/common.proto
inspect/inspect.proto
machine/machine.proto
resource/resource.proto
security/security.proto
storage/storage.proto
time/time.proto
Scalar Value Types

Top

common/common.proto

Data

Field	Type	Label	Description
metadata	Metadata
bytes	bytes

DataResponse

Field	Type	Label	Description
messages	Data	repeated

Empty

Field	Type	Label	Description
metadata	Metadata

EmptyResponse

Field	Type	Label	Description
messages	Empty	repeated

Error

Field	Type	Label
code	Code
message	string
details	google.protobuf.Any	repeated

Metadata

Common metadata message nested in all reply message types

Field	Type	Description
hostname	string	hostname of the server response comes from (injected by proxy)
error	string	error is set if request failed to the upstream (rest of response is undefined)
status	google.rpc.Status	error as gRPC Status

NetIP

Field	Type	Label	Description
ip	bytes

NetIPPort

Field	Type	Label	Description
ip	bytes
port	int32

NetIPPrefix

Field	Type	Label	Description
ip	bytes
prefix_length	int32

PEMEncodedCertificateAndKey

Field	Type	Label	Description
crt	bytes
key	bytes

PEMEncodedKey

Field	Type	Label	Description
key	bytes

URL

Field	Type	Label	Description
full_path	string

Code

Name	Number	Description
FATAL	0
LOCKED	1
CANCELED	2

ContainerDriver

Name	Number	Description
CONTAINERD	0
CRI	1

File-level Extensions

Extension	Type	Base	Number	Description
remove_deprecated_enum	string	.google.protobuf.EnumOptions	93117	Indicates the Talos version when this deprecated enum will be removed from API.
remove_deprecated_enum_value	string	.google.protobuf.EnumValueOptions	93117	Indicates the Talos version when this deprecated enum value will be removed from API.
remove_deprecated_field	string	.google.protobuf.FieldOptions	93117	Indicates the Talos version when this deprecated filed will be removed from API.
remove_deprecated_message	string	.google.protobuf.MessageOptions	93117	Indicates the Talos version when this deprecated message will be removed from API.
remove_deprecated_method	string	.google.protobuf.MethodOptions	93117	Indicates the Talos version when this deprecated method will be removed from API.
remove_deprecated_service	string	.google.protobuf.ServiceOptions	93117	Indicates the Talos version when this deprecated service will be removed from API.

Top

inspect/inspect.proto

ControllerDependencyEdge

Field	Type	Label	Description
controller_name	string
edge_type	DependencyEdgeType
resource_namespace	string
resource_type	string
resource_id	string

ControllerRuntimeDependenciesResponse

Field	Type	Label	Description
messages	ControllerRuntimeDependency	repeated

ControllerRuntimeDependency

The ControllerRuntimeDependency message contains the graph of controller-resource dependencies.

Field	Type	Label	Description
metadata	common.Metadata
edges	ControllerDependencyEdge	repeated

DependencyEdgeType

Name	Number	Description
OUTPUT_EXCLUSIVE	0
OUTPUT_SHARED	3
INPUT_STRONG	1
INPUT_WEAK	2
INPUT_DESTROY_READY	4

InspectService

The inspect service definition.

InspectService provides auxiliary API to inspect OS internals.

Method Name	Request Type	Response Type	Description
ControllerRuntimeDependencies	.google.protobuf.Empty	ControllerRuntimeDependenciesResponse

Top

machine/machine.proto

AddressEvent

AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname.

Field	Type	Label	Description
hostname	string
addresses	string	repeated

ApplyConfiguration

ApplyConfigurationResponse describes the response to a configuration request.

Field	Type	Label	Description
metadata	common.Metadata
warnings	string	repeated	Configuration validation warnings.
mode	ApplyConfigurationRequest.Mode		States which mode was actually chosen.
mode_details	string		Human-readable message explaining the result of the apply configuration call.

ApplyConfigurationRequest

rpc applyConfiguration ApplyConfiguration describes a request to assert a new configuration upon a node.

Field	Type	Description
data	bytes
on_reboot	bool	Deprecated. replaced by mode
immediate	bool	Deprecated. replaced by mode
mode	ApplyConfigurationRequest.Mode
dry_run	bool
try_mode_timeout	google.protobuf.Duration

ApplyConfigurationResponse

Field	Type	Label	Description
messages	ApplyConfiguration	repeated

BPFInstruction

Field	Type	Label	Description
op	uint32
jt	uint32
jf	uint32
k	uint32

Bootstrap

The bootstrap message containing the bootstrap status.

Field	Type	Label	Description
metadata	common.Metadata

BootstrapRequest

rpc Bootstrap

Field	Type	Label	Description
recover_etcd	bool		Enable etcd recovery from the snapshot.

Enable this when recovering from data directory copy to skip integrity check. |

BootstrapResponse

Field	Type	Label	Description
messages	Bootstrap	repeated

CNIConfig

Field	Type	Label	Description
name	string
urls	string	repeated

CPUInfo

Field	Type	Label
processor	uint32
vendor_id	string
cpu_family	string
model	string
model_name	string
stepping	string
microcode	string
cpu_mhz	double
cache_size	string
physical_id	string
siblings	uint32
core_id	string
cpu_cores	uint32
apic_id	string
initial_apic_id	string
fpu	string
fpu_exception	string
cpu_id_level	uint32
wp	string
flags	string	repeated
bugs	string	repeated
bogo_mips	double
cl_flush_size	uint32
cache_alignment	uint32
address_sizes	string
power_management	string

CPUInfoResponse

Field	Type	Label	Description
messages	CPUsInfo	repeated

CPUStat

Field	Type	Label	Description
user	double
nice	double
system	double
idle	double
iowait	double
irq	double
soft_irq	double
steal	double
guest	double
guest_nice	double

CPUsInfo

Field	Type	Label	Description
metadata	common.Metadata
cpu_info	CPUInfo	repeated

ClusterConfig

Field	Type	Label	Description
name	string
control_plane	ControlPlaneConfig
cluster_network	ClusterNetworkConfig
allow_scheduling_on_control_planes	bool

ClusterNetworkConfig

Field	Type	Label	Description
dns_domain	string
cni_config	CNIConfig

ConfigLoadErrorEvent

ConfigLoadErrorEvent is reported when the config loading has failed.

Field	Type	Label	Description
error	string

ConfigValidationErrorEvent

ConfigValidationErrorEvent is reported when config validation has failed.

Field	Type	Label	Description
error	string

Container

The messages message containing the requested containers.

Field	Type	Label	Description
metadata	common.Metadata
containers	ContainerInfo	repeated

ContainerInfo

The messages message containing the requested containers.

Field	Type	Label	Description
namespace	string
id	string
image	string
pid	uint32
status	string
pod_id	string
name	string

ContainersRequest

Field	Type	Label	Description
namespace	string
driver	common.ContainerDriver		driver might be default “containerd” or “cri”

ContainersResponse

Field	Type	Label	Description
messages	Container	repeated

ControlPlaneConfig

Field	Type	Label	Description
endpoint	string

CopyRequest

CopyRequest describes a request to copy data out of Talos node

Copy produces .tar.gz archive which is streamed back to the caller

Field	Type	Label	Description
root_path	string		Root path to start copying data out, it might be either a file or directory

DHCPOptionsConfig

Field	Type	Label	Description
route_metric	uint32

DiskStat

Field	Type	Label	Description
name	string
read_completed	uint64
read_merged	uint64
read_sectors	uint64
read_time_ms	uint64
write_completed	uint64
write_merged	uint64
write_sectors	uint64
write_time_ms	uint64
io_in_progress	uint64
io_time_ms	uint64
io_time_weighted_ms	uint64
discard_completed	uint64
discard_merged	uint64
discard_sectors	uint64
discard_time_ms	uint64

DiskStats

Field	Type	Label
metadata	common.Metadata
total	DiskStat
devices	DiskStat	repeated

DiskStatsResponse

Field	Type	Label	Description
messages	DiskStats	repeated

DiskUsageInfo

DiskUsageInfo describes a file or directory’s information for du command

Field	Type	Description
metadata	common.Metadata
name	string	Name is the name (including prefixed path) of the file or directory
size	int64	Size indicates the number of bytes contained within the file
error	string	Error describes any error encountered while trying to read the file information.
relative_name	string	RelativeName is the name of the file or directory relative to the RootPath

DiskUsageRequest

DiskUsageRequest describes a request to list disk usage of directories and regular files

Field	Type	Label	Description
recursion_depth	int32		RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced.
all	bool		All write sizes for all files, not just directories.
threshold	int64		Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative.
paths	string	repeated	DiskUsagePaths is the list of directories to calculate disk usage for.

DmesgRequest

dmesg

Field	Type	Label	Description
follow	bool
tail	bool

EtcdForfeitLeadership

Field	Type	Label	Description
metadata	common.Metadata
member	string

EtcdForfeitLeadershipRequest

EtcdForfeitLeadershipResponse

Field	Type	Label	Description
messages	EtcdForfeitLeadership	repeated

EtcdLeaveCluster

Field	Type	Label	Description
metadata	common.Metadata

EtcdLeaveClusterRequest

EtcdLeaveClusterResponse

Field	Type	Label	Description
messages	EtcdLeaveCluster	repeated

EtcdMember

EtcdMember describes a single etcd member.

Field	Type	Label	Description
id	uint64		member ID.
hostname	string		human-readable name of the member.
peer_urls	string	repeated	the list of URLs the member exposes to clients for communication.
client_urls	string	repeated	the list of URLs the member exposes to the cluster for communication.
is_learner	bool		learner flag

EtcdMemberListRequest

Field	Type	Label	Description
query_local	bool

EtcdMemberListResponse

Field	Type	Label	Description
messages	EtcdMembers	repeated

EtcdMembers

EtcdMembers contains the list of members registered on the host.

Field	Type	Label	Description
metadata	common.Metadata
legacy_members	string	repeated	list of member hostnames.
members	EtcdMember	repeated	the list of etcd members registered on the node.

EtcdRecover

Field	Type	Label	Description
metadata	common.Metadata

EtcdRecoverResponse

Field	Type	Label	Description
messages	EtcdRecover	repeated

EtcdRemoveMember

Field	Type	Label	Description
metadata	common.Metadata

EtcdRemoveMemberRequest

Field	Type	Label	Description
member	string

EtcdRemoveMemberResponse

Field	Type	Label	Description
messages	EtcdRemoveMember	repeated

EtcdSnapshotRequest

Event

Field	Type	Label	Description
metadata	common.Metadata
data	google.protobuf.Any
id	string
actor_id	string

EventsRequest

Field	Type	Label	Description
tail_events	int32
tail_id	string
tail_seconds	int32
with_actor_id	string

FeaturesInfo

FeaturesInfo describes individual Talos features that can be switched on or off.

Field	Type	Label	Description
rbac	bool		RBAC is true if role-based access control is enabled.

FileInfo

FileInfo describes a file or directory’s information

Field	Type	Description
metadata	common.Metadata
name	string	Name is the name (including prefixed path) of the file or directory
size	int64	Size indicates the number of bytes contained within the file
mode	uint32	Mode is the bitmap of UNIX mode/permission flags of the file
modified	int64	Modified indicates the UNIX timestamp at which the file was last modified
is_dir	bool	IsDir indicates that the file is a directory
error	string	Error describes any error encountered while trying to read the file information.
link	string	Link is filled with symlink target
relative_name	string	RelativeName is the name of the file or directory relative to the RootPath
uid	uint32	Owner uid
gid	uint32	Owner gid

GenerateClientConfiguration

Field	Type	Description
metadata	common.Metadata
ca	bytes	PEM-encoded CA certificate.
crt	bytes	PEM-encoded generated client certificate.
key	bytes	PEM-encoded generated client key.
talosconfig	bytes	Client configuration (talosconfig) file content.

GenerateClientConfigurationRequest

Field	Type	Label	Description
roles	string	repeated	Roles in the generated client certificate.
crt_ttl	google.protobuf.Duration		Client certificate TTL.

GenerateClientConfigurationResponse

Field	Type	Label	Description
messages	GenerateClientConfiguration	repeated

GenerateConfiguration

GenerateConfiguration describes the response to a generate configuration request.

Field	Type	Label
metadata	common.Metadata
data	bytes	repeated
talosconfig	bytes

GenerateConfigurationRequest

GenerateConfigurationRequest describes a request to generate a new configuration on a node.

Field	Type	Label	Description
config_version	string
cluster_config	ClusterConfig
machine_config	MachineConfig
override_time	google.protobuf.Timestamp

GenerateConfigurationResponse

Field	Type	Label	Description
messages	GenerateConfiguration	repeated

Hostname

Field	Type	Label	Description
metadata	common.Metadata
hostname	string

HostnameResponse

Field	Type	Label	Description
messages	Hostname	repeated

InstallConfig

Field	Type	Label	Description
install_disk	string
install_image	string

ListRequest

ListRequest describes a request to list the contents of a directory.

Field	Type	Label	Description
root	string		Root indicates the root directory for the list. If not indicated, ‘/’ is presumed.
recurse	bool		Recurse indicates that subdirectories should be recursed.
recursion_depth	int32		RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced.
types	ListRequest.Type	repeated	Types indicates what file type should be returned. If not indicated, all files will be returned.

LoadAvg

Field	Type	Label	Description
metadata	common.Metadata
load1	double
load5	double
load15	double

LoadAvgResponse

Field	Type	Label	Description
messages	LoadAvg	repeated

LogsRequest

rpc logs The request message containing the process name.

Field	Type	Description
namespace	string
id	string
driver	common.ContainerDriver	driver might be default “containerd” or “cri”
follow	bool
tail_lines	int32

MachineConfig

Field	Type	Label	Description
type	MachineConfig.MachineType
install_config	InstallConfig
network_config	NetworkConfig
kubernetes_version	string

MachineStatusEvent

MachineStatusEvent reports changes to the MachineStatus resource.

Field	Type	Label	Description
stage	MachineStatusEvent.MachineStage
status	MachineStatusEvent.MachineStatus

MachineStatusEvent.MachineStatus

Field	Type	Label	Description
ready	bool
unmet_conditions	MachineStatusEvent.MachineStatus.UnmetCondition	repeated

MachineStatusEvent.MachineStatus.UnmetCondition

Field	Type	Label	Description
name	string
reason	string

MemInfo

Field	Type	Label	Description
memtotal	uint64
memfree	uint64
memavailable	uint64
buffers	uint64
cached	uint64
swapcached	uint64
active	uint64
inactive	uint64
activeanon	uint64
inactiveanon	uint64
activefile	uint64
inactivefile	uint64
unevictable	uint64
mlocked	uint64
swaptotal	uint64
swapfree	uint64
dirty	uint64
writeback	uint64
anonpages	uint64
mapped	uint64
shmem	uint64
slab	uint64
sreclaimable	uint64
sunreclaim	uint64
kernelstack	uint64
pagetables	uint64
nfsunstable	uint64
bounce	uint64
writebacktmp	uint64
commitlimit	uint64
committedas	uint64
vmalloctotal	uint64
vmallocused	uint64
vmallocchunk	uint64
hardwarecorrupted	uint64
anonhugepages	uint64
shmemhugepages	uint64
shmempmdmapped	uint64
cmatotal	uint64
cmafree	uint64
hugepagestotal	uint64
hugepagesfree	uint64
hugepagesrsvd	uint64
hugepagessurp	uint64
hugepagesize	uint64
directmap4k	uint64
directmap2m	uint64
directmap1g	uint64

Memory

Field	Type	Label	Description
metadata	common.Metadata
meminfo	MemInfo

MemoryResponse

Field	Type	Label	Description
messages	Memory	repeated

MountStat

The messages message containing the requested processes.

Field	Type	Label	Description
filesystem	string
size	uint64
available	uint64
mounted_on	string

Mounts

The messages message containing the requested df stats.

Field	Type	Label	Description
metadata	common.Metadata
stats	MountStat	repeated

MountsResponse

Field	Type	Label	Description
messages	Mounts	repeated

NetDev

Field	Type	Label	Description
name	string
rx_bytes	uint64
rx_packets	uint64
rx_errors	uint64
rx_dropped	uint64
rx_fifo	uint64
rx_frame	uint64
rx_compressed	uint64
rx_multicast	uint64
tx_bytes	uint64
tx_packets	uint64
tx_errors	uint64
tx_dropped	uint64
tx_fifo	uint64
tx_collisions	uint64
tx_carrier	uint64
tx_compressed	uint64

NetworkConfig

Field	Type	Label	Description
hostname	string
interfaces	NetworkDeviceConfig	repeated

NetworkDeviceConfig

Field	Type	Label
interface	string
cidr	string
mtu	int32
dhcp	bool
ignore	bool
dhcp_options	DHCPOptionsConfig
routes	RouteConfig	repeated

NetworkDeviceStats

Field	Type	Label
metadata	common.Metadata
total	NetDev
devices	NetDev	repeated

NetworkDeviceStatsResponse

Field	Type	Label	Description
messages	NetworkDeviceStats	repeated

PacketCaptureRequest

Field	Type	Label	Description
interface	string		Interface name to perform packet capture on.
promiscuous	bool		Enable promiscuous mode.
snap_len	uint32		Snap length in bytes.
bpf_filter	BPFInstruction	repeated	BPF filter.

PhaseEvent

Field	Type	Label	Description
phase	string
action	PhaseEvent.Action

PlatformInfo

Field	Type	Label	Description
name	string
mode	string

Process

Field	Type	Label	Description
metadata	common.Metadata
processes	ProcessInfo	repeated

ProcessInfo

Field	Type	Label	Description
pid	int32
ppid	int32
state	string
threads	int32
cpu_time	double
virtual_memory	uint64
resident_memory	uint64
command	string
executable	string
args	string

ProcessesResponse

rpc processes

Field	Type	Label	Description
messages	Process	repeated

ReadRequest

Field	Type	Label	Description
path	string

Reboot

The reboot message containing the reboot status.

Field	Type	Label	Description
metadata	common.Metadata
actor_id	string

RebootRequest

rpc reboot

Field	Type	Label	Description
mode	RebootRequest.Mode

RebootResponse

Field	Type	Label	Description
messages	Reboot	repeated

Reset

The reset message containing the restart status.

Field	Type	Label	Description
metadata	common.Metadata
actor_id	string

ResetPartitionSpec

rpc reset

Field	Type	Label	Description
label	string
wipe	bool

ResetRequest

Field	Type	Label	Description
graceful	bool		Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving.
reboot	bool		Reboot indicates whether node should reboot or halt after resetting.
system_partitions_to_wipe	ResetPartitionSpec	repeated	System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased.

ResetResponse

Field	Type	Label	Description
messages	Reset	repeated

Restart

Field	Type	Label	Description
metadata	common.Metadata

RestartEvent

Field	Type	Label	Description
cmd	int64

RestartRequest

rpc restart The request message containing the process to restart.

Field	Type	Description
namespace	string
id	string
driver	common.ContainerDriver	driver might be default “containerd” or “cri”

RestartResponse

The messages message containing the restart status.

Field	Type	Label	Description
messages	Restart	repeated

Rollback

Field	Type	Label	Description
metadata	common.Metadata

RollbackRequest

rpc rollback

RollbackResponse

Field	Type	Label	Description
messages	Rollback	repeated

RouteConfig

Field	Type	Label	Description
network	string
gateway	string
metric	uint32

SequenceEvent

rpc events

Field	Type	Label	Description
sequence	string
action	SequenceEvent.Action
error	common.Error

ServiceEvent

Field	Type	Label	Description
msg	string
state	string
ts	google.protobuf.Timestamp

ServiceEvents

Field	Type	Label	Description
events	ServiceEvent	repeated

ServiceHealth

Field	Type	Label	Description
unknown	bool
healthy	bool
last_message	string
last_change	google.protobuf.Timestamp

ServiceInfo

Field	Type	Label	Description
id	string
state	string
events	ServiceEvents
health	ServiceHealth

ServiceList

rpc servicelist

Field	Type	Label	Description
metadata	common.Metadata
services	ServiceInfo	repeated

ServiceListResponse

Field	Type	Label	Description
messages	ServiceList	repeated

ServiceRestart

Field	Type	Label	Description
metadata	common.Metadata
resp	string

ServiceRestartRequest

Field	Type	Label	Description
id	string

ServiceRestartResponse

Field	Type	Label	Description
messages	ServiceRestart	repeated

ServiceStart

Field	Type	Label	Description
metadata	common.Metadata
resp	string

ServiceStartRequest

rpc servicestart

Field	Type	Label	Description
id	string

ServiceStartResponse

Field	Type	Label	Description
messages	ServiceStart	repeated

ServiceStateEvent

Field	Type	Label	Description
service	string
action	ServiceStateEvent.Action
message	string
health	ServiceHealth

ServiceStop

Field	Type	Label	Description
metadata	common.Metadata
resp	string

ServiceStopRequest

Field	Type	Label	Description
id	string

ServiceStopResponse

Field	Type	Label	Description
messages	ServiceStop	repeated

Shutdown

rpc shutdown The messages message containing the shutdown status.

Field	Type	Label	Description
metadata	common.Metadata
actor_id	string

ShutdownRequest

Field	Type	Label	Description
force	bool		Force indicates whether node should shutdown without first cordening and draining

ShutdownResponse

Field	Type	Label	Description
messages	Shutdown	repeated

SoftIRQStat

Field	Type	Label	Description
hi	uint64
timer	uint64
net_tx	uint64
net_rx	uint64
block	uint64
block_io_poll	uint64
tasklet	uint64
sched	uint64
hrtimer	uint64
rcu	uint64

Stat

The messages message containing the requested stat.

Field	Type	Label	Description
namespace	string
id	string
memory_usage	uint64
cpu_usage	uint64
pod_id	string
name	string

Stats

The messages message containing the requested stats.

Field	Type	Label	Description
metadata	common.Metadata
stats	Stat	repeated

StatsRequest

The request message containing the containerd namespace.

Field	Type	Label	Description
namespace	string
driver	common.ContainerDriver		driver might be default “containerd” or “cri”

StatsResponse

Field	Type	Label	Description
messages	Stats	repeated

SystemStat

Field	Type	Label
metadata	common.Metadata
boot_time	uint64
cpu_total	CPUStat
cpu	CPUStat	repeated
irq_total	uint64
irq	uint64	repeated
context_switches	uint64
process_created	uint64
process_running	uint64
process_blocked	uint64
soft_irq_total	uint64
soft_irq	SoftIRQStat

SystemStatResponse

Field	Type	Label	Description
messages	SystemStat	repeated

TaskEvent

Field	Type	Label	Description
task	string
action	TaskEvent.Action

Upgrade

Field	Type	Label	Description
metadata	common.Metadata
ack	string
actor_id	string

UpgradeRequest

rpc upgrade

Field	Type	Label	Description
image	string
preserve	bool
stage	bool
force	bool

UpgradeResponse

Field	Type	Label	Description
messages	Upgrade	repeated

Version

Field	Type	Description
metadata	common.Metadata
version	VersionInfo
platform	PlatformInfo
features	FeaturesInfo	Features describe individual Talos features that can be switched on or off.

VersionInfo

Field	Type	Label	Description
tag	string
sha	string
built	string
go_version	string
os	string
arch	string

VersionResponse

Field	Type	Label	Description
messages	Version	repeated

ApplyConfigurationRequest.Mode

Name	Number	Description
REBOOT	0
AUTO	1
NO_REBOOT	2
STAGED	3
TRY	4

ListRequest.Type

File type.

Name	Number	Description
REGULAR	0	Regular file (not directory, symlink, etc).
DIRECTORY	1	Directory.
SYMLINK	2	Symbolic link.

MachineConfig.MachineType

Name	Number	Description
TYPE_UNKNOWN	0
TYPE_INIT	1
TYPE_CONTROL_PLANE	2
TYPE_WORKER	3

MachineStatusEvent.MachineStage

Name	Number	Description
UNKNOWN	0
BOOTING	1
INSTALLING	2
MAINTENANCE	3
RUNNING	4
REBOOTING	5
SHUTTING_DOWN	6
RESETTING	7
UPGRADING	8

PhaseEvent.Action

Name	Number	Description
START	0
STOP	1

RebootRequest.Mode

Name	Number	Description
DEFAULT	0
POWERCYCLE	1

SequenceEvent.Action

Name	Number	Description
NOOP	0
START	1
STOP	2

ServiceStateEvent.Action

Name	Number	Description
INITIALIZED	0
PREPARING	1
WAITING	2
RUNNING	3
STOPPING	4
FINISHED	5
FAILED	6
SKIPPED	7

TaskEvent.Action

Name	Number	Description
START	0
STOP	1

MachineService

The machine service definition.

Method Name	Request Type	Response Type	Description
ApplyConfiguration	ApplyConfigurationRequest	ApplyConfigurationResponse
Bootstrap	BootstrapRequest	BootstrapResponse	Bootstrap method makes control plane node enter etcd bootstrap mode.

Node aborts etcd join sequence and creates single-node etcd cluster.

Snapshot can be later used to recover the cluster via Bootstrap method. | | EtcdSnapshot | EtcdSnapshotRequest | .common.Data stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client.

Top

resource/resource.proto

Get

The GetResponse message contains the Resource returned.

Field	Type	Label	Description
metadata	common.Metadata
definition	Resource
resource	Resource

GetRequest

rpc Get

Field	Type	Label	Description
namespace	string
type	string
id	string

GetResponse

Field	Type	Label	Description
messages	Get	repeated

ListRequest

rpc List The ListResponse message contains the Resource returned.

Field	Type	Label	Description
namespace	string
type	string

ListResponse

Field	Type	Label	Description
metadata	common.Metadata
definition	Resource
resource	Resource

Metadata

Field	Type	Label
namespace	string
type	string
id	string
version	string
owner	string
phase	string
created	google.protobuf.Timestamp
updated	google.protobuf.Timestamp
finalizers	string	repeated
labels	Metadata.LabelsEntry	repeated

Metadata.LabelsEntry

Field	Type	Label	Description
key	string
value	string

Resource

Field	Type	Label	Description
metadata	Metadata
spec	Spec

Spec

Field	Type	Label	Description
yaml	bytes

WatchRequest

rpc Watch The WatchResponse message contains the Resource returned.

Field	Type	Label	Description
namespace	string
type	string
id	string
tail_events	uint32

WatchResponse

Field	Type	Label	Description
metadata	common.Metadata
event_type	EventType
definition	Resource
resource	Resource

EventType

Name	Number	Description
CREATED	0
UPDATED	1
DESTROYED	2

ResourceService

The resource service definition.

ResourceService provides user-facing API for the Talos resources.

Method Name	Request Type	Response Type
Get	GetRequest	GetResponse
List	ListRequest	ListResponse stream
Watch	WatchRequest	WatchResponse stream

Top

security/security.proto

CertificateRequest

The request message containing the certificate signing request.

Field	Type	Label	Description
csr	bytes		Certificate Signing Request in PEM format.

CertificateResponse

The response message containing signed certificate.

Field	Type	Label	Description
ca	bytes		Certificate of the CA that signed the requested certificate in PEM format.
crt	bytes		Signed X.509 requested certificate in PEM format.

SecurityService

The security service definition.

Method Name	Request Type	Response Type	Description
Certificate	CertificateRequest	CertificateResponse

Top

storage/storage.proto

Disk

Disk represents a disk.

Field	Type	Description
size	uint64	Size indicates the disk size in bytes.
model	string	Model idicates the disk model.
device_name	string	DeviceName indicates the disk name (e.g. `sda`).
name	string	Name as in `/sys/block/<dev>/device/name`.
serial	string	Serial as in `/sys/block/<dev>/device/serial`.
modalias	string	Modalias as in `/sys/block/<dev>/device/modalias`.
uuid	string	Uuid as in `/sys/block/<dev>/device/uuid`.
wwid	string	Wwid as in `/sys/block/<dev>/device/wwid`.
type	Disk.DiskType	Type is a type of the disk: nvme, ssd, hdd, sd card.
bus_path	string	BusPath is the bus path of the disk.

Disks

DisksResponse represents the response of the Disks RPC.

Field	Type	Label	Description
metadata	common.Metadata
disks	Disk	repeated

DisksResponse

Field	Type	Label	Description
messages	Disks	repeated

Disk.DiskType

Name	Number	Description
UNKNOWN	0
SSD	1
HDD	2
NVME	3
SD	4

StorageService

StorageService represents the storage service.

Method Name	Request Type	Response Type	Description
Disks	.google.protobuf.Empty	DisksResponse

Top

time/time.proto

Time

Field	Type	Label	Description
metadata	common.Metadata
server	string
localtime	google.protobuf.Timestamp
remotetime	google.protobuf.Timestamp

TimeRequest

The response message containing the ntp server

Field	Type	Label	Description
server	string

TimeResponse

The response message containing the ntp server, time, and offset

Field	Type	Label	Description
messages	Time	repeated

TimeService

The time service definition.

Method Name	Request Type	Response Type	Description
Time	.google.protobuf.Empty	TimeResponse
TimeCheck	TimeRequest	TimeResponse

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)

2 - CLI

talosctl apply-config

Apply a new configuration to a node

talosctl apply-config [flags]

Options

      --cert-fingerprint strings                                 list of server certificate fingeprints to accept (defaults to no check)
  -p, --config-patch strings                                     the list of config patches to apply to the local config file before sending it to the node
      --dry-run                                                  check how the config change will be applied in dry-run mode
  -f, --file string                                              the filename of the updated configuration
  -h, --help                                                     help for apply-config
  -i, --insecure                                                 apply the config using the insecure (encrypted with no auth) maintenance service
  -m, --mode auto, interactive, no-reboot, reboot, staged, try   apply config mode (default auto)
      --timeout duration                                         the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl bootstrap

Bootstrap the etcd cluster on the specified node.

Synopsis

When Talos cluster is created etcd service on control plane nodes enter the join loop waiting to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node.

This command should not be used when “init” type node are used.

Talos etcd cluster can be recovered from a known snapshot with ‘–recover-from=’ flag.

talosctl bootstrap [flags]

Options

  -h, --help                      help for bootstrap
      --recover-from string       recover etcd cluster from the snapshot
      --recover-skip-hash-check   skip integrity check when recovering etcd (use when recovering from data directory copy)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl cluster create

Creates a local docker-based or QEMU-based kubernetes cluster

talosctl cluster create [flags]

Options

      --arch string                              cluster architecture (default "amd64")
      --bad-rtc                                  launch VM with bad RTC state (QEMU only)
      --cidr string                              CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24")
      --cni-bin-path strings                     search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin])
      --cni-bundle-url string                    URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v1.2.0-alpha.2/talosctl-cni-bundle-${ARCH}.tar.gz")
      --cni-cache-dir string                     CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache")
      --cni-conf-dir string                      CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d")
      --config-patch stringArray                 patch generated machineconfigs (applied to all node types), use @file to read a patch from file
      --config-patch-control-plane stringArray   patch generated machineconfigs (applied to 'init' and 'controlplane' types)
      --config-patch-worker stringArray          patch generated machineconfigs (applied to 'worker' type)
      --control-plane-port int                   control plane port (load balancer and local API port) (default 6443)
      --controlplanes int                        the number of controlplanes to create (default 1)
      --cpus string                              the share of CPUs as fraction (each control plane/VM) (default "2.0")
      --cpus-workers string                      the share of CPUs as fraction (each worker/VM) (default "2.0")
      --crashdump                                print debug crashdump to stderr when cluster startup fails
      --custom-cni-url string                    install custom CNI from the URL (Talos cluster)
      --disable-dhcp-hostname                    skip announcing hostname via DHCP (QEMU only)
      --disk int                                 default limit on disk size in MB (each VM) (default 6144)
      --disk-image-path string                   disk image to use
      --dns-domain string                        the dns domain to use for cluster (default "cluster.local")
      --docker-disable-ipv6                      skip enabling IPv6 in containers (Docker only)
      --docker-host-ip string                    Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0")
      --encrypt-ephemeral                        enable ephemeral partition encryption
      --encrypt-state                            enable state partition encryption
      --endpoint string                          use endpoint instead of provider defaults
  -p, --exposed-ports string                     Comma-separated list of ports/protocols to expose on init node. Ex -p <hostPort>:<containerPort>/<protocol (tcp or udp)> (Docker provisioner only)
      --extra-boot-kernel-args string            add extra kernel args to the initial boot from vmlinuz and initramfs (QEMU only)
      --extra-disks int                          number of extra disks to create for each worker VM
      --extra-disks-size int                     default limit on disk size in MB (each VM) (default 5120)
      --extra-uefi-search-paths strings          additional search paths for UEFI firmware (only applies when UEFI is enabled)
  -h, --help                                     help for create
      --image string                             the image to use (default "ghcr.io/siderolabs/talos:latest")
      --init-node-as-endpoint                    use init node as endpoint instead of any load balancer endpoint
      --initrd-path string                       initramfs image to use (default "_out/initramfs-${ARCH}.xz")
  -i, --input-dir string                         location of pre-generated config files
      --install-image string                     the installer image to use (default "ghcr.io/siderolabs/installer:latest")
      --ipv4                                     enable IPv4 network in the cluster (default true)
      --ipv6                                     enable IPv6 network in the cluster (QEMU provisioner only)
      --iso-path string                          the ISO path to use for the initial boot (VM only)
      --kubernetes-version string                desired kubernetes version to run (default "1.25.0")
      --memory int                               the limit on memory usage in MB (each control plane/VM) (default 2048)
      --memory-workers int                       the limit on memory usage in MB (each worker/VM) (default 2048)
      --mtu int                                  MTU of the cluster network (default 1500)
      --nameservers strings                      list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111])
      --registry-insecure-skip-verify strings    list of registry hostnames to skip TLS verification for
      --registry-mirror strings                  list of registry mirrors to use in format: <registry host>=<mirror URL>
      --skip-injecting-config                    skip injecting config from embedded metadata server, write config files to current directory
      --skip-kubeconfig                          skip merging kubeconfig from the created cluster
      --talos-version string                     the desired Talos version to generate config for (if not set, defaults to image version)
      --use-vip                                  use a virtual IP for the controlplane endpoint instead of the loadbalancer
      --user-disk strings                        list of disks to create for each VM in format: <mount_point1>:<size1>:<mount_point2>:<size2>
      --vmlinuz-path string                      the compressed kernel image to use (default "_out/vmlinuz-${ARCH}")
      --wait                                     wait for the cluster to be ready before returning (default true)
      --wait-timeout duration                    timeout to wait for the cluster to be ready (default 20m0s)
      --wireguard-cidr string                    CIDR of the wireguard network
      --with-apply-config                        enable apply config when the VM is starting in maintenance mode
      --with-bootloader                          enable bootloader to load kernel and initramfs from disk image after install (default true)
      --with-cluster-discovery                   enable cluster discovery (default true)
      --with-debug                               enable debug in Talos config to send service logs to the console
      --with-init-node                           create the cluster with an init node
      --with-kubespan                            enable KubeSpan system
      --with-uefi                                enable UEFI on x86_64 architecture (default true)
      --workers int                              the number of workers to create (default 1)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
      --name string          the name of the cluster (default "talos-default")
  -n, --nodes strings        target the specified nodes
      --provisioner string   Talos cluster provisioner to use (default "docker")
      --state string         directory path to store cluster state (default "/home/user/.talos/clusters")
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl cluster destroy

Destroys a local docker-based or firecracker-based kubernetes cluster

talosctl cluster destroy [flags]

Options

  -h, --help   help for destroy

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
      --name string          the name of the cluster (default "talos-default")
  -n, --nodes strings        target the specified nodes
      --provisioner string   Talos cluster provisioner to use (default "docker")
      --state string         directory path to store cluster state (default "/home/user/.talos/clusters")
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl cluster show

Shows info about a local provisioned kubernetes cluster

talosctl cluster show [flags]

Options

  -h, --help   help for show

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
      --name string          the name of the cluster (default "talos-default")
  -n, --nodes strings        target the specified nodes
      --provisioner string   Talos cluster provisioner to use (default "docker")
      --state string         directory path to store cluster state (default "/home/user/.talos/clusters")
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl cluster

A collection of commands for managing local docker-based or QEMU-based clusters

Options

  -h, --help                 help for cluster
      --name string          the name of the cluster (default "talos-default")
      --provisioner string   Talos cluster provisioner to use (default "docker")
      --state string         directory path to store cluster state (default "/home/user/.talos/clusters")

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl completion

Output shell completion code for the specified shell (bash, fish or zsh)

Synopsis

Output shell completion code for the specified shell (bash, fish or zsh). The shell code must be evaluated to provide interactive completion of talosctl commands. This can be done by sourcing it from the .bash_profile.

Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2

talosctl completion SHELL [flags]

Examples

# Installing bash completion on macOS using homebrew
## If running Bash 3.2 included with macOS
	brew install bash-completion
## or, if running Bash 4.1+
	brew install bash-completion@2
## If talosctl is installed via homebrew, this should start working immediately.
## If you've installed via other means, you may need add the completion to your completion directory
	talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl

# Installing bash completion on Linux
## If bash-completion is not installed on Linux, please install the 'bash-completion' package
## via your distribution's package manager.
## Load the talosctl completion code for bash into the current shell
	source <(talosctl completion bash)
## Write bash completion code to a file and source if from .bash_profile
	talosctl completion bash > ~/.talos/completion.bash.inc
	printf "
		# talosctl shell completion
		source '$HOME/.talos/completion.bash.inc'
		" >> $HOME/.bash_profile
	source $HOME/.bash_profile
# Load the talosctl completion code for fish[1] into the current shell
	talosctl completion fish | source
# Set the talosctl completion code for fish[1] to autoload on startup
    talosctl completion fish > ~/.config/fish/completions/talosctl.fish
# Load the talosctl completion code for zsh[1] into the current shell
	source <(talosctl completion zsh)
# Set the talosctl completion code for zsh[1] to autoload on startup
    talosctl completion zsh > "${fpath[1]}/_talosctl"

Options

  -h, --help   help for completion

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config add

Add a new context

talosctl config add <context> [flags]

Options

      --ca string    the path to the CA certificate
      --crt string   the path to the certificate
  -h, --help         help for add
      --key string   the path to the key

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config context

Set the current context

talosctl config context <context> [flags]

Options

  -h, --help   help for context

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config contexts

List defined contexts

talosctl config contexts [flags]

Options

  -h, --help   help for contexts

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config endpoint

Set the endpoint(s) for the current context

talosctl config endpoint <endpoint>... [flags]

Options

  -h, --help   help for endpoint

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config info

Show information about the current context

talosctl config info [flags]

Options

  -h, --help   help for info

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config merge

Merge additional contexts from another client configuration file

Synopsis

Contexts with the same name are renamed while merging configs.

talosctl config merge <from> [flags]

Options

  -h, --help   help for merge

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config new

Generate a new client configuration file

talosctl config new [<path>] [flags]

Options

      --crt-ttl duration   certificate TTL (default 87600h0m0s)
  -h, --help               help for new
      --roles strings      roles (default [os:admin])

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config node

Set the node(s) for the current context

talosctl config node <endpoint>... [flags]

Options

  -h, --help   help for node

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl config

Manage the client configuration file (talosconfig)

Options

  -h, --help   help for config

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl conformance kubernetes

Run Kubernetes conformance tests

talosctl conformance kubernetes [flags]

Options

  -h, --help          help for kubernetes
      --mode string   conformance test mode: [fast, certified] (default "fast")

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl conformance

Run conformance tests

Options

  -h, --help   help for conformance

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl containers

List containers

talosctl containers [flags]

Options

  -h, --help         help for containers
  -k, --kubernetes   use the k8s.io containerd namespace

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl copy

Copy data out from the node

Synopsis

Creates an .tar.gz archive at the node starting at and streams it back to the client.

If ‘-’ is given for , archive is written to stdout. Otherwise archive is extracted to which should be an empty directory or talosctl creates a directory if doesn’t exist. Command doesn’t preserve ownership and access mode for the files in extract mode, while streamed .tar archive captures ownership and permission bits.

talosctl copy <src-path> -|<local-path> [flags]

Options

  -h, --help   help for copy

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl dashboard

Cluster dashboard with real-time metrics

Synopsis

Provide quick UI to navigate through node real-time metrics.

Keyboard shortcuts:

h, : switch one node to the left
l, : switch one node to the right
j, : scroll process list down
k, : scroll process list up
: scroll process list half page down
: scroll process list half page up
: scroll process list one page down
: scroll process list one page up

talosctl dashboard [flags]

Options

  -h, --help                       help for dashboard
  -d, --update-interval duration   interval between updates (default 3s)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl disks

Get the list of disks from /sys/block on the machine

talosctl disks [flags]

Options

  -h, --help       help for disks
  -i, --insecure   get disks using the insecure (encrypted with no auth) maintenance service

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl dmesg

Retrieve kernel logs

talosctl dmesg [flags]

Options

  -f, --follow   specify if the kernel log should be streamed
  -h, --help     help for dmesg
      --tail     specify if only new messages should be sent (makes sense only when combined with --follow)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl edit

Edit a resource from the default editor.

Synopsis

The edit command allows you to directly edit any API resource you can retrieve via the command line tools.

It will open the editor defined by your TALOS_EDITOR, or EDITOR environment variables, or fall back to ‘vi’ for Linux or ’notepad’ for Windows.

talosctl edit <type> [<id>] [flags]

Options

      --dry-run                                     do not apply the change after editing and print the change summary instead
  -h, --help                                        help for edit
  -m, --mode auto, no-reboot, reboot, staged, try   apply config mode (default auto)
      --namespace string                            resource namespace (default is to use default namespace per resource)
      --timeout duration                            the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd forfeit-leadership

Tell node to forfeit etcd cluster leadership

talosctl etcd forfeit-leadership [flags]

Options

  -h, --help   help for forfeit-leadership

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd leave

Tell nodes to leave etcd cluster

talosctl etcd leave [flags]

Options

  -h, --help   help for leave

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd members

Get the list of etcd cluster members

talosctl etcd members [flags]

Options

  -h, --help   help for members

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd remove-member

Remove the node from etcd cluster

Synopsis

Use this command only if you want to remove a member which is in broken state. If there is no access to the node, or the node can’t access etcd to call etcd leave. Always prefer etcd leave over this command.

talosctl etcd remove-member <hostname> [flags]

Options

  -h, --help   help for remove-member

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd snapshot

Stream snapshot of the etcd node to the path.

talosctl etcd snapshot <path> [flags]

Options

  -h, --help   help for snapshot

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl etcd

Manage etcd

Options

  -h, --help   help for etcd

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl events

Stream runtime events

talosctl events [flags]

Options

      --actor-id string     filter events by the specified actor ID (default is no filter)
      --duration duration   show events for the past duration interval (one second resolution, default is to show no history)
  -h, --help                help for events
      --since string        show events after the specified event ID (default is to show no history)
      --tail int32          show specified number of past events (use -1 to show full history, default is to show no history)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen ca

Generates a self-signed X.509 certificate authority

talosctl gen ca [flags]

Options

  -h, --help                  help for ca
      --hours int             the hours from now on which the certificate validity period ends (default 87600)
      --organization string   X.509 distinguished name for the Organization
      --rsa                   generate in RSA format

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen config

Generates a set of configuration files for Talos cluster

Synopsis

The cluster endpoint is the URL for the Kubernetes API. If you decide to use a control plane node, common in a single node control plane setup, use port 6443 as this is the port that the API server binds to on every control plane node. For an HA setup, usually involving a load balancer, use the IP and port of the load balancer.

talosctl gen config <cluster name> <cluster endpoint> [flags]

Options

      --additional-sans strings                  additional Subject-Alt-Names for the APIServer certificate
      --config-patch stringArray                 patch generated machineconfigs (applied to all node types), use @file to read a patch from file
      --config-patch-control-plane stringArray   patch generated machineconfigs (applied to 'init' and 'controlplane' types)
      --config-patch-worker stringArray          patch generated machineconfigs (applied to 'worker' type)
      --dns-domain string                        the dns domain to use for cluster (default "cluster.local")
  -h, --help                                     help for config
      --install-disk string                      the disk to install to (default "/dev/sda")
      --install-image string                     the image used to perform an installation (default "ghcr.io/siderolabs/installer:latest")
      --kubernetes-version string                desired kubernetes version to run (default "1.25.0")
  -o, --output-dir string                        destination to output generated files
  -p, --persist                                  the desired persist value for configs (default true)
      --registry-mirror strings                  list of registry mirrors to use in format: <registry host>=<mirror URL>
      --talos-version string                     the desired Talos version to generate config for (backwards compatibility, e.g. v0.8)
      --version string                           the desired machine config version to generate (default "v1alpha1")
      --with-cluster-discovery                   enable cluster discovery feature (default true)
      --with-docs                                renders all machine configs adding the documentation for each field (default true)
      --with-examples                            renders all machine configs with the commented examples (default true)
      --with-kubespan                            enable KubeSpan feature
      --with-secrets string                      use a secrets file generated using 'gen secrets'

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen crt

Generates an X.509 Ed25519 certificate

talosctl gen crt [flags]

Options

      --ca string     path to the PEM encoded CERTIFICATE
      --csr string    path to the PEM encoded CERTIFICATE REQUEST
  -h, --help          help for crt
      --hours int     the hours from now on which the certificate validity period ends (default 24)
      --name string   the basename of the generated file

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen csr

Generates a CSR using an Ed25519 private key

talosctl gen csr [flags]

Options

  -h, --help            help for csr
      --ip string       generate the certificate for this IP address
      --key string      path to the PEM encoded EC or RSA PRIVATE KEY
      --roles strings   roles (default [os:admin])

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen key

Generates an Ed25519 private key

talosctl gen key [flags]

Options

  -h, --help          help for key
      --name string   the basename of the generated file

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen keypair

Generates an X.509 Ed25519 key pair

talosctl gen keypair [flags]

Options

  -h, --help                  help for keypair
      --ip string             generate the certificate for this IP address
      --organization string   X.509 distinguished name for the Organization

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen secrets

Generates a secrets bundle file which can later be used to generate a config

talosctl gen secrets [flags]

Options

  -p, --from-kubernetes-pki string          use a Kubernetes PKI directory (e.g. /etc/kubernetes/pki) as input
  -h, --help                                help for secrets
  -t, --kubernetes-bootstrap-token string   use the provided bootstrap token as input
  -o, --output-file string                  path of the output file (default "secrets.yaml")
      --talos-version string                the desired Talos version to generate secrets bundle for (backwards compatibility, e.g. v0.8)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl gen

Generate CAs, certificates, and private keys

Options

  -h, --help   help for gen

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl get

Get a specific resource or list of resources.

Synopsis

Similar to ‘kubectl get’, ’talosctl get’ returns a set of resources from the OS. To get a list of all available resource definitions, issue ’talosctl get rd’

talosctl get <type> [<id>] [flags]

Options

  -h, --help               help for get
  -i, --insecure           get resources using the insecure (encrypted with no auth) maintenance service
      --namespace string   resource namespace (default is to use default namespace per resource)
  -o, --output string      output mode (json, table, yaml) (default "table")
  -w, --watch              watch resource changes

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl health

Check cluster health

talosctl health [flags]

Options

      --control-plane-nodes strings   specify IPs of control plane nodes
  -h, --help                          help for health
      --init-node string              specify IPs of init node
      --k8s-endpoint string           use endpoint instead of kubeconfig default
      --run-e2e                       run Kubernetes e2e test
      --server                        run server-side check (default true)
      --wait-timeout duration         timeout to wait for the cluster to be ready (default 20m0s)
      --worker-nodes strings          specify IPs of worker nodes

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl images

List the default images used by Talos

talosctl images [flags]

Options

  -h, --help   help for images

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl inject serviceaccount

Inject Talos API ServiceAccount into Kubernetes manifests

talosctl inject serviceaccount [--roles='<ROLE_1>,<ROLE_2>'] -f <manifest.yaml> [flags]

Examples

talosctl inject serviceaccount --roles="os:admin" -f deployment.yaml > deployment-injected.yaml

Alternatively, stdin can be piped to the command:
cat deployment.yaml | talosctl inject serviceaccount --roles="os:admin" -f - > deployment-injected.yaml

Options

  -f, --file string     file with Kubernetes manifests to be injected with ServiceAccount
  -h, --help            help for serviceaccount
  -r, --roles strings   roles to add to the generated ServiceAccount manifests (default [os:reader])

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl inject

Inject Talos API resources into Kubernetes manifests

Options

  -h, --help   help for inject

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl inspect dependencies

Inspect controller-resource dependencies as graphviz graph.

Synopsis

Inspect controller-resource dependencies as graphviz graph.

Pipe the output of the command through the “dot” program (part of graphviz package) to render the graph:

talosctl inspect dependencies | dot -Tpng > graph.png

talosctl inspect dependencies [flags]

Options

  -h, --help             help for dependencies
      --with-resources   display live resource information with dependencies

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl inspect

Inspect internals of Talos

Options

  -h, --help   help for inspect

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl kubeconfig

Download the admin kubeconfig from the node

Synopsis

Download the admin kubeconfig from the node. If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. Otherwise kubeconfig will be written to PWD or [local-path] if specified.

talosctl kubeconfig [local-path] [flags]

Options

  -f, --force                       Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge
      --force-context-name string   Force context name for kubeconfig merge
  -h, --help                        help for kubeconfig
  -m, --merge                       Merge with existing kubeconfig (default true)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl list

Retrieve a directory listing

talosctl list [path] [flags]

Options

  -d, --depth int32    maximum recursion depth (default 1)
  -h, --help           help for list
  -H, --humanize       humanize size and time in the output
  -l, --long           display additional file details
  -r, --recurse        recurse into subdirectories
  -t, --type strings   filter by specified types:
                       f	regular file
                       d	directory
                       l, L	symbolic link

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl logs

Retrieve logs for a service

talosctl logs <service name> [flags]

Options

  -f, --follow       specify if the logs should be streamed
  -h, --help         help for logs
  -k, --kubernetes   use the k8s.io containerd namespace
      --tail int32   lines of log file to display (default is to show from the beginning) (default -1)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl memory

Show memory usage

talosctl memory [flags]

Options

  -h, --help      help for memory
  -v, --verbose   display extended memory statistics

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl mounts

List mounts

talosctl mounts [flags]

Options

  -h, --help   help for mounts

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl patch

Update field(s) of a resource using a JSON patch.

talosctl patch <type> [<id>] [flags]

Options

      --dry-run                                     print the change summary and patch preview without applying the changes
  -h, --help                                        help for patch
  -m, --mode auto, no-reboot, reboot, staged, try   apply config mode (default auto)
      --namespace string                            resource namespace (default is to use default namespace per resource)
  -p, --patch stringArray                           the patch to be applied to the resource file, use @file to read a patch from file.
      --patch-file string                           a file containing a patch to be applied to the resource.
      --timeout duration                            the config will be rolled back after specified timeout (if try mode is selected) (default 1m0s)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl pcap

Capture the network packets from the node.

Synopsis

The command launches packet capture on the node and streams back the packets as raw pcap file.

Default behavior is to decode the packets with internal decoder to stdout:

talosctl pcap -i eth0

Raw pcap file can be saved with –output flag:

talosctl pcap -i eth0 –output eth0.pcap

Output can be piped to tcpdump:

talosctl pcap -i eth0 -o - | tcpdump -vvv -r -

BPF filter can be applied, but it has to compiled to BPF instructions first using tcpdump. Correct link type should be specified for the tcpdump: EN10MB for Ethernet links and RAW for e.g. Wireguard tunnels:

talosctl pcap -i eth0 –bpf-filter “$(tcpdump -dd -y EN10MB ’tcp and dst port 80’)”

talosctl pcap -i kubespan –bpf-filter “$(tcpdump -dd -y RAW ‘port 50000’)”

As packet capture is transmitted over the network, it is recommended to filter out the Talos API traffic, e.g. by excluding packets with the port 50000.

talosctl pcap [flags]

Options

      --bpf-filter string   bpf filter to apply, tcpdump -dd format
      --duration duration   duration of the capture
  -h, --help                help for pcap
  -i, --interface string    interface name to capture packets on (default "eth0")
  -o, --output string       if not set, decode packets to stdout; if set write raw pcap data to a file, use '-' for stdout
      --promiscuous         put interface into promiscuous mode
  -s, --snaplen int         maximum packet size to capture (default 65536)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl processes

List running processes

talosctl processes [flags]

Options

  -h, --help          help for processes
  -s, --sort string   Column to sort output by. [rss|cpu] (default "rss")
  -w, --watch         Stream running processes

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl read

Read a file on the machine

talosctl read <path> [flags]

Options

  -h, --help   help for read

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl reboot

Reboot a node

talosctl reboot [flags]

Options

      --debug         debug operation from kernel logs. --no-wait is set to false when this flag is set
  -h, --help          help for reboot
  -m, --mode string   select the reboot mode: "default", "powercycle" (skips kexec) (default "default")
      --wait          wait for the operation to complete, tracking its progress. always set to true when --debug is set

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl reset

Reset a node

talosctl reset [flags]

Options

      --debug                           debug operation from kernel logs. --no-wait is set to false when this flag is set
      --graceful                        if true, attempt to cordon/drain node and leave etcd (if applicable) (default true)
  -h, --help                            help for reset
      --reboot                          if true, reboot the node after resetting instead of shutting down
      --system-labels-to-wipe strings   if set, just wipe selected system disk partitions by label but keep other partitions intact
      --wait                            wait for the operation to complete, tracking its progress. always set to true when --debug is set

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl restart

Restart a process

talosctl restart <id> [flags]

Options

  -h, --help         help for restart
  -k, --kubernetes   use the k8s.io containerd namespace

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl rollback

Rollback a node to the previous installation

talosctl rollback [flags]

Options

  -h, --help   help for rollback

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl service

Retrieve the state of a service (or all services), control service state

Synopsis

Service control command. If run without arguments, lists all the services and their state. If service ID is specified, default action ‘status’ is executed which shows status of a single list service. With actions ‘start’, ‘stop’, ‘restart’, service state is updated respectively.

talosctl service [<id> [start|stop|restart|status]] [flags]

Options

  -h, --help   help for service

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl shutdown

Shutdown a node

talosctl shutdown [flags]

Options

      --debug   debug operation from kernel logs. --no-wait is set to false when this flag is set
      --force   if true, force a node to shutdown without a cordon/drain
  -h, --help    help for shutdown
      --wait    wait for the operation to complete, tracking its progress. always set to true when --debug is set

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl stats

Get container stats

talosctl stats [flags]

Options

  -h, --help         help for stats
  -k, --kubernetes   use the k8s.io containerd namespace

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl support

Dump debug information about the cluster

Synopsis

Generated bundle contains the following debug information:

For each node:
- Kernel logs.
- All Talos internal services logs.
- All kube-system pods logs.
- Talos COSI resources without secrets.
- COSI runtime state graph.
- Processes snapshot.
- IO pressure snapshot.
- Mounts list.
- PCI devices info.
- Talos version.
For the cluster:
- Kubernetes nodes and kube-system pods manifests.

talosctl support [flags]

Options

  -h, --help              help for support
  -w, --num-workers int   number of workers per node (default 1)
  -O, --output string     output file to write support archive to
  -v, --verbose           verbose output

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl time

Gets current server time

talosctl time [--check server] [flags]

Options

  -c, --check string   checks server time against specified ntp server
  -h, --help           help for time

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl upgrade

Upgrade Talos on the target node

talosctl upgrade [flags]

Options

      --debug          debug operation from kernel logs. --no-wait is set to false when this flag is set
  -f, --force          force the upgrade (skip checks on etcd health and members, might lead to data loss)
  -h, --help           help for upgrade
  -i, --image string   the container image to use for performing the install
  -p, --preserve       preserve data
  -s, --stage          stage the upgrade to perform it after a reboot
      --wait           wait for the operation to complete, tracking its progress. always set to true when --debug is set

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl upgrade-k8s

Upgrade Kubernetes control plane in the Talos cluster.

Synopsis

Command runs upgrade of Kubernetes control plane components between specified versions.

talosctl upgrade-k8s [flags]

Options

      --dry-run           skip the actual upgrade and show the upgrade plan instead
      --endpoint string   the cluster control plane endpoint
      --from string       the Kubernetes control plane version to upgrade from
  -h, --help              help for upgrade-k8s
      --to string         the Kubernetes control plane version to upgrade to (default "1.25.0")
      --upgrade-kubelet   upgrade kubelet service (default true)

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl usage

Retrieve a disk usage

talosctl usage [path1] [path2] ... [pathN] [flags]

Options

  -a, --all             write counts for all files, not just directories
  -d, --depth int32     maximum recursion depth
  -h, --help            help for usage
  -H, --humanize        humanize size and time in the output
  -t, --threshold int   threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl validate

Validate config

talosctl validate [flags]

Options

  -c, --config string   the path of the config file
  -h, --help            help for validate
  -m, --mode string     the mode to validate the config for (valid values are metal, cloud, and container)
      --strict          treat validation warnings as errors

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl version

Prints the version

talosctl version [flags]

Options

      --client     Print client version only
  -h, --help       help for version
  -i, --insecure   use Talos maintenance mode API
      --short      Print the short version

Options inherited from parent commands

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

talosctl

A CLI for out-of-band management of Kubernetes nodes created by Talos

Options

      --cluster string       Cluster to connect to if a proxy endpoint is used.
      --context string       Context to be used in command
  -e, --endpoints strings    override default endpoints in Talos configuration
  -h, --help                 help for talosctl
  -n, --nodes strings        target the specified nodes
      --talosconfig string   The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config' and '/var/run/secrets/talos.dev/config' in order.

3 - Configuration

Package v1alpha1 configuration file contains all the options available for configuring a machine.

To generate a set of basic configuration files, run:

talosctl gen config --version v1alpha1 <cluster name> <cluster endpoint>

This will generate a machine config for each node type, and a talosconfig for the CLI.

Config

Config defines the v1alpha1 configuration file.

version: v1alpha1
persist: true
machine: # ...
cluster: # ...

Field	Type	Description	Value(s)
`version`	string	Indicates the schema used to decode the contents.	`v1alpha1`
`debug`	bool	Enable verbose logging to the console. All system containers logs will flow into serial console. Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.	`true` `yes` `false` `no`
`persist`	bool	Indicates whether to pull the machine config upon every boot.	`true` `yes` `false` `no`
`machine`	MachineConfig	Provides machine specific configuration options.
`cluster`	ClusterConfig	Provides cluster specific configuration options.

MachineConfig

MachineConfig represents the machine-specific config values.

Appears in:

Config.machine

type: controlplane
# InstallConfig represents the installation options for preparing a node.
install:
    disk: /dev/sda # The disk used for installations.
    # Allows for supplying extra kernel args via the bootloader.
    extraKernelArgs:
        - console=ttyS1
        - panic=10
    image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
    bootloader: true # Indicates if a bootloader should be installed.
    wipe: false # Indicates if the installation disk should be wiped at installation time.

    # # Look up disk using disk attributes like model, size, serial and others.
    # diskSelector:
    #     size: 4GB # Disk size.
    #     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
    #     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

    # # Allows for supplying additional system extension images to install on top of base Talos image.
    # extensions:
    #     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

Field	Type	Description	Value(s)
`type`	string	Defines the role of the machine within the cluster. Control Plane Control Plane node type designates the node as a control plane member. This means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler. Worker Worker node type designates the node as a worker node. This means it will be an available compute node for scheduling workloads. This node type was previously known as “join”; that value is still supported but deprecated.	`controlplane` `worker`
`token`	string	The `token` is used by a machine to join the PKI of the cluster. Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity. Show example(s) `token: 328hom.uqjzh6jnn2eie9oi`
`ca`	PEMEncodedCertificateAndKey	The root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) `ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`certSANs`	[]string	Extra certificate subject alternative names for the machine’s certificate. By default, all non-loopback interface IPs are automatically added to the certificate’s SANs. Show example(s) `certSANs: - 10.0.0.10 - 172.16.0.10 - 192.168.0.10`
`controlPlane`	MachineControlPlaneConfig	Provides machine specific control plane configuration options. Show example(s) `controlPlane: # Controller manager machine specific configuration options. controllerManager: disabled: false # Disable kube-controller-manager on the node. # Scheduler machine specific configuration options. scheduler: disabled: true # Disable kube-scheduler on the node.`
`kubelet`	KubeletConfig	Used to provide additional options to the kubelet. Show example(s) kubelet: image: ghcr.io/siderolabs/kubelet:v1.25.0 # The `image` field is an optional reference to an alternative kubelet image. # The `extraArgs` field is used to provide additional flags to the kubelet. extraArgs: feature-gates: ServerSideApply=true # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. # clusterDNS: # - 10.96.0.10 # - 169.254.2.53 # # The `extraMounts` field is used to add additional mounts to the kubelet container. # extraMounts: # - destination: /var/lib/example # type: bind # source: /var/lib/example # options: # - bind # - rshared # - rw # # The `extraConfig` field is used to provide kubelet configuration overrides. # extraConfig: # serverTLSBootstrap: true # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. # nodeIP: # # The `validSubnets` field configures the networks to pick kubelet node IP from. # validSubnets: # - 10.0.0.0/8 # - '!10.0.0.3/32' # - fdc7::/16
`pods`	[]Unstructured	Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver. Static pods can be used to run components which should be started before the Kubernetes control plane is up. Talos doesn’t validate the pod definition. Updates to this field can be applied without a reboot. See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/. Show example(s) `pods: - apiVersion: v1 kind: pod metadata: name: nginx spec: containers: - image: nginx name: nginx`
`network`	NetworkConfig	Provides machine specific network configuration options. Show example(s) network: hostname: worker-1 # Used to statically set the hostname for the machine. # `interfaces` is used to define the network interface configuration. interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Picks a network device using the selector. # # select a device with bus prefix 00:. # deviceSelector: # busPath: 00: # PCI, USB bus prefix, supports matching by wildcard. # # select a device with mac address matching `:f0:ab` and `virtio` kernel driver. # deviceSelector: # hardwareAddr: ':f0:ab' # Device hardware address, supports matching by wildcard. # driver: virtio # Kernel driver, supports matching by wildcard. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Bridge specific options. # bridge: # # The interfaces that make up the bridge. # interfaces: # - eth0 # - eth1 # # A bridge option. # stp: # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # # layer2 vip example # vip: # ip: 172.16.199.55 # Specifies the IP address to be used. # Used to statically set the nameservers for the machine. nameservers: - 9.8.7.6 - 8.7.6.5 # # Allows for extra entries to be added to the `/etc/hosts` file # extraHostEntries: # - ip: 192.168.1.100 # The IP of the host. # # The host alias. # aliases: # - example # - example.domain.tld # # Configures KubeSpan feature. # kubespan: # enabled: true # Enable the KubeSpan feature.
`disks`	[]MachineDisk	Used to partition, format and mount additional disks. Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. Note that the partitioning and formating is done only once, if and only if no existing partitions are found. If `size:` is omitted, the partition is sized to occupy the full disk. Show example(s) disks: - device: /dev/sdb # The name of the disk to use. # A list of partitions to create on the disk. partitions: - mountpoint: /var/mnt/extra # Where to mount the partition. # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. # # Human readable representation. # size: 100 MB # # Precise value in bytes. # size: 1073741824
`install`	InstallConfig	Used to provide instructions for installations. Show example(s) install: disk: /dev/sda # The disk used for installations. # Allows for supplying extra kernel args via the bootloader. extraKernelArgs: - console=ttyS1 - panic=10 image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. bootloader: true # Indicates if a bootloader should be installed. wipe: false # Indicates if the installation disk should be wiped at installation time. # # Look up disk using disk attributes like model, size, serial and others. # diskSelector: # size: 4GB # Disk size. # model: WDC* # Disk model `/sys/block/<dev>/device/model`. # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. # # Allows for supplying additional system extension images to install on top of base Talos image. # extensions: # - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.
`files`	[]MachineFile	Allows the addition of user specified files. The value of `op` can be `create`, `overwrite`, or `append`. In the case of `create`, `path` must not exist. In the case of `overwrite`, and `append`, `path` must be a valid file. If an `op` value of `append` is used, the existing file will be appended. Note that the file contents are not required to be base64 encoded. Show example(s) `files: - content: '...' # The contents of the file. permissions: 0o666 # The file's permissions in octal. path: /tmp/file.txt # The path of the file. op: append # The operation to use`
`env`	Env	The `env` field allows for the addition of environment variables. All environment variables are set on PID 1 in addition to every service. Show example(s) `env: GRPC_GO_LOG_SEVERITY_LEVEL: info GRPC_GO_LOG_VERBOSITY_LEVEL: "99" https_proxy: http://SERVER:PORT/` `env: GRPC_GO_LOG_SEVERITY_LEVEL: error https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/` `env: https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/`	`GRPC_GO_LOG_VERBOSITY_LEVEL` `GRPC_GO_LOG_SEVERITY_LEVEL` `http_proxy` `https_proxy` `no_proxy`
`time`	TimeConfig	Used to configure the machine’s time settings. Show example(s) `time: disabled: false # Indicates if the time service is disabled for the machine. # Specifies time (NTP) servers to use for setting the system time. servers: - time.cloudflare.com bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.`
`sysctls`	map[string]string	Used to configure the machine’s sysctls. Show example(s) `sysctls: kernel.domainname: talos.dev net.ipv4.ip_forward: "0"`
`sysfs`	map[string]string	Used to configure the machine’s sysfs. Show example(s) `sysfs: devices.system.cpu.cpu0.cpufreq.scaling_governor: performance`
`registries`	RegistriesConfig	Used to configure the machine’s container image registry mirrors. Automatically generates matching CRI configuration for registry mirrors. The `mirrors` section allows to redirect requests for images to non-default registry, which might be local registry or caching mirror. The `config` section provides a way to authenticate to the registry with TLS client identity, provide registry CA, or authentication information. Authentication information has same meaning with the corresponding field in `.docker/config.json`. See also matching configuration for CRI containerd plugin. Show example(s) registries: # Specifies mirror configuration for each registry. mirrors: docker.io: # List of endpoints (URLs) for registry mirrors to use. endpoints: - https://registry.local # Specifies TLS & auth configuration for HTTPS image registries. config: registry.local: # The TLS configuration for the registry. tls: # Enable mutual TLS authentication with the registry. clientIdentity: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # The auth configuration for this registry. auth: username: username # Optional registry authentication. password: password # Optional registry authentication.
`systemDiskEncryption`	SystemDiskEncryptionConfig	Machine system disk encryption configuration. Defines each system partition encryption parameters. Show example(s) systemDiskEncryption: # Ephemeral partition encryption. ephemeral: provider: luks2 # Encryption provider to use for the encryption. # Defines the encryption keys generation and storage method. keys: - # Deterministically generated key from the node UUID and PartitionLabel. nodeID: {} slot: 0 # Key slot number for LUKS2 encryption. # # Cipher kind to use for the encryption. Depends on the encryption provider. # cipher: aes-xts-plain64 # # Defines the encryption sector size. # blockSize: 4096 # # Additional --perf parameters for the LUKS2 encryption. # options: # - no_read_workqueue # - no_write_workqueue
`features`	FeaturesConfig	Features describe individual Talos features that can be switched on or off. Show example(s) `features: rbac: true # Enable role-based access control (RBAC). # # Configure Talos API access from Kubernetes pods. # kubernetesTalosAPIAccess: # enabled: true # Enable Talos API access from Kubernetes pods. # # The list of Talos API roles which can be granted for access from Kubernetes pods. # allowedRoles: # - os:reader # # The list of Kubernetes namespaces Talos API access is available from. # allowedKubernetesNamespaces: # - kube-system`
`udev`	UdevConfig	Configures the udev system. Show example(s) `udev: # List of udev rules to apply to the udev system rules: - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"`
`logging`	LoggingConfig	Configures the logging system. Show example(s) `logging: # Logging destination. destinations: - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". format: json_lines # Logs format.`
`kernel`	KernelConfig	Configures the kernel. Show example(s) `kernel: # Kernel modules to load. modules: - name: brtfs # Module name.`
`seccompProfiles`	[]MachineSeccompProfile	Configures the seccomp profiles for the machine. Show example(s) seccompProfiles: - name: audit.json # The `name` field is used to provide the file name of the seccomp profile. # The `value` field is used to provide the seccomp profile. value: defaultAction: SCMP_ACT_LOG

MachineSeccompProfile

MachineSeccompProfile defines seccomp profiles for the machine.

Appears in:

MachineConfig.seccompProfiles

- name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
  # The `value` field is used to provide the seccomp profile.
  value:
    defaultAction: SCMP_ACT_LOG

Field	Type	Description	Value(s)
`name`	string	The `name` field is used to provide the file name of the seccomp profile.
`value`	Unstructured	The `value` field is used to provide the seccomp profile.

ClusterConfig

ClusterConfig represents the cluster-wide config values.

Appears in:

Config.cluster

# ControlPlaneConfig represents the control plane configuration options.
controlPlane:
    endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
    localAPIServerPort: 443 # The port that the API server listens on internally.
clusterName: talos.local
# ClusterNetworkConfig represents kube networking configuration options.
network:
    # The CNI used.
    cni:
        name: flannel # Name of CNI to use.
    dnsDomain: cluster.local # The domain used by Kubernetes DNS.
    # The pod subnet CIDR.
    podSubnets:
        - 10.244.0.0/16
    # The service subnet CIDR.
    serviceSubnets:
        - 10.96.0.0/12

Field	Type	Description	Value(s)
`id`	string	Globally unique identifier for this cluster (base64 encoded random 32 bytes).
`secret`	string	Shared secret of cluster (base64 encoded random 32 bytes). This secret is shared among cluster members but should never be sent over the network.
`controlPlane`	ControlPlaneConfig	Provides control plane specific configuration options. Show example(s) `controlPlane: endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. localAPIServerPort: 443 # The port that the API server listens on internally.`
`clusterName`	string	Configures the cluster’s name.
`network`	ClusterNetworkConfig	Provides cluster specific network configuration options. Show example(s) `network: # The CNI used. cni: name: flannel # Name of CNI to use. dnsDomain: cluster.local # The domain used by Kubernetes DNS. # The pod subnet CIDR. podSubnets: - 10.244.0.0/16 # The service subnet CIDR. serviceSubnets: - 10.96.0.0/12`
`token`	string	The bootstrap token used to join the cluster. Show example(s) `token: wlzjyw.bei2zfylhs2by0wd`
`aescbcEncryptionSecret`	string	The key used for the encryption of secret data at rest. Show example(s) `aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=`
`ca`	PEMEncodedCertificateAndKey	The base64 encoded root certificate authority used by Kubernetes. Show example(s) `ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`aggregatorCA`	PEMEncodedCertificateAndKey	The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. This CA can be self-signed. Show example(s) `aggregatorCA: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`serviceAccount`	PEMEncodedKey	The base64 encoded private key for service account token generation. Show example(s) `serviceAccount: key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`apiServer`	APIServerConfig	API server specific configuration options. Show example(s) apiServer: image: k8s.gcr.io/kube-apiserver:v1.25.0 # The container image used in the API server manifest. # Extra arguments to supply to the API server. extraArgs: feature-gates: ServerSideApply=true http2-max-streams-per-connection: "32" # Extra certificate subject alternative names for the API server's certificate. certSANs: - 1.2.3.4 - 4.5.6.7 # # Configure the API server admission plugins. # admissionControl: # - name: PodSecurity # Name is the name of the admission controller. # # Configuration is an embedded configuration object to be used as the plugin's # configuration: # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 # defaults: # audit: restricted # audit-version: latest # enforce: baseline # enforce-version: latest # warn: restricted # warn-version: latest # exemptions: # namespaces: # - kube-system # runtimeClasses: [] # usernames: [] # kind: PodSecurityConfiguration
`controllerManager`	ControllerManagerConfig	Controller manager server specific configuration options. Show example(s) `controllerManager: image: k8s.gcr.io/kube-controller-manager:v1.25.0 # The container image used in the controller manager manifest. # Extra arguments to supply to the controller manager. extraArgs: feature-gates: ServerSideApply=true`
`proxy`	ProxyConfig	Kube-proxy server-specific configuration options Show example(s) `proxy: image: k8s.gcr.io/kube-proxy:v1.25.0 # The container image used in the kube-proxy manifest. mode: ipvs # proxy mode of kube-proxy. # Extra arguments to supply to kube-proxy. extraArgs: proxy-mode: iptables # # Disable kube-proxy deployment on cluster bootstrap. # disabled: false`
`scheduler`	SchedulerConfig	Scheduler server specific configuration options. Show example(s) `scheduler: image: k8s.gcr.io/kube-scheduler:v1.25.0 # The container image used in the scheduler manifest. # Extra arguments to supply to the scheduler. extraArgs: feature-gates: AllBeta=true`
`discovery`	ClusterDiscoveryConfig	Configures cluster member discovery. Show example(s) `discovery: enabled: true # Enable the cluster membership discovery feature. # Configure registries used for cluster member discovery. registries: # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information kubernetes: {} # Service registry is using an external service to push and pull information about cluster members. service: endpoint: https://discovery.talos.dev/ # External service endpoint.`
`etcd`	EtcdConfig	Etcd specific configuration options. Show example(s) etcd: image: gcr.io/etcd-development/etcd:v3.5.4 # The container image used to create the etcd service. # The `ca` is the root certificate authority of the PKI. ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ== # Extra arguments to supply to etcd. extraArgs: election-timeout: "5000" # # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. # advertisedSubnets: # - 10.0.0.0/8
`coreDNS`	CoreDNS	Core DNS specific configuration options. Show example(s) coreDNS: image: docker.io/coredns/coredns:1.9.3 # The `image` field is an override to the default coredns image.
`externalCloudProvider`	ExternalCloudProviderConfig	External cloud provider configuration. Show example(s) `externalCloudProvider: enabled: true # Enable external cloud provider. # A list of urls that point to additional manifests for an external cloud provider. manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`
`extraManifests`	[]string	A list of urls that point to additional manifests. These will get automatically deployed as part of the bootstrap. Show example(s) `extraManifests: - https://www.example.com/manifest1.yaml - https://www.example.com/manifest2.yaml`
`extraManifestHeaders`	map[string]string	A map of key value pairs that will be added while fetching the extraManifests. Show example(s) `extraManifestHeaders: Token: "1234567" X-ExtraInfo: info`
`inlineManifests`	ClusterInlineManifests	A list of inline Kubernetes manifests. These will get automatically deployed as part of the bootstrap. Show example(s) `inlineManifests: - name: namespace-ci # Name of the manifest. contents: \|- # Manifest contents as a string. apiVersion: v1 kind: Namespace metadata: name: ci`
`adminKubeconfig`	AdminKubeconfigConfig	Settings for admin kubeconfig generation. Certificate lifetime can be configured. Show example(s) `adminKubeconfig: certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).`
`allowSchedulingOnControlPlanes`	bool	Allows running workload on control-plane nodes.	`true` `yes` `false` `no`

ExtraMount

ExtraMount wraps OCI Mount specification.

Appears in:

KubeletConfig.extraMounts

- destination: /var/lib/example
  type: bind
  source: /var/lib/example
  options:
    - bind
    - rshared
    - rw

MachineControlPlaneConfig

MachineControlPlaneConfig machine specific configuration options.

Appears in:

MachineConfig.controlPlane

# Controller manager machine specific configuration options.
controllerManager:
    disabled: false # Disable kube-controller-manager on the node.
# Scheduler machine specific configuration options.
scheduler:
    disabled: true # Disable kube-scheduler on the node.

Field	Type	Description	Value(s)
`controllerManager`	MachineControllerManagerConfig	Controller manager machine specific configuration options.
`scheduler`	MachineSchedulerConfig	Scheduler machine specific configuration options.

MachineControllerManagerConfig

MachineControllerManagerConfig represents the machine specific ControllerManager config values.

Appears in:

MachineControlPlaneConfig.controllerManager

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-controller-manager on the node.

MachineSchedulerConfig

MachineSchedulerConfig represents the machine specific Scheduler config values.

Appears in:

MachineControlPlaneConfig.scheduler

Field	Type	Description	Value(s)
`disabled`	bool	Disable kube-scheduler on the node.

KubeletConfig

KubeletConfig represents the kubelet config values.

Appears in:

MachineConfig.kubelet

image: ghcr.io/siderolabs/kubelet:v1.25.0 # The `image` field is an optional reference to an alternative kubelet image.
# The `extraArgs` field is used to provide additional flags to the kubelet.
extraArgs:
    feature-gates: ServerSideApply=true

# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
#     - 10.96.0.10
#     - 169.254.2.53

# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
#     - destination: /var/lib/example
#       type: bind
#       source: /var/lib/example
#       options:
#         - bind
#         - rshared
#         - rw

# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
#     serverTLSBootstrap: true

# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
#     # The `validSubnets` field configures the networks to pick kubelet node IP from.
#     validSubnets:
#         - 10.0.0.0/8
#         - '!10.0.0.3/32'
#         - fdc7::/16

Field	Type	Description	Value(s)
`image`	string	The `image` field is an optional reference to an alternative kubelet image. Show example(s) `image: ghcr.io/siderolabs/kubelet:v1.25.0`
`clusterDNS`	[]string	The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. Show example(s) `clusterDNS: - 10.96.0.10 - 169.254.2.53`
`extraArgs`	map[string]string	The `extraArgs` field is used to provide additional flags to the kubelet. Show example(s) `extraArgs: key: value`
`extraMounts`	[]ExtraMount	The `extraMounts` field is used to add additional mounts to the kubelet container. Note that either `bind` or `rbind` are required in the `options`. Show example(s) `extraMounts: - destination: /var/lib/example type: bind source: /var/lib/example options: - bind - rshared - rw`
`extraConfig`	Unstructured	The `extraConfig` field is used to provide kubelet configuration overrides. Some fields are not allowed to be overridden: authentication and authorization, cgroups configuration, ports, etc. Show example(s) `extraConfig: serverTLSBootstrap: true`
`defaultRuntimeSeccompProfileEnabled`	bool	Enable container runtime default Seccomp profile.	`true` `yes` `false` `no`
`registerWithFQDN`	bool	The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. This is required in clouds like AWS.	`true` `yes` `false` `no`
`nodeIP`	KubeletNodeIPConfig	The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. This is used when a node has multiple addresses to choose from. Show example(s) nodeIP: # The `validSubnets` field configures the networks to pick kubelet node IP from. validSubnets: - 10.0.0.0/8 - '!10.0.0.3/32' - fdc7::/16
`skipNodeRegistration`	bool	The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver. This runs kubelet as standalone and only runs static pods.	`true` `yes` `false` `no`

KubeletNodeIPConfig

KubeletNodeIPConfig represents the kubelet node IP configuration.

Appears in:

KubeletConfig.nodeIP

# The `validSubnets` field configures the networks to pick kubelet node IP from.
validSubnets:
    - 10.0.0.0/8
    - '!10.0.0.3/32'
    - fdc7::/16

Field	Type	Description	Value(s)
`validSubnets`	[]string	The `validSubnets` field configures the networks to pick kubelet node IP from. For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.

NetworkConfig

NetworkConfig represents the machine’s networking config values.

Appears in:

MachineConfig.network

hostname: worker-1 # Used to statically set the hostname for the machine.
# `interfaces` is used to define the network interface configuration.
interfaces:
    - interface: eth0 # The interface name.
      # Assigns static IP addresses to the interface.
      addresses:
        - 192.168.2.0/24
      # A list of routes associated with the interface.
      routes:
        - network: 0.0.0.0/0 # The route's network (destination).
          gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
          metric: 1024 # The optional metric for the route.
      mtu: 1500 # The interface's MTU.

      # # Picks a network device using the selector.

      # # select a device with bus prefix 00:*.
      # deviceSelector:
      #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
      # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
      # deviceSelector:
      #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
      #     driver: virtio # Kernel driver, supports matching by wildcard.

      # # Bond specific options.
      # bond:
      #     # The interfaces that make up the bond.
      #     interfaces:
      #         - eth0
      #         - eth1
      #     mode: 802.3ad # A bond option.
      #     lacpRate: fast # A bond option.

      # # Bridge specific options.
      # bridge:
      #     # The interfaces that make up the bridge.
      #     interfaces:
      #         - eth0
      #         - eth1
      #     # A bridge option.
      #     stp:
      #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

      # # Indicates if DHCP should be used to configure the interface.
      # dhcp: true

      # # DHCP specific options.
      # dhcpOptions:
      #     routeMetric: 1024 # The priority of all routes received via DHCP.

      # # Wireguard specific configuration.

      # # wireguard server example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     listenPort: 51111 # Specifies a device's listening port.
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24
      # # wireguard peer example
      # wireguard:
      #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
      #     # Specifies a list of peer configurations to apply to a device.
      #     peers:
      #         - publicKey: ABCDEF... # Specifies the public key of this peer.
      #           endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
      #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
      #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      #           allowedIPs:
      #             - 192.168.1.0/24

      # # Virtual (shared) IP address configuration.

      # # layer2 vip example
      # vip:
      #     ip: 172.16.199.55 # Specifies the IP address to be used.
# Used to statically set the nameservers for the machine.
nameservers:
    - 9.8.7.6
    - 8.7.6.5

# # Allows for extra entries to be added to the `/etc/hosts` file
# extraHostEntries:
#     - ip: 192.168.1.100 # The IP of the host.
#       # The host alias.
#       aliases:
#         - example
#         - example.domain.tld

# # Configures KubeSpan feature.
# kubespan:
#     enabled: true # Enable the KubeSpan feature.

Field	Type	Description	Value(s)
`hostname`	string	Used to statically set the hostname for the machine.
`interfaces`	[]Device	`interfaces` is used to define the network interface configuration. By default all network interfaces will attempt a DHCP discovery. This can be further tuned through this configuration parameter. Show example(s) interfaces: - interface: eth0 # The interface name. # Assigns static IP addresses to the interface. addresses: - 192.168.2.0/24 # A list of routes associated with the interface. routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). metric: 1024 # The optional metric for the route. mtu: 1500 # The interface's MTU. # # Picks a network device using the selector. # # select a device with bus prefix 00:. # deviceSelector: # busPath: 00: # PCI, USB bus prefix, supports matching by wildcard. # # select a device with mac address matching `:f0:ab` and `virtio` kernel driver. # deviceSelector: # hardwareAddr: ':f0:ab' # Device hardware address, supports matching by wildcard. # driver: virtio # Kernel driver, supports matching by wildcard. # # Bond specific options. # bond: # # The interfaces that make up the bond. # interfaces: # - eth0 # - eth1 # mode: 802.3ad # A bond option. # lacpRate: fast # A bond option. # # Bridge specific options. # bridge: # # The interfaces that make up the bridge. # interfaces: # - eth0 # - eth1 # # A bridge option. # stp: # enabled: true # Whether Spanning Tree Protocol (STP) is enabled. # # Indicates if DHCP should be used to configure the interface. # dhcp: true # # DHCP specific options. # dhcpOptions: # routeMetric: 1024 # The priority of all routes received via DHCP. # # Wireguard specific configuration. # # wireguard server example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # listenPort: 51111 # Specifies a device's listening port. # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # wireguard peer example # wireguard: # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # # Specifies a list of peer configurations to apply to a device. # peers: # - publicKey: ABCDEF... # Specifies the public key of this peer. # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. # allowedIPs: # - 192.168.1.0/24 # # Virtual (shared) IP address configuration. # # layer2 vip example # vip: # ip: 172.16.199.55 # Specifies the IP address to be used.
`nameservers`	[]string	Used to statically set the nameservers for the machine. Defaults to `1.1.1.1` and `8.8.8.8` Show example(s) `nameservers: - 8.8.8.8 - 1.1.1.1`
`extraHostEntries`	[]ExtraHost	Allows for extra entries to be added to the `/etc/hosts` file Show example(s) `extraHostEntries: - ip: 192.168.1.100 # The IP of the host. # The host alias. aliases: - example - example.domain.tld`
`kubespan`	NetworkKubeSpan	Configures KubeSpan feature. Show example(s) `kubespan: enabled: true # Enable the KubeSpan feature.`
`disableSearchDomain`	bool	Disable generating a default search domain in /etc/resolv.conf based on the machine hostname. Defaults to `false`.	`true` `yes` `false` `no`

InstallConfig

InstallConfig represents the installation options for preparing a node.

Appears in:

MachineConfig.install

disk: /dev/sda # The disk used for installations.
# Allows for supplying extra kernel args via the bootloader.
extraKernelArgs:
    - console=ttyS1
    - panic=10
image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation.
bootloader: true # Indicates if a bootloader should be installed.
wipe: false # Indicates if the installation disk should be wiped at installation time.

# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
#     size: 4GB # Disk size.
#     model: WDC* # Disk model `/sys/block/<dev>/device/model`.
#     busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

# # Allows for supplying additional system extension images to install on top of base Talos image.
# extensions:
#     - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

Field	Type	Description	Value(s)
`disk`	string	The disk used for installations. Show example(s) `disk: /dev/sda` `disk: /dev/nvme0`
`diskSelector`	InstallDiskSelector	Look up disk using disk attributes like model, size, serial and others. Always has priority over `disk`. Show example(s) diskSelector: size: 4GB # Disk size. model: WDC* # Disk model `/sys/block/<dev>/device/model`. busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
`extraKernelArgs`	[]string	Allows for supplying extra kernel args via the bootloader. Show example(s) `extraKernelArgs: - talos.platform=metal - reboot=k`
`image`	string	Allows for supplying the image used to perform the installation. Image reference for each Talos release can be found on GitHub releases page. Show example(s) `image: ghcr.io/siderolabs/installer:latest`
`extensions`	[]InstallExtensionConfig	Allows for supplying additional system extension images to install on top of base Talos image. Show example(s) `extensions: - image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.`
`bootloader`	bool	Indicates if a bootloader should be installed.	`true` `yes` `false` `no`
`wipe`	bool	Indicates if the installation disk should be wiped at installation time. Defaults to `true`.	`true` `yes` `false` `no`
`legacyBIOSSupport`	bool	Indicates if MBR partition should be marked as bootable (active). Should be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.

InstallDiskSelector

InstallDiskSelector represents a disk query parameters for the install disk lookup.

Appears in:

InstallConfig.diskSelector

size: 4GB # Disk size.
model: WDC* # Disk model `/sys/block/<dev>/device/model`.
busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.

Field	Type	Description	Value(s)
`size`	InstallDiskSizeMatcher	Disk size. Show example(s) `size: 4GB` `size: '> 1TB'` `size: <= 2TB`
`name`	string	Disk name `/sys/block/<dev>/device/name`.
`model`	string	Disk model `/sys/block/<dev>/device/model`.
`serial`	string	Disk serial number `/sys/block/<dev>/serial`.
`modalias`	string	Disk modalias `/sys/block/<dev>/device/modalias`.
`uuid`	string	Disk UUID `/sys/block/<dev>/uuid`.
`wwid`	string	Disk WWID `/sys/block/<dev>/wwid`.
`type`	InstallDiskType	Disk Type.	`ssd` `hdd` `nvme` `sd`
`busPath`	string	Disk bus path. Show example(s) `busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0` `busPath: /pci0000:00/*`

InstallExtensionConfig

InstallExtensionConfig represents a configuration for a system extension.

Appears in:

InstallConfig.extensions

- image: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 # System extension image.

Field	Type	Description	Value(s)
`image`	string	System extension image.

TimeConfig

TimeConfig represents the options for configuring time on a machine.

Appears in:

MachineConfig.time

disabled: false # Indicates if the time service is disabled for the machine.
# Specifies time (NTP) servers to use for setting the system time.
servers:
    - time.cloudflare.com
bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.

Field	Type	Description
`disabled`	bool	Indicates if the time service is disabled for the machine. Defaults to `false`.
`servers`	[]string	Specifies time (NTP) servers to use for setting the system time. Defaults to `pool.ntp.org`
`bootTimeout`	Duration	Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. NTP sync will be still running in the background. Defaults to “infinity” (waiting forever for time sync)

RegistriesConfig

RegistriesConfig represents the image pull options.

Appears in:

MachineConfig.registries

# Specifies mirror configuration for each registry.
mirrors:
    docker.io:
        # List of endpoints (URLs) for registry mirrors to use.
        endpoints:
            - https://registry.local
# Specifies TLS & auth configuration for HTTPS image registries.
config:
    registry.local:
        # The TLS configuration for the registry.
        tls:
            # Enable mutual TLS authentication with the registry.
            clientIdentity:
                crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
                key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
        # The auth configuration for this registry.
        auth:
            username: username # Optional registry authentication.
            password: password # Optional registry authentication.

Field Type Description Value(s)

mirrors

map[string]RegistryMirrorConfig

Specifies mirror configuration for each registry.

This setting allows to use local pull-through caching registires,
air-gapped installations, etc.

Registry name is the first segment of image identifier, with ‘docker.io’
being default one.

Show example(s)

mirrors:
    ghcr.io:
        # List of endpoints (URLs) for registry mirrors to use.
        endpoints:
            - https://registry.insecure
            - https://ghcr.io/v2/

config

map[string]RegistryConfig

Specifies TLS & auth configuration for HTTPS image registries.

Mutual TLS can be enabled with ‘clientIdentity’ option.

TLS configuration can be skipped if registry has trusted
server certificate.

Show example(s)

config:
    registry.insecure:
        # The TLS configuration for the registry.
        tls:
            insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

            # # Enable mutual TLS authentication with the registry.
            # clientIdentity:
            #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
            #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

        # # The auth configuration for this registry.
        # auth:
        #     username: username # Optional registry authentication.
        #     password: password # Optional registry authentication.

PodCheckpointer

PodCheckpointer represents the pod-checkpointer config values.

Field	Type	Description	Value(s)
`image`	string	The `image` field is an override to the default pod-checkpointer image.

CoreDNS

CoreDNS represents the CoreDNS config values.

Appears in:

ClusterConfig.coreDNS

image: docker.io/coredns/coredns:1.9.3 # The `image` field is an override to the default coredns image.

Field	Type	Description	Value(s)
`disabled`	bool	Disable coredns deployment on cluster bootstrap.
`image`	string	The `image` field is an override to the default coredns image.

Endpoint

Endpoint represents the endpoint URL parsed out of the machine config.

Appears in:

ControlPlaneConfig.endpoint
LoggingDestination.endpoint

https://1.2.3.4:6443

https://cluster1.internal:6443

udp://127.0.0.1:12345

tcp://1.2.3.4:12345

ControlPlaneConfig

ControlPlaneConfig represents the control plane configuration options.

Appears in:

ClusterConfig.controlPlane

endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
localAPIServerPort: 443 # The port that the API server listens on internally.

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. It is single-valued, and may optionally include a port number. Show example(s) `endpoint: https://1.2.3.4:6443` `endpoint: https://cluster1.internal:6443`
`localAPIServerPort`	int	The port that the API server listens on internally. This may be different than the port portion listed in the endpoint field above. The default is `6443`.

APIServerConfig

APIServerConfig represents the kube apiserver configuration options.

Appears in:

ClusterConfig.apiServer

image: k8s.gcr.io/kube-apiserver:v1.25.0 # The container image used in the API server manifest.
# Extra arguments to supply to the API server.
extraArgs:
    feature-gates: ServerSideApply=true
    http2-max-streams-per-connection: "32"
# Extra certificate subject alternative names for the API server's certificate.
certSANs:
    - 1.2.3.4
    - 4.5.6.7

# # Configure the API server admission plugins.
# admissionControl:
#     - name: PodSecurity # Name is the name of the admission controller.
#       # Configuration is an embedded configuration object to be used as the plugin's
#       configuration:
#         apiVersion: pod-security.admission.config.k8s.io/v1alpha1
#         defaults:
#             audit: restricted
#             audit-version: latest
#             enforce: baseline
#             enforce-version: latest
#             warn: restricted
#             warn-version: latest
#         exemptions:
#             namespaces:
#                 - kube-system
#             runtimeClasses: []
#             usernames: []
#         kind: PodSecurityConfiguration

Field	Type	Description
`image`	string	The container image used in the API server manifest. Show example(s) `image: k8s.gcr.io/kube-apiserver:v1.25.0`
`extraArgs`	map[string]string	Extra arguments to supply to the API server.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the API server static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.
`certSANs`	[]string	Extra certificate subject alternative names for the API server’s certificate.
`disablePodSecurityPolicy`	bool	Disable PodSecurityPolicy in the API server and default manifests.
`admissionControl`	[]AdmissionPluginConfig	Configure the API server admission plugins. Show example(s) `admissionControl: - name: PodSecurity # Name is the name of the admission controller. # Configuration is an embedded configuration object to be used as the plugin's configuration: apiVersion: pod-security.admission.config.k8s.io/v1alpha1 defaults: audit: restricted audit-version: latest enforce: baseline enforce-version: latest warn: restricted warn-version: latest exemptions: namespaces: - kube-system runtimeClasses: [] usernames: [] kind: PodSecurityConfiguration`

AdmissionPluginConfig

AdmissionPluginConfig represents the API server admission plugin configuration.

Appears in:

APIServerConfig.admissionControl

- name: PodSecurity # Name is the name of the admission controller.
  # Configuration is an embedded configuration object to be used as the plugin's
  configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1alpha1
    defaults:
        audit: restricted
        audit-version: latest
        enforce: baseline
        enforce-version: latest
        warn: restricted
        warn-version: latest
    exemptions:
        namespaces:
            - kube-system
        runtimeClasses: []
        usernames: []
    kind: PodSecurityConfiguration

Field	Type	Description	Value(s)
`name`	string	Name is the name of the admission controller. It must match the registered admission plugin name.
`configuration`	Unstructured	Configuration is an embedded configuration object to be used as the plugin’s configuration.

ControllerManagerConfig

ControllerManagerConfig represents the kube controller manager configuration options.

Appears in:

ClusterConfig.controllerManager

image: k8s.gcr.io/kube-controller-manager:v1.25.0 # The container image used in the controller manager manifest.
# Extra arguments to supply to the controller manager.
extraArgs:
    feature-gates: ServerSideApply=true

Field	Type	Description
`image`	string	The container image used in the controller manager manifest. Show example(s) `image: k8s.gcr.io/kube-controller-manager:v1.25.0`
`extraArgs`	map[string]string	Extra arguments to supply to the controller manager.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the controller manager static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.

ProxyConfig

ProxyConfig represents the kube proxy configuration options.

Appears in:

ClusterConfig.proxy

image: k8s.gcr.io/kube-proxy:v1.25.0 # The container image used in the kube-proxy manifest.
mode: ipvs # proxy mode of kube-proxy.
# Extra arguments to supply to kube-proxy.
extraArgs:
    proxy-mode: iptables

# # Disable kube-proxy deployment on cluster bootstrap.
# disabled: false

Field	Type	Description
`disabled`	bool	Disable kube-proxy deployment on cluster bootstrap. Show example(s) `disabled: false`
`image`	string	The container image used in the kube-proxy manifest. Show example(s) `image: k8s.gcr.io/kube-proxy:v1.25.0`
`mode`	string	proxy mode of kube-proxy. The default is ‘iptables’.
`extraArgs`	map[string]string	Extra arguments to supply to kube-proxy.

SchedulerConfig

SchedulerConfig represents the kube scheduler configuration options.

Appears in:

ClusterConfig.scheduler

image: k8s.gcr.io/kube-scheduler:v1.25.0 # The container image used in the scheduler manifest.
# Extra arguments to supply to the scheduler.
extraArgs:
    feature-gates: AllBeta=true

Field	Type	Description
`image`	string	The container image used in the scheduler manifest. Show example(s) `image: k8s.gcr.io/kube-scheduler:v1.25.0`
`extraArgs`	map[string]string	Extra arguments to supply to the scheduler.
`extraVolumes`	[]VolumeMountConfig	Extra volumes to mount to the scheduler static pod.
`env`	Env	The `env` field allows for the addition of environment variables for the control plane component.

EtcdConfig

EtcdConfig represents the etcd configuration options.

Appears in:

ClusterConfig.etcd

image: gcr.io/etcd-development/etcd:v3.5.4 # The container image used to create the etcd service.
# The `ca` is the root certificate authority of the PKI.
ca:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==
# Extra arguments to supply to etcd.
extraArgs:
    election-timeout: "5000"

# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
#     - 10.0.0.0/8

Field	Type	Description
`image`	string	The container image used to create the etcd service. Show example(s) `image: gcr.io/etcd-development/etcd:v3.5.4`
`ca`	PEMEncodedCertificateAndKey	The `ca` is the root certificate authority of the PKI. It is composed of a base64 encoded `crt` and `key`. Show example(s) `ca: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`extraArgs`	map[string]string	Extra arguments to supply to etcd. Note that the following args are not allowed: - `name` - `data-dir` - `initial-cluster-state` - `listen-peer-urls` - `listen-client-urls` - `cert-file` - `key-file` - `trusted-ca-file` - `peer-client-cert-auth` - `peer-cert-file` - `peer-trusted-ca-file` - `peer-key-file`
`advertisedSubnets`	[]string	The `advertisedSubnets` field configures the networks to pick etcd advertised IP from. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node. Show example(s) `advertisedSubnets: - 10.0.0.0/8`
`listenSubnets`	[]string	The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections. If `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to `advertisedSubnets`. If neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses. IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. Negative subnet matches should be specified last to filter out IPs picked by positive matches. If not specified, advertised IP is selected as the first routable address of the node.

ClusterNetworkConfig

ClusterNetworkConfig represents kube networking configuration options.

Appears in:

ClusterConfig.network

# The CNI used.
cni:
    name: flannel # Name of CNI to use.
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
    - 10.244.0.0/16
# The service subnet CIDR.
serviceSubnets:
    - 10.96.0.0/12

Field	Type	Description
`cni`	CNIConfig	The CNI used. Composed of “name” and “urls”. The “name” key supports the following options: “flannel”, “custom”, and “none”. “flannel” uses Talos-managed Flannel CNI, and that’s the default option. “custom” uses custom manifests that should be provided in “urls”. “none” indicates that Talos will not manage any CNI installation. Show example(s) `cni: name: custom # Name of CNI to use. # URLs containing manifests to apply for the CNI. urls: - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml`
`dnsDomain`	string	The domain used by Kubernetes DNS. The default is `cluster.local` Show example(s) `dnsDomain: cluser.local`
`podSubnets`	[]string	The pod subnet CIDR. Show example(s) `podSubnets: - 10.244.0.0/16`
`serviceSubnets`	[]string	The service subnet CIDR. Show example(s) `serviceSubnets: - 10.96.0.0/12`

CNIConfig

CNIConfig represents the CNI configuration options.

Appears in:

ClusterNetworkConfig.cni

name: custom # Name of CNI to use.
# URLs containing manifests to apply for the CNI.
urls:
    - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml

Field	Type	Description	Value(s)
`name`	string	Name of CNI to use.	`flannel` `custom` `none`
`urls`	[]string	URLs containing manifests to apply for the CNI. Should be present for “custom”, must be empty for “flannel” and “none”.

ExternalCloudProviderConfig

ExternalCloudProviderConfig contains external cloud provider configuration.

Appears in:

ClusterConfig.externalCloudProvider

enabled: true # Enable external cloud provider.
# A list of urls that point to additional manifests for an external cloud provider.
manifests:
    - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
    - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml

Field	Type	Description	Value(s)
`enabled`	bool	Enable external cloud provider.	`true` `yes` `false` `no`
`manifests`	[]string	A list of urls that point to additional manifests for an external cloud provider. These will get automatically deployed as part of the bootstrap. Show example(s) `manifests: - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml`

AdminKubeconfigConfig

AdminKubeconfigConfig contains admin kubeconfig settings.

Appears in:

ClusterConfig.adminKubeconfig

certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).

Field	Type	Description	Value(s)
`certLifetime`	Duration	Admin kubeconfig certificate lifetime (default is 1 year). Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).

MachineDisk

MachineDisk represents the options available for partitioning, formatting, and mounting extra disks.

Appears in:

MachineConfig.disks

- device: /dev/sdb # The name of the disk to use.
  # A list of partitions to create on the disk.
  partitions:
    - mountpoint: /var/mnt/extra # Where to mount the partition.

      # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.

      # # Human readable representation.
      # size: 100 MB
      # # Precise value in bytes.
      # size: 1073741824

Field	Type	Description	Value(s)
`device`	string	The name of the disk to use.
`partitions`	[]DiskPartition	A list of partitions to create on the disk.

DiskPartition

DiskPartition represents the options for a disk partition.

Appears in:

MachineDisk.partitions

Field	Type	Description	Value(s)
`size`	DiskSize	The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. Show example(s) `size: 100 MB` `size: 1073741824`
`mountpoint`	string	Where to mount the partition.

EncryptionConfig

EncryptionConfig represents partition encryption settings.

Appears in:

SystemDiskEncryptionConfig.state
SystemDiskEncryptionConfig.ephemeral

Field	Type	Description	Value(s)
`provider`	string	Encryption provider to use for the encryption. Show example(s) `provider: luks2`
`keys`	[]EncryptionKey	Defines the encryption keys generation and storage method.
`cipher`	string	Cipher kind to use for the encryption. Depends on the encryption provider. Show example(s) `cipher: aes-xts-plain64`	`aes-xts-plain64` `xchacha12,aes-adiantum-plain64` `xchacha20,aes-adiantum-plain64`
`keySize`	uint	Defines the encryption key length.
`blockSize`	uint64	Defines the encryption sector size. Show example(s) `blockSize: 4096`
`options`	[]string	Additional –perf parameters for the LUKS2 encryption. Show example(s) `options: - no_read_workqueue - no_write_workqueue`	`no_read_workqueue` `no_write_workqueue` `same_cpu_crypt`

EncryptionKey

EncryptionKey represents configuration for disk encryption key.

Appears in:

EncryptionConfig.keys

Field	Type	Description
`static`	EncryptionKeyStatic	Key which value is stored in the configuration file.
`nodeID`	EncryptionKeyNodeID	Deterministically generated key from the node UUID and PartitionLabel.
`slot`	int	Key slot number for LUKS2 encryption.

EncryptionKeyStatic

EncryptionKeyStatic represents throw away key type.

Appears in:

EncryptionKey.static

Field	Type	Description	Value(s)
`passphrase`	string	Defines the static passphrase value.

EncryptionKeyNodeID

EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel.

Appears in:

EncryptionKey.nodeID

MachineFile

MachineFile represents a file to write to disk.

Appears in:

MachineConfig.files

- content: '...' # The contents of the file.
  permissions: 0o666 # The file's permissions in octal.
  path: /tmp/file.txt # The path of the file.
  op: append # The operation to use

Field	Type	Description	Value(s)
`content`	string	The contents of the file.
`permissions`	FileMode	The file’s permissions in octal.
`path`	string	The path of the file.
`op`	string	The operation to use	`create` `append` `overwrite`

ExtraHost

ExtraHost represents a host entry in /etc/hosts.

Appears in:

NetworkConfig.extraHostEntries

- ip: 192.168.1.100 # The IP of the host.
  # The host alias.
  aliases:
    - example
    - example.domain.tld

Field	Type	Description	Value(s)
`ip`	string	The IP of the host.
`aliases`	[]string	The host alias.

Device

Device represents a network interface.

Appears in:

NetworkConfig.interfaces

- interface: eth0 # The interface name.
  # Assigns static IP addresses to the interface.
  addresses:
    - 192.168.2.0/24
  # A list of routes associated with the interface.
  routes:
    - network: 0.0.0.0/0 # The route's network (destination).
      gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route).
      metric: 1024 # The optional metric for the route.
  mtu: 1500 # The interface's MTU.

  # # Picks a network device using the selector.

  # # select a device with bus prefix 00:*.
  # deviceSelector:
  #     busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.
  # # select a device with mac address matching `*:f0:ab` and `virtio` kernel driver.
  # deviceSelector:
  #     hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
  #     driver: virtio # Kernel driver, supports matching by wildcard.

  # # Bond specific options.
  # bond:
  #     # The interfaces that make up the bond.
  #     interfaces:
  #         - eth0
  #         - eth1
  #     mode: 802.3ad # A bond option.
  #     lacpRate: fast # A bond option.

  # # Bridge specific options.
  # bridge:
  #     # The interfaces that make up the bridge.
  #     interfaces:
  #         - eth0
  #         - eth1
  #     # A bridge option.
  #     stp:
  #         enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

  # # Indicates if DHCP should be used to configure the interface.
  # dhcp: true

  # # DHCP specific options.
  # dhcpOptions:
  #     routeMetric: 1024 # The priority of all routes received via DHCP.

  # # Wireguard specific configuration.

  # # wireguard server example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     listenPort: 51111 # Specifies a device's listening port.
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24
  # # wireguard peer example
  # wireguard:
  #     privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
  #     # Specifies a list of peer configurations to apply to a device.
  #     peers:
  #         - publicKey: ABCDEF... # Specifies the public key of this peer.
  #           endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
  #           persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
  #           # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
  #           allowedIPs:
  #             - 192.168.1.0/24

  # # Virtual (shared) IP address configuration.

  # # layer2 vip example
  # vip:
  #     ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`interface`	string	The interface name. Mutually exclusive with `deviceSelector`. Show example(s) `interface: eth0`
`deviceSelector`	NetworkDeviceSelector	Picks a network device using the selector. Mutually exclusive with `interface`. Supports partial match using wildcard syntax. Show example(s) `deviceSelector: busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.` `deviceSelector: hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard. driver: virtio # Kernel driver, supports matching by wildcard.`
`addresses`	[]string	Assigns static IP addresses to the interface. An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). Show example(s) `addresses: - 10.5.0.0/16 - 192.168.3.7`
`routes`	[]Route	A list of routes associated with the interface. If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. Show example(s) `routes: - network: 0.0.0.0/0 # The route's network (destination). gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - network: 10.2.0.0/16 # The route's network (destination). gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).`
`bond`	Bond	Bond specific options. Show example(s) `bond: # The interfaces that make up the bond. interfaces: - eth0 - eth1 mode: 802.3ad # A bond option. lacpRate: fast # A bond option.`
`bridge`	Bridge	Bridge specific options. Show example(s) `bridge: # The interfaces that make up the bridge. interfaces: - eth0 - eth1 # A bridge option. stp: enabled: true # Whether Spanning Tree Protocol (STP) is enabled.`
`vlans`	[]Vlan	VLAN specific options.
`mtu`	int	The interface’s MTU. If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
`dhcp`	bool	Indicates if DHCP should be used to configure the interface. The following DHCP options are supported: - `OptionClasslessStaticRoute` - `OptionDomainNameServer` - `OptionDNSDomainSearchList` - `OptionHostName` Show example(s) `dhcp: true`
`ignore`	bool	Indicates if the interface should be ignored (skips configuration).
`dummy`	bool	Indicates if the interface is a dummy interface. `dummy` is used to specify that this interface should be a virtual-only, dummy interface.
`dhcpOptions`	DHCPOptions	DHCP specific options. `dhcp` must be set to true for these to take effect. Show example(s) `dhcpOptions: routeMetric: 1024 # The priority of all routes received via DHCP.`
`wireguard`	DeviceWireguardConfig	Wireguard specific configuration. Includes things like private key, listen port, peers. Show example(s) `wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). listenPort: 51111 # Specifies a device's listening port. # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24` wireguard: privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). # Specifies a list of peer configurations to apply to a device. peers: - publicKey: ABCDEF... # Specifies the public key of this peer. endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. allowedIPs: - 192.168.1.0/24
`vip`	DeviceVIPConfig	Virtual (shared) IP address configuration. Show example(s) `vip: ip: 172.16.199.55 # Specifies the IP address to be used.`

DHCPOptions

DHCPOptions contains options for configuring the DHCP settings for a given interface.

Appears in:

Device.dhcpOptions
Vlan.dhcpOptions

routeMetric: 1024 # The priority of all routes received via DHCP.

Field	Type	Description
`routeMetric`	uint32	The priority of all routes received via DHCP.
`ipv4`	bool	Enables DHCPv4 protocol for the interface (default is enabled).
`ipv6`	bool	Enables DHCPv6 protocol for the interface (default is disabled).
`duidv6`	string	Set client DUID (hex string).

DeviceWireguardConfig

DeviceWireguardConfig contains settings for configuring Wireguard network interface.

Appears in:

Device.wireguard

privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
listenPort: 51111 # Specifies a device's listening port.
# Specifies a list of peer configurations to apply to a device.
peers:
    - publicKey: ABCDEF... # Specifies the public key of this peer.
      endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry.
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.1.0/24

privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded).
# Specifies a list of peer configurations to apply to a device.
peers:
    - publicKey: ABCDEF... # Specifies the public key of this peer.
      endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry.
      persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer.
      # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.
      allowedIPs:
        - 192.168.1.0/24

Field	Type	Description
`privateKey`	string	Specifies a private key configuration (base64 encoded). Can be generated by `wg genkey`.
`listenPort`	int	Specifies a device’s listening port.
`firewallMark`	int	Specifies a device’s firewall mark.
`peers`	[]DeviceWireguardPeer	Specifies a list of peer configurations to apply to a device.

DeviceWireguardPeer

DeviceWireguardPeer a WireGuard device peer configuration.

Appears in:

DeviceWireguardConfig.peers

Field	Type	Description
`publicKey`	string	Specifies the public key of this peer. Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.
`endpoint`	string	Specifies the endpoint of this peer entry.
`persistentKeepaliveInterval`	Duration	Specifies the persistent keepalive interval for this peer. Field format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).
`allowedIPs`	[]string	AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.

DeviceVIPConfig

DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface.

Appears in:

Device.vip
Vlan.vip

ip: 172.16.199.55 # Specifies the IP address to be used.

Field	Type	Description
`ip`	string	Specifies the IP address to be used.
`equinixMetal`	VIPEquinixMetalConfig	Specifies the Equinix Metal API settings to assign VIP to the node.
`hcloud`	VIPHCloudConfig	Specifies the Hetzner Cloud API settings to assign VIP to the node.

VIPEquinixMetalConfig

VIPEquinixMetalConfig contains settings for Equinix Metal VIP management.

Appears in:

DeviceVIPConfig.equinixMetal

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Equinix Metal API Token.

VIPHCloudConfig

VIPHCloudConfig contains settings for Hetzner Cloud VIP management.

Appears in:

DeviceVIPConfig.hcloud

Field	Type	Description	Value(s)
`apiToken`	string	Specifies the Hetzner Cloud API Token.

Bond

Bond contains the various options for configuring a bonded interface.

Appears in:

Device.bond

# The interfaces that make up the bond.
interfaces:
    - eth0
    - eth1
mode: 802.3ad # A bond option.
lacpRate: fast # A bond option.

Field	Type	Description
`interfaces`	[]string	The interfaces that make up the bond.
`arpIPTarget`	[]string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`mode`	string	A bond option. Please see the official kernel documentation.
`xmitHashPolicy`	string	A bond option. Please see the official kernel documentation.
`lacpRate`	string	A bond option. Please see the official kernel documentation.
`adActorSystem`	string	A bond option. Please see the official kernel documentation. Not supported at the moment.
`arpValidate`	string	A bond option. Please see the official kernel documentation.
`arpAllTargets`	string	A bond option. Please see the official kernel documentation.
`primary`	string	A bond option. Please see the official kernel documentation.
`primaryReselect`	string	A bond option. Please see the official kernel documentation.
`failOverMac`	string	A bond option. Please see the official kernel documentation.
`adSelect`	string	A bond option. Please see the official kernel documentation.
`miimon`	uint32	A bond option. Please see the official kernel documentation.
`updelay`	uint32	A bond option. Please see the official kernel documentation.
`downdelay`	uint32	A bond option. Please see the official kernel documentation.
`arpInterval`	uint32	A bond option. Please see the official kernel documentation.
`resendIgmp`	uint32	A bond option. Please see the official kernel documentation.
`minLinks`	uint32	A bond option. Please see the official kernel documentation.
`lpInterval`	uint32	A bond option. Please see the official kernel documentation.
`packetsPerSlave`	uint32	A bond option. Please see the official kernel documentation.
`numPeerNotif`	uint8	A bond option. Please see the official kernel documentation.
`tlbDynamicLb`	uint8	A bond option. Please see the official kernel documentation.
`allSlavesActive`	uint8	A bond option. Please see the official kernel documentation.
`useCarrier`	bool	A bond option. Please see the official kernel documentation.
`adActorSysPrio`	uint16	A bond option. Please see the official kernel documentation.
`adUserPortKey`	uint16	A bond option. Please see the official kernel documentation.
`peerNotifyDelay`	uint32	A bond option. Please see the official kernel documentation.

STP

STP contains the various options for configuring the STP properties of a bridge interface.

Appears in:

Bridge.stp

Field	Type	Description	Value(s)
`enabled`	bool	Whether Spanning Tree Protocol (STP) is enabled.

Bridge

Bridge contains the various options for configuring a bridge interface.

Appears in:

Device.bridge

# The interfaces that make up the bridge.
interfaces:
    - eth0
    - eth1
# A bridge option.
stp:
    enabled: true # Whether Spanning Tree Protocol (STP) is enabled.

Field	Type	Description	Value(s)
`interfaces`	[]string	The interfaces that make up the bridge.
`stp`	STP	A bridge option. Please see the official kernel documentation.

Vlan

Vlan represents vlan settings for a device.

Appears in:

Device.vlans

Field	Type	Description
`addresses`	[]string	The addresses in CIDR notation or as plain IPs to use.
`routes`	[]Route	A list of routes associated with the VLAN.
`dhcp`	bool	Indicates if DHCP should be used.
`vlanId`	uint16	The VLAN’s ID.
`mtu`	uint32	The VLAN’s MTU.
`vip`	DeviceVIPConfig	The VLAN’s virtual IP address configuration.
`dhcpOptions`	DHCPOptions	DHCP specific options. `dhcp` must be set to true for these to take effect.

Route

Route represents a network route.

Appears in:

Device.routes
Vlan.routes

- network: 0.0.0.0/0 # The route's network (destination).
  gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route).
- network: 10.2.0.0/16 # The route's network (destination).
  gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route).

Field	Type	Description
`network`	string	The route’s network (destination).
`gateway`	string	The route’s gateway (if empty, creates link scope route).
`source`	string	The route’s source address (optional).
`metric`	uint32	The optional metric for the route.

RegistryMirrorConfig

RegistryMirrorConfig represents mirror configuration for a registry.

Appears in:

RegistriesConfig.mirrors

ghcr.io:
    # List of endpoints (URLs) for registry mirrors to use.
    endpoints:
        - https://registry.insecure
        - https://ghcr.io/v2/

Field	Type	Description	Value(s)
`endpoints`	[]string	List of endpoints (URLs) for registry mirrors to use. Endpoint configures HTTP/HTTPS access mode, host name, port and path (if path is not set, it defaults to `/v2`).

RegistryConfig

RegistryConfig specifies auth & TLS config per registry.

Appears in:

RegistriesConfig.config

registry.insecure:
    # The TLS configuration for the registry.
    tls:
        insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

        # # Enable mutual TLS authentication with the registry.
        # clientIdentity:
        #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
        #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

    # # The auth configuration for this registry.
    # auth:
    #     username: username # Optional registry authentication.
    #     password: password # Optional registry authentication.

Field Type Description Value(s)

tls

RegistryTLSConfig

The TLS configuration for the registry.

Show example(s)

tls:
    # Enable mutual TLS authentication with the registry.
    clientIdentity:
        crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
        key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

tls:
    insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

    # # Enable mutual TLS authentication with the registry.
    # clientIdentity:
    #     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    #     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

auth

RegistryAuthConfig

The auth configuration for this registry.

Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.

Show example(s)

auth:
    username: username # Optional registry authentication.
    password: password # Optional registry authentication.

RegistryAuthConfig

RegistryAuthConfig specifies authentication configuration for a registry.

Appears in:

RegistryConfig.auth

username: username # Optional registry authentication.
password: password # Optional registry authentication.

Field	Type	Description
`username`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`password`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`auth`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.
`identityToken`	string	Optional registry authentication. The meaning of each field is the same with the corresponding field in .docker/config.json.

RegistryTLSConfig

RegistryTLSConfig specifies TLS config for HTTPS registries.

Appears in:

RegistryConfig.tls

# Enable mutual TLS authentication with the registry.
clientIdentity:
    crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
    key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

insecureSkipVerify: true # Skip TLS server certificate verification (not recommended).

# # Enable mutual TLS authentication with the registry.
# clientIdentity:
#     crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t
#     key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==

Field	Type	Description
`clientIdentity`	PEMEncodedCertificateAndKey	Enable mutual TLS authentication with the registry. Client certificate and key should be base64-encoded. Show example(s) `clientIdentity: crt: LS0tIEVYQU1QTEUgQ0VSVElGSUNBVEUgLS0t key: LS0tIEVYQU1QTEUgS0VZIC0tLQ==`
`ca`	Base64Bytes	CA registry certificate to add the list of trusted certificates. Certificate should be base64-encoded.
`insecureSkipVerify`	bool	Skip TLS server certificate verification (not recommended).

SystemDiskEncryptionConfig

SystemDiskEncryptionConfig specifies system disk partitions encryption settings.

Appears in:

MachineConfig.systemDiskEncryption

# Ephemeral partition encryption.
ephemeral:
    provider: luks2 # Encryption provider to use for the encryption.
    # Defines the encryption keys generation and storage method.
    keys:
        - # Deterministically generated key from the node UUID and PartitionLabel.
          nodeID: {}
          slot: 0 # Key slot number for LUKS2 encryption.

    # # Cipher kind to use for the encryption. Depends on the encryption provider.
    # cipher: aes-xts-plain64

    # # Defines the encryption sector size.
    # blockSize: 4096

    # # Additional --perf parameters for the LUKS2 encryption.
    # options:
    #     - no_read_workqueue
    #     - no_write_workqueue

Field	Type	Description	Value(s)
`state`	EncryptionConfig	State partition encryption.
`ephemeral`	EncryptionConfig	Ephemeral partition encryption.

FeaturesConfig

FeaturesConfig describes individual Talos features that can be switched on or off.

Appears in:

MachineConfig.features

rbac: true # Enable role-based access control (RBAC).

# # Configure Talos API access from Kubernetes pods.
# kubernetesTalosAPIAccess:
#     enabled: true # Enable Talos API access from Kubernetes pods.
#     # The list of Talos API roles which can be granted for access from Kubernetes pods.
#     allowedRoles:
#         - os:reader
#     # The list of Kubernetes namespaces Talos API access is available from.
#     allowedKubernetesNamespaces:
#         - kube-system

Field	Type	Description
`rbac`	bool	Enable role-based access control (RBAC).
`stableHostname`	bool	Enable stable default hostname.
`kubernetesTalosAPIAccess`	KubernetesTalosAPIAccessConfig	Configure Talos API access from Kubernetes pods. This feature is disabled if the feature config is not specified. Show example(s) `kubernetesTalosAPIAccess: enabled: true # Enable Talos API access from Kubernetes pods. # The list of Talos API roles which can be granted for access from Kubernetes pods. allowedRoles: - os:reader # The list of Kubernetes namespaces Talos API access is available from. allowedKubernetesNamespaces: - kube-system`

KubernetesTalosAPIAccessConfig

KubernetesTalosAPIAccessConfig describes the configuration for the Talos API access from Kubernetes pods.

Appears in:

FeaturesConfig.kubernetesTalosAPIAccess

enabled: true # Enable Talos API access from Kubernetes pods.
# The list of Talos API roles which can be granted for access from Kubernetes pods.
allowedRoles:
    - os:reader
# The list of Kubernetes namespaces Talos API access is available from.
allowedKubernetesNamespaces:
    - kube-system

Field	Type	Description
`enabled`	bool	Enable Talos API access from Kubernetes pods.
`allowedRoles`	[]string	The list of Talos API roles which can be granted for access from Kubernetes pods. Empty list means that no roles can be granted, so access is blocked.
`allowedKubernetesNamespaces`	[]string	The list of Kubernetes namespaces Talos API access is available from.

VolumeMountConfig

VolumeMountConfig struct describes extra volume mount for the static pods.

Appears in:

APIServerConfig.extraVolumes
ControllerManagerConfig.extraVolumes
SchedulerConfig.extraVolumes

Field	Type	Description
`hostPath`	string	Path on the host. Show example(s) `hostPath: /var/lib/auth`
`mountPath`	string	Path in the container. Show example(s) `mountPath: /etc/kubernetes/auth`
`readonly`	bool	Mount the volume read only. Show example(s) `readonly: true`

ClusterInlineManifest

ClusterInlineManifest struct describes inline bootstrap manifests for the user.

Field	Type	Description	Value(s)
`name`	string	Name of the manifest. Name should be unique. Show example(s) `name: csi`
`contents`	string	Manifest contents as a string. Show example(s) `contents: /etc/kubernetes/auth`

NetworkKubeSpan

NetworkKubeSpan struct describes KubeSpan configuration.

Appears in:

NetworkConfig.kubespan

enabled: true # Enable the KubeSpan feature.

Field	Type	Description
`enabled`	bool	Enable the KubeSpan feature. Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
`advertiseKubernetesNetworks`	bool	Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node. If disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel, and KubeSpan handles the node-to-node traffic. If enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly. When enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which is not always the case with CNIs not relying on Kubernetes for IPAM.
`allowDownPeerBypass`	bool	Skip sending traffic via KubeSpan if the peer connection state is not up. This provides configurable choice between connectivity and security: either traffic is always forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly to the peer if Wireguard connection can’t be established.

NetworkDeviceSelector

NetworkDeviceSelector struct describes network device selector.

Appears in:

Device.deviceSelector

busPath: 00:* # PCI, USB bus prefix, supports matching by wildcard.

hardwareAddr: '*:f0:ab' # Device hardware address, supports matching by wildcard.
driver: virtio # Kernel driver, supports matching by wildcard.

Field	Type	Description
`busPath`	string	PCI, USB bus prefix, supports matching by wildcard.
`hardwareAddr`	string	Device hardware address, supports matching by wildcard.
`pciID`	string	PCI ID (vendor ID, product ID), supports matching by wildcard.
`driver`	string	Kernel driver, supports matching by wildcard.

ClusterDiscoveryConfig

ClusterDiscoveryConfig struct configures cluster membership discovery.

Appears in:

ClusterConfig.discovery

enabled: true # Enable the cluster membership discovery feature.
# Configure registries used for cluster member discovery.
registries:
    # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
    kubernetes: {}
    # Service registry is using an external service to push and pull information about cluster members.
    service:
        endpoint: https://discovery.talos.dev/ # External service endpoint.

Field	Type	Description	Value(s)
`enabled`	bool	Enable the cluster membership discovery feature. Cluster discovery is based on individual registries which are configured under the registries field.
`registries`	DiscoveryRegistriesConfig	Configure registries used for cluster member discovery.

DiscoveryRegistriesConfig

DiscoveryRegistriesConfig struct configures cluster membership discovery.

Appears in:

ClusterDiscoveryConfig.registries

Field	Type	Description	Value(s)
`kubernetes`	RegistryKubernetesConfig	Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information as annotations on the Node resources.
`service`	RegistryServiceConfig	Service registry is using an external service to push and pull information about cluster members.

RegistryKubernetesConfig

RegistryKubernetesConfig struct configures Kubernetes discovery registry.

Appears in:

DiscoveryRegistriesConfig.kubernetes

Field	Type	Description	Value(s)
`disabled`	bool	Disable Kubernetes discovery registry.

RegistryServiceConfig

RegistryServiceConfig struct configures Kubernetes discovery registry.

Appears in:

DiscoveryRegistriesConfig.service

Field	Type	Description	Value(s)
`disabled`	bool	Disable external service discovery registry.
`endpoint`	string	External service endpoint. Show example(s) `endpoint: https://discovery.talos.dev/`

UdevConfig

UdevConfig describes how the udev system should be configured.

Appears in:

MachineConfig.udev

# List of udev rules to apply to the udev system
rules:
    - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"

Field	Type	Description	Value(s)
`rules`	[]string	List of udev rules to apply to the udev system

LoggingConfig

LoggingConfig struct configures Talos logging.

Appears in:

MachineConfig.logging

# Logging destination.
destinations:
    - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
      format: json_lines # Logs format.

Field	Type	Description	Value(s)
`destinations`	[]LoggingDestination	Logging destination.

LoggingDestination

LoggingDestination struct configures Talos logging destination.

Appears in:

LoggingConfig.destinations

Field	Type	Description	Value(s)
`endpoint`	Endpoint	Where to send logs. Supported protocols are “tcp” and “udp”. Show example(s) `endpoint: udp://127.0.0.1:12345` `endpoint: tcp://1.2.3.4:12345`
`format`	string	Logs format.	`json_lines`

KernelConfig

KernelConfig struct configures Talos Linux kernel.

Appears in:

MachineConfig.kernel

# Kernel modules to load.
modules:
    - name: brtfs # Module name.

Field	Type	Description	Value(s)
`modules`	[]KernelModuleConfig	Kernel modules to load.

KernelModuleConfig

KernelModuleConfig struct configures Linux kernel modules to load.

Appears in:

KernelConfig.modules

Field	Type	Description	Value(s)
`name`	string	Module name.

4 - Kernel

Linux kernel reference.

Commandline Parameters

Talos supports a number of kernel commandline parameters. Some are required for it to operate. Others are optional and useful in certain circumstances.

Several of these are enforced by the Kernel Self Protection Project KSPP.

Required parameters:

talos.platform: can be one of aws, azure, container, digitalocean, gcp, metal, equinixMetal, or vmware
init_on_alloc=1: required by KSPP
slab_nomerge: required by KSPP
pti=on: required by KSPP

Recommended parameters:

init_on_free=1: advised by KSPP if minimizing stale data lifetime is important

Available Talos-specific parameters

`ip`

Initial configuration of the interface, routes, DNS, NTP servers.

Full documentation is available in the Linux kernel docs.

ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>

Talos will use the configuration supplied via the kernel parameter as the initial network configuration. This parameter is useful in the environments where DHCP doesn’t provide IP addresses or when default DNS and NTP servers should be overridden before loading machine configuration. Partial configuration can be applied as well, e.g. ip=<:::::::<dns0-ip>:<dns1-ip>:<ntp0-ip> sets only the DNS and NTP servers.

IPv6 addresses can be specified by enclosing them in the square brackets, e.g. ip=[2001:db8::a]:[2001:db8::b]:[fe80::1]::controlplane1:eth1::[2001:4860:4860::6464]:[2001:4860:4860::64]:[2001:4860:4806::].

`bond`

Bond interface configuration.

Full documentation is available in the Dracut kernel docs.

bond=<bondname>:<bondslaves>:<options>:<mtu>

Talos will use the bond= kernel parameter if supplied to set the initial bond configuration. This parameter is useful in environments where the switch ports are suspended if the machine doesn’t setup a LACP bond.

If only the bond name is supplied, the bond will be created with eth0 and eth1 as slaves and bond mode set as balance-rr

All these below configurations are equivalent:

bond=bond0
bond=bond0:
bond=bond0::
bond=bond0:::
bond=bond0:eth0,eth1
bond=bond0:eth0,eth1:balance-rr

An example of a bond configuration with all options specified:

bond=bond1:eth3,eth4:mode=802.3ad,xmit_hash_policy=layer2+3:1450

This will create a bond interface named bond1 with eth3 and eth4 as slaves and set the bond mode to 802.3ad, the transmit hash policy to layer2+3 and bond interface MTU to 1450.

`vlan`

The interface vlan configuration.

Full documentation is available in the Dracut kernel docs.

Talos will use the vlan= kernel parameter if supplied to set the initial vlan configuration. This parameter is useful in environments where the switch ports are VLAN tagged with no native VLAN.

Only one vlan can be configured at this stage.

An example of a vlan configuration including static ip configuration:

vlan=eth0.100:eth0 ip=172.20.0.2::172.20.0.1:255.255.255.0::eth0.100:::::

This will create a vlan interface named eth0.100 with eth0 as the underlying interface and set the vlan id to 100 with static IP 172.20.0.2/24 and 172.20.0.1 as default gateway.

`panic`

The amount of time to wait after a panic before a reboot is issued.

Talos will always reboot if it encounters an unrecoverable error. However, when collecting debug information, it may reboot too quickly for humans to read the logs. This option allows the user to delay the reboot to give time to collect debug information from the console screen.

A value of 0 disables automatic rebooting entirely.

`talos.config`

The URL at which the machine configuration data may be found.

This parameter supports variable substitution inside URL query values for the following case-insensitive placeholders:

${uuid} the SMBIOS UUID
${serial} the SMBIOS Serial Number
${mac} the MAC address of the first network interface attaining link state up
${hostname} the hostname of the machine

The following example

http://example.com/metadata?h=${hostname}&m=${mac}&s=${serial}&u=${uuid}

may translate to

http://example.com/metadata?h=myTestHostname&m=52%3A2f%3Afd%3Adf%3Afc%3Ac0&s=0OCZJ19N65&u=40dcbd19-3b10-444e-bfff-aaee44a51fda

For backwards compatibility we insert the system UUID into the query parameter uuid if its value is empty. As in http://example.com/metadata?uuid= => http://example.com/metadata?uuid=40dcbd19-3b10-444e-bfff-aaee44a51fda

`talos.platform`

The platform name on which Talos will run.

Valid options are:

aws
azure
container
digitalocean
gcp
metal
equinixMetal
vmware

`talos.board`

The board name, if Talos is being used on an ARM64 SBC.

Supported boards are:

bananapi_m64: Banana Pi M64
libretech_all_h3_cc_h5: Libre Computer ALL-H3-CC
rock64: Pine64 Rock64
rpi_4: Raspberry Pi 4, Model B

`talos.hostname`

The hostname to be used. The hostname is generally specified in the machine config. However, in some cases, the DHCP server needs to know the hostname before the machine configuration has been acquired.

Unless specifically required, the machine configuration should be used instead.

`talos.shutdown`

The type of shutdown to use when Talos is told to shutdown.

Valid options are:

halt
poweroff

`talos.network.interface.ignore`

A network interface which should be ignored and not configured by Talos.

Before a configuration is applied (early on each boot), Talos attempts to configure each network interface by DHCP. If there are many network interfaces on the machine which have link but no DHCP server, this can add significant boot delays.

This option may be specified multiple times for multiple network interfaces.

`talos.experimental.wipe`

Resets the disk before starting up the system.

Valid options are:

system resets system disk.

5 - Platform

Visualization of the bootstrap process on bare metal machines.

Metal

Below is a image to visualize the process of bootstrapping nodes.

Reference

1 - API

Table of Contents

common/common.proto

Data

DataResponse

Empty

EmptyResponse

Error

Metadata

NetIP

NetIPPort

NetIPPrefix

PEMEncodedCertificateAndKey

PEMEncodedKey

URL

Code

ContainerDriver

File-level Extensions

inspect/inspect.proto

ControllerDependencyEdge

ControllerRuntimeDependenciesResponse

ControllerRuntimeDependency

DependencyEdgeType

InspectService

machine/machine.proto

AddressEvent

ApplyConfiguration

ApplyConfigurationRequest

ApplyConfigurationResponse

BPFInstruction

Bootstrap

BootstrapRequest

BootstrapResponse

CNIConfig

CPUInfo

CPUInfoResponse

CPUStat

CPUsInfo

ClusterConfig

ClusterNetworkConfig

ConfigLoadErrorEvent

ConfigValidationErrorEvent

Container

ContainerInfo

ContainersRequest

ContainersResponse

ControlPlaneConfig

CopyRequest

DHCPOptionsConfig

DiskStat

DiskStats

DiskStatsResponse

DiskUsageInfo

DiskUsageRequest

DmesgRequest

EtcdForfeitLeadership

EtcdForfeitLeadershipRequest

EtcdForfeitLeadershipResponse

EtcdLeaveCluster

EtcdLeaveClusterRequest

EtcdLeaveClusterResponse

EtcdMember

EtcdMemberListRequest

EtcdMemberListResponse

EtcdMembers

EtcdRecover

EtcdRecoverResponse

EtcdRemoveMember

EtcdRemoveMemberRequest

EtcdRemoveMemberResponse

EtcdSnapshotRequest

Event

EventsRequest

FeaturesInfo

FileInfo

GenerateClientConfiguration

GenerateClientConfigurationRequest

GenerateClientConfigurationResponse

GenerateConfiguration