From da451c5ba4ee97e7ef108bb6d73d5aa8bc7c72fd Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Wed, 15 Oct 2025 14:41:44 +0400 Subject: [PATCH] chore: drop documentation except for fresh reference As the documentation got moved to https://github.com/siderolabs/docs/tree/main/public/talos, drop the documentation from Talos repository to avoid confusion. Leave only generated reference docs for now. Signed-off-by: Andrey Smirnov --- Makefile | 14 - netlify.toml | 11 - website/.DS_Store | Bin 6148 -> 0 bytes website/.gitignore | 1 - website/.hugo_build.lock | 0 website/LICENSE | 201 - website/assets/icons/logo.svg | 1 - website/assets/scss/_sidebar-tree.scss | 246 - website/assets/scss/_styles_project.scss | 46 - website/assets/scss/_variables_project.scss | 19 - website/content/_index.html | 169 - website/content/featured-background.png | Bin 738169 -> 0 bytes website/content/v0.10/_index.md | 47 - .../v0.10/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 161 - .../bare-metal-platforms/equinix-metal.md | 127 - .../v0.10/bare-metal-platforms/matchbox.md | 188 - .../v0.10/bare-metal-platforms/sidero.md | 7 - .../content/v0.10/cloud-platforms/_index.md | 4 - website/content/v0.10/cloud-platforms/aws.md | 261 - .../content/v0.10/cloud-platforms/azure.md | 282 - .../v0.10/cloud-platforms/digitalocean.md | 152 - website/content/v0.10/cloud-platforms/gcp.md | 177 - .../v0.10/cloud-platforms/openstack.md | 135 - website/content/v0.10/guides/_index.md | 4 - .../v0.10/guides/advanced-networking.md | 84 - website/content/v0.10/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.10/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 101 - .../v0.10/guides/converting-control-plane.md | 257 - .../v0.10/guides/customizing-the-kernel.md | 20 - .../guides/customizing-the-root-filesystem.md | 61 - .../v0.10/guides/deploy-metrics-server.md | 43 - .../content/v0.10/guides/disaster-recovery.md | 147 - .../content/v0.10/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.10/guides/managing-pki.md | 49 - .../v0.10/guides/resetting-a-machine.md | 22 - website/content/v0.10/guides/storage.md | 133 - .../guides/troubleshooting-control-plane.md | 437 - .../v0.10/guides/upgrading-kubernetes.md | 281 - .../content/v0.10/guides/upgrading-talos.md | 63 - website/content/v0.10/guides/vip.md | 81 - website/content/v0.10/introduction/_index.md | 4 - .../v0.10/introduction/getting-started.md | 461 - .../content/v0.10/introduction/quickstart.md | 46 - .../v0.10/introduction/system-requirements.md | 54 - .../content/v0.10/introduction/what-is-new.md | 55 - .../v0.10/introduction/what-is-talos.md | 27 - website/content/v0.10/learn-more/_index.md | 4 - .../content/v0.10/learn-more/architecture.md | 41 - .../content/v0.10/learn-more/components.md | 123 - website/content/v0.10/learn-more/concepts.md | 12 - .../content/v0.10/learn-more/control-plane.md | 67 - .../v0.10/learn-more/controllers-resources.md | 227 - website/content/v0.10/learn-more/faqs.md | 31 - .../content/v0.10/learn-more/philosophy.md | 72 - website/content/v0.10/learn-more/talosctl.md | 62 - website/content/v0.10/learn-more/upgrades.md | 111 - .../content/v0.10/local-platforms/_index.md | 4 - .../content/v0.10/local-platforms/docker.md | 60 - .../v0.10/local-platforms/firecracker.md | 316 - website/content/v0.10/local-platforms/qemu.md | 299 - .../v0.10/local-platforms/virtualbox.md | 176 - website/content/v0.10/reference/_index.md | 4 - website/content/v0.10/reference/api.md | 3677 ------- website/content/v0.10/reference/cli.md | 2181 ---- .../content/v0.10/reference/configuration.md | 5055 --------- website/content/v0.10/reference/kernel.md | 107 - website/content/v0.10/reference/platform.md | 9 - .../v0.10/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.10/single-board-computers/rock64.md | 57 - .../v0.10/single-board-computers/rockpi_4.md | 93 - .../v0.10/single-board-computers/rpi_4.md | 109 - .../v0.10/virtualized-platforms/_index.md | 4 - .../v0.10/virtualized-platforms/hyper-v.md | 5 - .../v0.10/virtualized-platforms/kvm.md | 5 - .../v0.10/virtualized-platforms/proxmox.md | 182 - .../v0.10/virtualized-platforms/vmware.md | 218 - .../v0.10/virtualized-platforms/xen.md | 5 - website/content/v0.11/_index.md | 47 - .../v0.11/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 125 - .../v0.11/bare-metal-platforms/matchbox.md | 174 - .../v0.11/bare-metal-platforms/sidero.md | 7 - .../content/v0.11/cloud-platforms/_index.md | 4 - website/content/v0.11/cloud-platforms/aws.md | 256 - .../content/v0.11/cloud-platforms/azure.md | 284 - .../v0.11/cloud-platforms/digitalocean.md | 157 - website/content/v0.11/cloud-platforms/gcp.md | 185 - .../v0.11/cloud-platforms/openstack.md | 146 - website/content/v0.11/guides/_index.md | 4 - .../v0.11/guides/advanced-networking.md | 84 - website/content/v0.11/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.11/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 101 - .../v0.11/guides/converting-control-plane.md | 257 - .../v0.11/guides/customizing-the-kernel.md | 49 - .../guides/customizing-the-root-filesystem.md | 61 - .../v0.11/guides/deploy-metrics-server.md | 43 - .../content/v0.11/guides/disaster-recovery.md | 147 - .../content/v0.11/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.11/guides/managing-pki.md | 49 - website/content/v0.11/guides/rbac.md | 50 - .../v0.11/guides/resetting-a-machine.md | 22 - website/content/v0.11/guides/storage.md | 220 - .../guides/troubleshooting-control-plane.md | 437 - .../v0.11/guides/upgrading-kubernetes.md | 281 - .../content/v0.11/guides/upgrading-talos.md | 67 - website/content/v0.11/guides/vip.md | 81 - website/content/v0.11/introduction/_index.md | 4 - .../v0.11/introduction/getting-started.md | 460 - .../content/v0.11/introduction/quickstart.md | 46 - .../v0.11/introduction/system-requirements.md | 54 - .../content/v0.11/introduction/what-is-new.md | 59 - .../v0.11/introduction/what-is-talos.md | 27 - website/content/v0.11/learn-more/_index.md | 4 - .../content/v0.11/learn-more/architecture.md | 41 - .../content/v0.11/learn-more/components.md | 123 - website/content/v0.11/learn-more/concepts.md | 12 - .../content/v0.11/learn-more/control-plane.md | 67 - .../v0.11/learn-more/controllers-resources.md | 229 - website/content/v0.11/learn-more/faqs.md | 31 - .../v0.11/learn-more/networking-resources.md | 394 - .../content/v0.11/learn-more/philosophy.md | 72 - website/content/v0.11/learn-more/talosctl.md | 62 - website/content/v0.11/learn-more/upgrades.md | 111 - .../content/v0.11/local-platforms/_index.md | 4 - .../content/v0.11/local-platforms/docker.md | 60 - .../v0.11/local-platforms/firecracker.md | 316 - website/content/v0.11/local-platforms/qemu.md | 299 - .../v0.11/local-platforms/virtualbox.md | 190 - website/content/v0.11/reference/_index.md | 4 - website/content/v0.11/reference/api.md | 3475 ------ website/content/v0.11/reference/cli.md | 2216 ---- .../content/v0.11/reference/configuration.md | 5140 --------- website/content/v0.11/reference/kernel.md | 95 - website/content/v0.11/reference/platform.md | 9 - .../v0.11/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.11/single-board-computers/pine64.md | 57 - .../v0.11/single-board-computers/rock64.md | 57 - .../v0.11/single-board-computers/rockpi_4.md | 93 - .../v0.11/single-board-computers/rpi_4.md | 109 - .../v0.11/virtualized-platforms/_index.md | 4 - .../v0.11/virtualized-platforms/hyper-v.md | 5 - .../v0.11/virtualized-platforms/kvm.md | 5 - .../v0.11/virtualized-platforms/proxmox.md | 218 - .../v0.11/virtualized-platforms/vmware.md | 203 - .../v0.11/virtualized-platforms/xen.md | 5 - website/content/v0.12/_index.md | 47 - .../v0.12/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 125 - .../v0.12/bare-metal-platforms/matchbox.md | 174 - .../v0.12/bare-metal-platforms/sidero.md | 7 - .../content/v0.12/cloud-platforms/_index.md | 4 - website/content/v0.12/cloud-platforms/aws.md | 267 - .../content/v0.12/cloud-platforms/azure.md | 284 - .../v0.12/cloud-platforms/digitalocean.md | 157 - website/content/v0.12/cloud-platforms/gcp.md | 185 - .../v0.12/cloud-platforms/openstack.md | 146 - website/content/v0.12/guides/_index.md | 4 - .../v0.12/guides/advanced-networking.md | 86 - website/content/v0.12/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.12/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 102 - .../v0.12/guides/customizing-the-kernel.md | 49 - .../guides/customizing-the-root-filesystem.md | 61 - .../v0.12/guides/deploy-metrics-server.md | 43 - .../content/v0.12/guides/disaster-recovery.md | 147 - .../content/v0.12/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.12/guides/managing-pki.md | 49 - website/content/v0.12/guides/rbac.md | 48 - .../v0.12/guides/resetting-a-machine.md | 22 - website/content/v0.12/guides/storage.md | 220 - .../guides/troubleshooting-control-plane.md | 427 - .../v0.12/guides/upgrading-kubernetes.md | 309 - .../content/v0.12/guides/upgrading-talos.md | 89 - website/content/v0.12/guides/vip.md | 81 - website/content/v0.12/introduction/_index.md | 4 - .../v0.12/introduction/getting-started.md | 460 - .../content/v0.12/introduction/quickstart.md | 46 - .../v0.12/introduction/support-matrix.md | 24 - .../v0.12/introduction/system-requirements.md | 54 - .../content/v0.12/introduction/what-is-new.md | 84 - .../v0.12/introduction/what-is-talos.md | 27 - website/content/v0.12/learn-more/_index.md | 4 - .../content/v0.12/learn-more/architecture.md | 41 - .../content/v0.12/learn-more/components.md | 123 - website/content/v0.12/learn-more/concepts.md | 12 - .../content/v0.12/learn-more/control-plane.md | 67 - .../v0.12/learn-more/controllers-resources.md | 229 - website/content/v0.12/learn-more/faqs.md | 31 - .../v0.12/learn-more/networking-resources.md | 394 - .../content/v0.12/learn-more/philosophy.md | 72 - website/content/v0.12/learn-more/talosctl.md | 62 - website/content/v0.12/learn-more/upgrades.md | 111 - .../content/v0.12/local-platforms/_index.md | 4 - .../content/v0.12/local-platforms/docker.md | 60 - .../v0.12/local-platforms/firecracker.md | 316 - website/content/v0.12/local-platforms/qemu.md | 299 - .../v0.12/local-platforms/virtualbox.md | 190 - website/content/v0.12/reference/_index.md | 4 - website/content/v0.12/reference/api.md | 3446 ------ website/content/v0.12/reference/cli.md | 2180 ---- .../content/v0.12/reference/configuration.md | 5091 --------- website/content/v0.12/reference/kernel.md | 95 - website/content/v0.12/reference/platform.md | 9 - .../v0.12/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.12/single-board-computers/pine64.md | 57 - .../v0.12/single-board-computers/rock64.md | 57 - .../v0.12/single-board-computers/rockpi_4.md | 93 - .../v0.12/single-board-computers/rpi_4.md | 109 - .../v0.12/virtualized-platforms/_index.md | 4 - .../v0.12/virtualized-platforms/hyper-v.md | 5 - .../v0.12/virtualized-platforms/kvm.md | 5 - .../v0.12/virtualized-platforms/proxmox.md | 218 - .../v0.12/virtualized-platforms/vmware.md | 203 - .../v0.12/virtualized-platforms/xen.md | 5 - website/content/v0.13/_index.md | 47 - .../v0.13/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 125 - .../v0.13/bare-metal-platforms/matchbox.md | 174 - .../v0.13/bare-metal-platforms/sidero.md | 7 - .../content/v0.13/cloud-platforms/_index.md | 4 - website/content/v0.13/cloud-platforms/aws.md | 267 - .../content/v0.13/cloud-platforms/azure.md | 284 - .../v0.13/cloud-platforms/digitalocean.md | 157 - website/content/v0.13/cloud-platforms/gcp.md | 185 - .../content/v0.13/cloud-platforms/hetzner.md | 246 - .../content/v0.13/cloud-platforms/nocloud.md | 125 - .../v0.13/cloud-platforms/openstack.md | 146 - .../content/v0.13/cloud-platforms/scaleway.md | 6 - .../content/v0.13/cloud-platforms/upcloud.md | 6 - .../content/v0.13/cloud-platforms/vultr.md | 6 - website/content/v0.13/guides/_index.md | 4 - .../v0.13/guides/advanced-networking.md | 86 - website/content/v0.13/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.13/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 102 - .../v0.13/guides/customizing-the-kernel.md | 49 - .../guides/customizing-the-root-filesystem.md | 61 - .../v0.13/guides/deploy-metrics-server.md | 43 - .../content/v0.13/guides/disaster-recovery.md | 147 - website/content/v0.13/guides/discovery.md | 115 - .../content/v0.13/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.13/guides/kubespan.md | 184 - website/content/v0.13/guides/managing-pki.md | 49 - website/content/v0.13/guides/rbac.md | 48 - .../v0.13/guides/resetting-a-machine.md | 22 - website/content/v0.13/guides/storage.md | 220 - .../guides/troubleshooting-control-plane.md | 427 - .../v0.13/guides/upgrading-kubernetes.md | 309 - .../content/v0.13/guides/upgrading-talos.md | 66 - website/content/v0.13/guides/vip.md | 81 - website/content/v0.13/introduction/_index.md | 4 - .../v0.13/introduction/getting-started.md | 471 - .../content/v0.13/introduction/quickstart.md | 57 - .../v0.13/introduction/support-matrix.md | 51 - .../v0.13/introduction/system-requirements.md | 54 - .../content/v0.13/introduction/what-is-new.md | 69 - .../v0.13/introduction/what-is-talos.md | 27 - website/content/v0.13/learn-more/_index.md | 4 - .../content/v0.13/learn-more/architecture.md | 41 - .../content/v0.13/learn-more/components.md | 123 - website/content/v0.13/learn-more/concepts.md | 12 - .../content/v0.13/learn-more/control-plane.md | 67 - .../v0.13/learn-more/controllers-resources.md | 229 - website/content/v0.13/learn-more/discovery.md | 19 - website/content/v0.13/learn-more/faqs.md | 31 - website/content/v0.13/learn-more/kubespan.md | 99 - .../v0.13/learn-more/networking-resources.md | 394 - .../content/v0.13/learn-more/philosophy.md | 72 - website/content/v0.13/learn-more/talosctl.md | 62 - website/content/v0.13/learn-more/upgrades.md | 111 - .../content/v0.13/local-platforms/_index.md | 4 - .../content/v0.13/local-platforms/docker.md | 60 - website/content/v0.13/local-platforms/qemu.md | 299 - .../v0.13/local-platforms/virtualbox.md | 190 - website/content/v0.13/reference/_index.md | 4 - website/content/v0.13/reference/api.md | 3446 ------ website/content/v0.13/reference/cli.md | 2127 ---- .../content/v0.13/reference/configuration.md | 5533 ---------- website/content/v0.13/reference/kernel.md | 95 - website/content/v0.13/reference/platform.md | 9 - .../v0.13/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.13/single-board-computers/pine64.md | 57 - .../v0.13/single-board-computers/rock64.md | 57 - .../v0.13/single-board-computers/rockpi_4.md | 92 - .../v0.13/single-board-computers/rpi_4.md | 109 - .../v0.13/virtualized-platforms/_index.md | 4 - .../v0.13/virtualized-platforms/hyper-v.md | 5 - .../v0.13/virtualized-platforms/kvm.md | 5 - .../v0.13/virtualized-platforms/proxmox.md | 218 - .../v0.13/virtualized-platforms/vmware.md | 214 - .../v0.13/virtualized-platforms/xen.md | 5 - website/content/v0.14/_index.md | 47 - .../v0.14/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 125 - .../v0.14/bare-metal-platforms/matchbox.md | 174 - .../v0.14/bare-metal-platforms/sidero.md | 7 - .../content/v0.14/cloud-platforms/_index.md | 4 - website/content/v0.14/cloud-platforms/aws.md | 267 - .../content/v0.14/cloud-platforms/azure.md | 292 - .../v0.14/cloud-platforms/digitalocean.md | 157 - website/content/v0.14/cloud-platforms/gcp.md | 422 - .../v0.14/cloud-platforms/gcp/config.yaml | 21 - .../v0.14/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../v0.14/cloud-platforms/gcp/talos-ha.jinja | 282 - .../content/v0.14/cloud-platforms/hetzner.md | 246 - .../content/v0.14/cloud-platforms/nocloud.md | 125 - .../v0.14/cloud-platforms/openstack.md | 146 - .../content/v0.14/cloud-platforms/scaleway.md | 6 - .../content/v0.14/cloud-platforms/upcloud.md | 6 - .../content/v0.14/cloud-platforms/vultr.md | 6 - website/content/v0.14/guides/_index.md | 4 - .../adding-a-proprietary-kernel-module.md | 63 - .../v0.14/guides/advanced-networking.md | 86 - website/content/v0.14/guides/air-gapped.md | 137 - .../guides/configuring-ceph-with-rook.md | 278 - .../configuring-certificate-authorities.md | 21 - .../v0.14/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 102 - .../v0.14/guides/customizing-the-kernel.md | 49 - .../guides/customizing-the-root-filesystem.md | 61 - .../v0.14/guides/deploy-metrics-server.md | 43 - .../content/v0.14/guides/deploying-cilium.md | 210 - .../content/v0.14/guides/disaster-recovery.md | 147 - website/content/v0.14/guides/discovery.md | 115 - .../content/v0.14/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.14/guides/kubespan.md | 184 - website/content/v0.14/guides/logging.md | 186 - website/content/v0.14/guides/managing-pki.md | 49 - website/content/v0.14/guides/rbac.md | 48 - .../v0.14/guides/resetting-a-machine.md | 27 - website/content/v0.14/guides/storage.md | 143 - .../guides/troubleshooting-control-plane.md | 427 - .../v0.14/guides/upgrading-kubernetes.md | 522 - .../content/v0.14/guides/upgrading-talos.md | 60 - website/content/v0.14/guides/vip.md | 98 - website/content/v0.14/introduction/_index.md | 4 - .../v0.14/introduction/getting-started.md | 482 - .../content/v0.14/introduction/quickstart.md | 59 - .../v0.14/introduction/support-matrix.md | 51 - .../v0.14/introduction/system-requirements.md | 54 - .../content/v0.14/introduction/what-is-new.md | 101 - .../v0.14/introduction/what-is-talos.md | 27 - website/content/v0.14/learn-more/_index.md | 4 - .../content/v0.14/learn-more/architecture.md | 52 - .../content/v0.14/learn-more/components.md | 123 - .../content/v0.14/learn-more/control-plane.md | 67 - .../v0.14/learn-more/controllers-resources.md | 229 - .../v0.14/learn-more/developing-talos.md | 233 - website/content/v0.14/learn-more/discovery.md | 19 - website/content/v0.14/learn-more/faqs.md | 31 - website/content/v0.14/learn-more/kubespan.md | 99 - .../v0.14/learn-more/networking-resources.md | 394 - .../content/v0.14/learn-more/philosophy.md | 72 - website/content/v0.14/learn-more/talosctl.md | 62 - website/content/v0.14/learn-more/upgrades.md | 111 - .../content/v0.14/local-platforms/_index.md | 4 - .../content/v0.14/local-platforms/docker.md | 60 - website/content/v0.14/local-platforms/qemu.md | 299 - .../v0.14/local-platforms/virtualbox.md | 190 - website/content/v0.14/reference/_index.md | 4 - website/content/v0.14/reference/api.md | 3273 ------ website/content/v0.14/reference/cli.md | 2163 ---- .../content/v0.14/reference/configuration.md | 5853 ---------- website/content/v0.14/reference/kernel.md | 107 - website/content/v0.14/reference/platform.md | 9 - .../v0.14/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.14/single-board-computers/pine64.md | 57 - .../v0.14/single-board-computers/rock64.md | 57 - .../v0.14/single-board-computers/rockpi_4.md | 92 - .../v0.14/single-board-computers/rpi_4.md | 109 - .../v0.14/virtualized-platforms/_index.md | 4 - .../v0.14/virtualized-platforms/hyper-v.md | 5 - .../v0.14/virtualized-platforms/kvm.md | 5 - .../v0.14/virtualized-platforms/proxmox.md | 218 - .../v0.14/virtualized-platforms/vmware.md | 313 - .../virtualized-platforms/vmware/cp.patch | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../v0.14/virtualized-platforms/xen.md | 5 - website/content/v0.6/_index.md | 47 - .../v0.6/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 159 - .../bare-metal-platforms/equinix-metal.md | 5 - .../v0.6/bare-metal-platforms/matchbox.md | 189 - .../v0.6/bare-metal-platforms/sidero.md | 6 - .../content/v0.6/cloud-platforms/_index.md | 4 - website/content/v0.6/cloud-platforms/aws.md | 255 - website/content/v0.6/cloud-platforms/azure.md | 281 - .../v0.6/cloud-platforms/digitalocean.md | 149 - website/content/v0.6/cloud-platforms/gcp.md | 174 - website/content/v0.6/guides/_index.md | 4 - .../v0.6/guides/advanced-networking.md | 84 - .../v0.6/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../guides/configuring-pull-through-cache.md | 102 - .../configuring-the-cluster-endpoint.md | 45 - .../v0.6/guides/customizing-the-kernel.md | 20 - .../guides/customizing-the-root-filesystem.md | 61 - website/content/v0.6/guides/managing-pki.md | 49 - .../v0.6/guides/resetting-a-machine.md | 22 - .../v0.6/guides/upgrading-kubernetes.md | 272 - .../content/v0.6/guides/upgrading-talos.md | 22 - website/content/v0.6/introduction/_index.md | 4 - .../content/v0.6/introduction/quickstart.md | 55 - .../v0.6/introduction/system-requirements.md | 54 - .../v0.6/introduction/what-is-talos.md | 21 - website/content/v0.6/learn-more/_index.md | 4 - .../content/v0.6/learn-more/architecture.md | 131 - website/content/v0.6/learn-more/faqs.md | 31 - .../content/v0.6/local-platforms/_index.md | 4 - .../content/v0.6/local-platforms/docker.md | 54 - .../v0.6/local-platforms/firecracker.md | 313 - website/content/v0.6/local-platforms/qemu.md | 324 - website/content/v0.6/reference/_index.md | 4 - .../content/v0.6/reference/configuration.md | 1584 --- .../v0.6/virtualized-platforms/_index.md | 4 - .../v0.6/virtualized-platforms/hyper-v.md | 5 - .../content/v0.6/virtualized-platforms/kvm.md | 5 - .../v0.6/virtualized-platforms/proxmox.md | 5 - .../v0.6/virtualized-platforms/vmware.md | 216 - .../content/v0.6/virtualized-platforms/xen.md | 5 - website/content/v0.7/_index.md | 47 - .../v0.7/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 159 - .../bare-metal-platforms/equinix-metal.md | 5 - .../v0.7/bare-metal-platforms/matchbox.md | 189 - .../v0.7/bare-metal-platforms/sidero.md | 6 - .../content/v0.7/cloud-platforms/_index.md | 4 - website/content/v0.7/cloud-platforms/aws.md | 255 - website/content/v0.7/cloud-platforms/azure.md | 281 - .../v0.7/cloud-platforms/digitalocean.md | 150 - website/content/v0.7/cloud-platforms/gcp.md | 174 - website/content/v0.7/guides/_index.md | 4 - .../v0.7/guides/advanced-networking.md | 84 - website/content/v0.7/guides/air-gapped.md | 137 - .../v0.7/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../v0.7/guides/customizing-the-kernel.md | 20 - .../guides/customizing-the-root-filesystem.md | 61 - website/content/v0.7/guides/managing-pki.md | 49 - .../v0.7/guides/resetting-a-machine.md | 22 - .../v0.7/guides/upgrading-kubernetes.md | 263 - .../content/v0.7/guides/upgrading-talos.md | 58 - website/content/v0.7/introduction/_index.md | 4 - .../v0.7/introduction/getting-started.md | 88 - .../content/v0.7/introduction/quickstart.md | 46 - .../v0.7/introduction/system-requirements.md | 54 - .../v0.7/introduction/what-is-talos.md | 27 - website/content/v0.7/learn-more/_index.md | 4 - .../content/v0.7/learn-more/architecture.md | 19 - website/content/v0.7/learn-more/components.md | 131 - website/content/v0.7/learn-more/concepts.md | 12 - website/content/v0.7/learn-more/faqs.md | 31 - website/content/v0.7/learn-more/philosophy.md | 72 - website/content/v0.7/learn-more/talosctl.md | 62 - website/content/v0.7/learn-more/upgrades.md | 115 - .../content/v0.7/local-platforms/_index.md | 4 - .../content/v0.7/local-platforms/docker.md | 54 - .../v0.7/local-platforms/firecracker.md | 315 - website/content/v0.7/local-platforms/qemu.md | 298 - .../v0.7/local-platforms/virtualbox.md | 175 - website/content/v0.7/reference/_index.md | 4 - website/content/v0.7/reference/api.md | 2673 ----- website/content/v0.7/reference/cli.md | 1629 --- .../content/v0.7/reference/configuration.md | 3733 ------- website/content/v0.7/reference/platform.md | 9 - .../v0.7/virtualized-platforms/_index.md | 4 - .../v0.7/virtualized-platforms/hyper-v.md | 5 - .../content/v0.7/virtualized-platforms/kvm.md | 5 - .../v0.7/virtualized-platforms/proxmox.md | 181 - .../v0.7/virtualized-platforms/vmware.md | 216 - .../content/v0.7/virtualized-platforms/xen.md | 5 - website/content/v0.8/_index.md | 47 - .../v0.8/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 160 - .../bare-metal-platforms/equinix-metal.md | 127 - .../v0.8/bare-metal-platforms/matchbox.md | 190 - .../v0.8/bare-metal-platforms/sidero.md | 7 - .../content/v0.8/cloud-platforms/_index.md | 4 - website/content/v0.8/cloud-platforms/aws.md | 266 - website/content/v0.8/cloud-platforms/azure.md | 282 - .../v0.8/cloud-platforms/digitalocean.md | 151 - website/content/v0.8/cloud-platforms/gcp.md | 175 - .../content/v0.8/cloud-platforms/openstack.md | 133 - website/content/v0.8/guides/_index.md | 4 - .../v0.8/guides/advanced-networking.md | 84 - website/content/v0.8/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.8/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../v0.8/guides/customizing-the-kernel.md | 20 - .../guides/customizing-the-root-filesystem.md | 61 - website/content/v0.8/guides/managing-pki.md | 49 - .../v0.8/guides/resetting-a-machine.md | 22 - website/content/v0.8/guides/storage.md | 15 - .../v0.8/guides/upgrading-kubernetes.md | 364 - .../content/v0.8/guides/upgrading-talos.md | 58 - website/content/v0.8/introduction/_index.md | 4 - .../v0.8/introduction/getting-started.md | 88 - .../content/v0.8/introduction/quickstart.md | 46 - .../v0.8/introduction/system-requirements.md | 54 - .../v0.8/introduction/what-is-talos.md | 27 - website/content/v0.8/learn-more/_index.md | 4 - .../content/v0.8/learn-more/architecture.md | 41 - website/content/v0.8/learn-more/components.md | 131 - website/content/v0.8/learn-more/concepts.md | 12 - website/content/v0.8/learn-more/faqs.md | 31 - website/content/v0.8/learn-more/philosophy.md | 72 - website/content/v0.8/learn-more/talosctl.md | 62 - website/content/v0.8/learn-more/upgrades.md | 128 - .../content/v0.8/local-platforms/_index.md | 4 - .../content/v0.8/local-platforms/docker.md | 60 - .../v0.8/local-platforms/firecracker.md | 316 - website/content/v0.8/local-platforms/qemu.md | 299 - .../v0.8/local-platforms/virtualbox.md | 176 - website/content/v0.8/reference/_index.md | 4 - website/content/v0.8/reference/api.md | 3110 ------ website/content/v0.8/reference/cli.md | 1811 --- .../content/v0.8/reference/configuration.md | 3792 ------- website/content/v0.8/reference/platform.md | 9 - .../v0.8/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.8/single-board-computers/rock64.md | 57 - .../v0.8/single-board-computers/rpi_4.md | 98 - .../v0.8/virtualized-platforms/_index.md | 4 - .../v0.8/virtualized-platforms/hyper-v.md | 5 - .../content/v0.8/virtualized-platforms/kvm.md | 5 - .../v0.8/virtualized-platforms/proxmox.md | 182 - .../v0.8/virtualized-platforms/vmware.md | 217 - .../content/v0.8/virtualized-platforms/xen.md | 5 - website/content/v0.9/_index.md | 47 - .../v0.9/bare-metal-platforms/_index.md | 4 - .../bare-metal-platforms/digital-rebar.md | 160 - .../bare-metal-platforms/equinix-metal.md | 126 - .../v0.9/bare-metal-platforms/matchbox.md | 187 - .../v0.9/bare-metal-platforms/sidero.md | 7 - .../content/v0.9/cloud-platforms/_index.md | 4 - website/content/v0.9/cloud-platforms/aws.md | 266 - website/content/v0.9/cloud-platforms/azure.md | 282 - .../v0.9/cloud-platforms/digitalocean.md | 151 - website/content/v0.9/cloud-platforms/gcp.md | 175 - .../content/v0.9/cloud-platforms/openstack.md | 133 - website/content/v0.9/guides/_index.md | 4 - .../v0.9/guides/advanced-networking.md | 84 - website/content/v0.9/guides/air-gapped.md | 137 - .../configuring-certificate-authorities.md | 21 - .../v0.9/guides/configuring-containerd.md | 33 - .../guides/configuring-corporate-proxies.md | 52 - .../configuring-network-connectivity.md | 71 - .../guides/configuring-pull-through-cache.md | 110 - .../configuring-the-cluster-endpoint.md | 45 - .../guides/configuring-wireguard-network.md | 101 - .../v0.9/guides/converting-control-plane.md | 262 - .../v0.9/guides/customizing-the-kernel.md | 20 - .../guides/customizing-the-root-filesystem.md | 61 - .../content/v0.9/guides/disk-encryption.md | 179 - .../guides/editing-machine-configuration.md | 104 - website/content/v0.9/guides/managing-pki.md | 49 - .../v0.9/guides/resetting-a-machine.md | 22 - website/content/v0.9/guides/storage.md | 15 - .../guides/troubleshooting-control-plane.md | 442 - .../v0.9/guides/upgrading-kubernetes.md | 281 - .../content/v0.9/guides/upgrading-talos.md | 103 - website/content/v0.9/guides/vip.md | 81 - website/content/v0.9/introduction/_index.md | 4 - .../v0.9/introduction/getting-started.md | 461 - .../content/v0.9/introduction/quickstart.md | 46 - .../v0.9/introduction/system-requirements.md | 54 - .../content/v0.9/introduction/what-is-new.md | 51 - .../v0.9/introduction/what-is-talos.md | 27 - website/content/v0.9/learn-more/_index.md | 4 - .../content/v0.9/learn-more/architecture.md | 41 - website/content/v0.9/learn-more/components.md | 131 - website/content/v0.9/learn-more/concepts.md | 12 - .../content/v0.9/learn-more/control-plane.md | 67 - .../v0.9/learn-more/controllers-resources.md | 230 - website/content/v0.9/learn-more/faqs.md | 38 - website/content/v0.9/learn-more/philosophy.md | 72 - website/content/v0.9/learn-more/talosctl.md | 62 - website/content/v0.9/learn-more/upgrades.md | 111 - .../content/v0.9/local-platforms/_index.md | 4 - .../content/v0.9/local-platforms/docker.md | 60 - .../v0.9/local-platforms/firecracker.md | 316 - website/content/v0.9/local-platforms/qemu.md | 299 - .../v0.9/local-platforms/virtualbox.md | 176 - website/content/v0.9/reference/_index.md | 4 - website/content/v0.9/reference/api.md | 3572 ------ website/content/v0.9/reference/cli.md | 2054 ---- .../content/v0.9/reference/configuration.md | 4671 -------- website/content/v0.9/reference/kernel.md | 107 - website/content/v0.9/reference/platform.md | 9 - .../v0.9/single-board-computers/_index.md | 4 - .../single-board-computers/bananapi_m64.md | 57 - .../libretech_all_h3_cc_h5.md | 57 - .../v0.9/single-board-computers/rock64.md | 57 - .../v0.9/single-board-computers/rockpi_4.md | 57 - .../v0.9/single-board-computers/rpi_4.md | 103 - .../v0.9/virtualized-platforms/_index.md | 4 - .../v0.9/virtualized-platforms/hyper-v.md | 5 - .../content/v0.9/virtualized-platforms/kvm.md | 5 - .../v0.9/virtualized-platforms/proxmox.md | 182 - .../v0.9/virtualized-platforms/vmware.md | 217 - .../content/v0.9/virtualized-platforms/xen.md | 5 - website/content/v1.0/_index.md | 54 - website/content/v1.0/advanced/_index.md | 4 - .../v1.0/advanced/advanced-networking.md | 89 - website/content/v1.0/advanced/air-gapped.md | 167 - .../v1.0/advanced/customizing-the-kernel.md | 51 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.0/advanced/developing-talos.md | 235 - .../v1.0/advanced/disaster-recovery.md | 149 - .../v1.0/advanced/extension-services.md | 153 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.0/advanced/static-pods.md | 100 - .../advanced/troubleshooting-control-plane.md | 487 - website/content/v1.0/introduction/_index.md | 4 - .../v1.0/introduction/getting-started.md | 463 - .../content/v1.0/introduction/quickstart.md | 60 - .../v1.0/introduction/support-matrix.md | 53 - .../v1.0/introduction/system-requirements.md | 55 - website/content/v1.0/introduction/theila.md | 75 - .../content/v1.0/introduction/what-is-new.md | 166 - .../v1.0/introduction/what-is-talos.md | 28 - .../content/v1.0/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/discovery.md | 118 - .../configuration/pod-security.md | 181 - .../configuration/storage.md | 141 - .../v1.0/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 209 - .../kubernetes-guides/network/kubespan.md | 190 - .../kubernetes-guides/upgrading-kubernetes.md | 349 - website/content/v1.0/learn-more/_index.md | 4 - .../content/v1.0/learn-more/architecture.md | 52 - website/content/v1.0/learn-more/components.md | 124 - website/content/v1.0/learn-more/concepts.md | 143 - .../content/v1.0/learn-more/control-plane.md | 68 - .../v1.0/learn-more/controllers-resources.md | 230 - website/content/v1.0/learn-more/discovery.md | 20 - website/content/v1.0/learn-more/faqs.md | 39 - .../content/v1.0/learn-more/knowledge-base.md | 55 - website/content/v1.0/learn-more/kubespan.md | 100 - .../v1.0/learn-more/networking-resources.md | 395 - website/content/v1.0/learn-more/philosophy.md | 73 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.0/learn-more/talosctl.md | 63 - website/content/v1.0/reference/_index.md | 4 - website/content/v1.0/reference/api.md | 3307 ------ website/content/v1.0/reference/cli.md | 2165 ---- .../content/v1.0/reference/configuration.md | 2631 ----- website/content/v1.0/reference/kernel.md | 144 - website/content/v1.0/reference/platform.md | 10 - website/content/v1.0/talos-guides/_index.md | 5 - .../v1.0/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 35 - .../configuration/disk-encryption.md | 183 - .../editing-machine-configuration.md | 154 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 51 - .../talos-guides/configuration/nvidia-gpu.md | 232 - .../configuration/pull-through-cache.md | 113 - .../v1.0/talos-guides/configuration/rbac.md | 51 - .../configuration/system-extensions.md | 81 - .../v1.0/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 174 - .../bare-metal-platforms/equinix-metal.md | 127 - .../install/bare-metal-platforms/matchbox.md | 176 - .../install/bare-metal-platforms/sidero.md | 10 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 269 - .../install/cloud-platforms/azure.md | 294 - .../install/cloud-platforms/digitalocean.md | 159 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 127 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 55 - .../install/local-platforms/qemu.md | 301 - .../install/local-platforms/virtualbox.md | 192 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 94 - .../install/single-board-computers/rpi_4.md | 111 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 9 - .../install/virtualized-platforms/proxmox.md | 233 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../v1.0/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 54 - .../content/v1.0/talos-guides/network/vip.md | 103 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.0/talos-guides/resetting-a-machine.md | 39 - .../v1.0/talos-guides/upgrading-talos.md | 159 - website/content/v1.1/_index.md | 55 - website/content/v1.1/advanced/_index.md | 4 - .../v1.1/advanced/advanced-networking.md | 89 - website/content/v1.1/advanced/air-gapped.md | 167 - .../v1.1/advanced/customizing-the-kernel.md | 51 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.1/advanced/developing-talos.md | 235 - .../v1.1/advanced/disaster-recovery.md | 149 - .../v1.1/advanced/extension-services.md | 189 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.1/advanced/static-pods.md | 100 - .../advanced/troubleshooting-control-plane.md | 487 - website/content/v1.1/introduction/_index.md | 4 - .../v1.1/introduction/getting-started.md | 463 - .../content/v1.1/introduction/quickstart.md | 60 - .../v1.1/introduction/support-matrix.md | 53 - .../v1.1/introduction/system-requirements.md | 55 - website/content/v1.1/introduction/theila.md | 75 - .../content/v1.1/introduction/what-is-new.md | 99 - .../v1.1/introduction/what-is-talos.md | 28 - .../content/v1.1/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/discovery.md | 118 - .../configuration/pod-security.md | 170 - ...licated-local-storage-with-openebs-jiva.md | 194 - .../configuration/storage.md | 141 - .../configuration/synology-csi.md | 259 - .../v1.1/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 209 - .../kubernetes-guides/network/kubespan.md | 190 - .../kubernetes-guides/upgrading-kubernetes.md | 349 - website/content/v1.1/learn-more/_index.md | 4 - .../content/v1.1/learn-more/architecture.md | 52 - website/content/v1.1/learn-more/components.md | 124 - website/content/v1.1/learn-more/concepts.md | 143 - .../content/v1.1/learn-more/control-plane.md | 68 - .../v1.1/learn-more/controllers-resources.md | 230 - website/content/v1.1/learn-more/discovery.md | 21 - website/content/v1.1/learn-more/faqs.md | 39 - .../content/v1.1/learn-more/knowledge-base.md | 69 - website/content/v1.1/learn-more/kubespan.md | 100 - .../v1.1/learn-more/networking-resources.md | 434 - website/content/v1.1/learn-more/philosophy.md | 73 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.1/learn-more/talosctl.md | 63 - website/content/v1.1/reference/_index.md | 4 - website/content/v1.1/reference/api.md | 3328 ------ website/content/v1.1/reference/cli.md | 2173 ---- .../content/v1.1/reference/configuration.md | 2718 ----- website/content/v1.1/reference/kernel.md | 144 - website/content/v1.1/reference/platform.md | 10 - website/content/v1.1/talos-guides/_index.md | 5 - .../v1.1/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 35 - .../configuration/disk-encryption.md | 183 - .../editing-machine-configuration.md | 154 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 51 - .../talos-guides/configuration/nvidia-gpu.md | 232 - .../configuration/pull-through-cache.md | 113 - .../v1.1/talos-guides/configuration/rbac.md | 51 - .../configuration/system-extensions.md | 88 - .../v1.1/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 174 - .../bare-metal-platforms/equinix-metal.md | 127 - .../install/bare-metal-platforms/matchbox.md | 176 - .../install/bare-metal-platforms/sidero.md | 10 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 269 - .../install/cloud-platforms/azure.md | 294 - .../install/cloud-platforms/digitalocean.md | 159 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 127 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 55 - .../install/local-platforms/qemu.md | 301 - .../install/local-platforms/virtualbox.md | 192 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../install/single-board-computers/rpi_4.md | 111 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 9 - .../install/virtualized-platforms/proxmox.md | 233 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../v1.1/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 54 - .../talos-guides/network/device-selector.md | 47 - .../content/v1.1/talos-guides/network/vip.md | 103 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.1/talos-guides/resetting-a-machine.md | 39 - .../v1.1/talos-guides/upgrading-talos.md | 173 - website/content/v1.10/_index.md | 55 - website/content/v1.10/advanced/_index.md | 4 - .../v1.10/advanced/advanced-networking.md | 108 - website/content/v1.10/advanced/air-gapped.md | 164 - .../content/v1.10/advanced/building-images.md | 120 - website/content/v1.10/advanced/ca-rotation.md | 187 - .../v1.10/advanced/cgroups-analysis.md | 285 - .../v1.10/advanced/customizing-the-kernel.md | 95 - .../v1.10/advanced/developing-talos.md | 447 - .../v1.10/advanced/disaster-recovery.md | 148 - .../content/v1.10/advanced/egress-domains.md | 44 - .../v1.10/advanced/etcd-maintenance.md | 76 - .../v1.10/advanced/extension-services.md | 208 - .../v1.10/advanced/install-kubevirt.md | 539 - .../content/v1.10/advanced/kernel-module.md | 314 - .../v1.10/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.10/advanced/migrating-from-kubeadm.md | 161 - .../content/v1.10/advanced/oci-base-spec.md | 49 - website/content/v1.10/advanced/overlays.md | 113 - website/content/v1.10/advanced/selinux.md | 45 - website/content/v1.10/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../v1.10/advanced/verifying-images.md | 37 - website/content/v1.10/advanced/watchdog.md | 69 - website/content/v1.10/introduction/_index.md | 4 - .../introduction/deploy-first-workload.md | 67 - .../v1.10/introduction/getting-started.md | 231 - .../content/v1.10/introduction/prodnotes.md | 392 - .../content/v1.10/introduction/quickstart.md | 62 - .../v1.10/introduction/support-matrix.md | 58 - .../v1.10/introduction/system-requirements.md | 69 - .../v1.10/introduction/troubleshooting.md | 432 - .../v1.10/introduction/what-is-new/index.md | 139 - .../v1.10/introduction/what-is-talos.md | 28 - .../content/v1.10/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 285 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/device-plugins.md | 145 - .../configuration/etcd-metrics.md | 57 - .../configuration/inlinemanifests.md | 139 - .../configuration/kubeprism.md | 58 - .../configuration/local-storage.md | 139 - .../configuration/node-labels.md | 47 - .../configuration/pod-security.md | 288 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 163 - .../configuration/synology-csi.md | 259 - .../configuration/usernamespace.md | 30 - .../v1.10/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 437 - .../v1.10/kubernetes-guides/network/multus.md | 216 - .../kubernetes-guides/upgrading-kubernetes.md | 400 - website/content/v1.10/learn-more/_index.md | 4 - .../content/v1.10/learn-more/architecture.md | 55 - .../content/v1.10/learn-more/components.md | 120 - .../content/v1.10/learn-more/control-plane.md | 145 - .../v1.10/learn-more/controllers-resources.md | 230 - website/content/v1.10/learn-more/faqs.md | 72 - .../content/v1.10/learn-more/image-factory.md | 182 - .../v1.10/learn-more/knowledge-base.md | 98 - website/content/v1.10/learn-more/kubespan.md | 207 - .../v1.10/learn-more/networking-resources.md | 434 - .../content/v1.10/learn-more/philosophy.md | 110 - .../v1.10/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.10/learn-more/talosctl.md | 62 - website/content/v1.10/reference/_index.md | 4 - website/content/v1.10/reference/api.md | 9402 ---------------- website/content/v1.10/reference/cli.md | 3271 ------ .../v1.10/reference/configuration/_index.md | 28 - .../reference/configuration/block/_index.md | 8 - .../configuration/block/uservolumeconfig.md | 282 - .../configuration/block/volumeconfig.md | 86 - .../configuration/extensions/_index.md | 8 - .../extensions/extensionserviceconfig.md | 57 - .../configuration/hardware/_index.md | 8 - .../hardware/pcidriverrebindconfig.md | 33 - .../reference/configuration/network/_index.md | 8 - .../configuration/network/ethernetconfig.md | 87 - .../network/kubespanendpointsconfig.md | 33 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../runtime/watchdogtimerconfig.md | 35 - .../configuration/security/_index.md | 8 - .../security/trustedrootsconfig.md | 36 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 34 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 3926 ------- website/content/v1.10/reference/kernel.md | 279 - .../content/v1.10/schemas/config.schema.json | 4229 ------- .../v1.10/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.10/talos-guides/_index.md | 5 - .../talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 28 - .../talos-guides/configuration/containerd.md | 101 - .../configuration/disk-encryption.md | 198 - .../configuration/disk-management.md | 491 - .../editing-machine-configuration.md | 164 - .../talos-guides/configuration/image-cache.md | 183 - .../talos-guides/configuration/insecure.md | 105 - .../talos-guides/configuration/logging.md | 435 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 158 - .../talos-guides/configuration/nvidia-gpu.md | 157 - .../talos-guides/configuration/patching.md | 398 - .../configuration/performance-tuning.md | 75 - .../configuration/pull-through-cache.md | 171 - .../v1.10/talos-guides/configuration/rbac.md | 52 - .../reproducible-machine-config.md | 49 - .../configuration/system-extensions.md | 106 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.10/talos-guides/discovery.md | 168 - .../v1.10/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.10/talos-guides/howto/scaling-down.md | 17 - .../v1.10/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 33 - .../v1.10/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/bootloader.md | 57 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 174 - .../bare-metal-platforms/network-config.md | 71 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 253 - .../v1.10/talos-guides/install/boot-assets.md | 489 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 159 - .../install/cloud-platforms/aws.md | 491 - .../install/cloud-platforms/azure.md | 296 - .../install/cloud-platforms/cloudstack.md | 228 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 425 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 325 - .../install/cloud-platforms/kubernetes.md | 103 - .../install/cloud-platforms/nocloud.md | 142 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 109 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 160 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 141 - .../install/local-platforms/qemu.md | 294 - .../install/local-platforms/virtualbox.md | 198 - .../v1.10/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../single-board-computers/orangepi_5.md | 109 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock5b.md | 72 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 375 - .../single-board-computers/turing_rk1.md | 136 - .../single-board-computers/unofficial.md | 20 - .../v1.10/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 92 - .../install/virtualized-platforms/kvm.md | 14 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 271 - .../virtualized-platforms/vagrant-libvirt.md | 283 - .../install/virtualized-platforms/vmware.md | 337 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 12 - .../interactive-dashboard/index.md | 77 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.10/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 73 - .../talos-guides/network/ethernet-config.md | 106 - .../v1.10/talos-guides/network/host-dns.md | 112 - .../talos-guides/network/ingress-firewall.md | 245 - .../v1.10/talos-guides/network/kubespan.md | 258 - .../v1.10/talos-guides/network/multihoming.md | 44 - .../network/predictable-interface-names.md | 38 - .../v1.10/talos-guides/network/siderolink.md | 39 - .../content/v1.10/talos-guides/network/vip.md | 131 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.10/talos-guides/resetting-a-machine.md | 44 - .../v1.10/talos-guides/upgrading-talos.md | 166 - website/content/v1.11/_index.md | 56 - website/content/v1.11/advanced/_index.md | 4 - .../v1.11/advanced/advanced-networking.md | 108 - website/content/v1.11/advanced/air-gapped.md | 164 - .../content/v1.11/advanced/building-images.md | 120 - website/content/v1.11/advanced/ca-rotation.md | 187 - .../v1.11/advanced/cgroups-analysis.md | 285 - .../v1.11/advanced/customizing-the-kernel.md | 95 - .../v1.11/advanced/developing-talos.md | 441 - .../v1.11/advanced/disaster-recovery.md | 148 - .../content/v1.11/advanced/egress-domains.md | 44 - .../v1.11/advanced/etcd-maintenance.md | 226 - .../v1.11/advanced/extension-services.md | 208 - .../v1.11/advanced/install-kubevirt.md | 538 - .../content/v1.11/advanced/kernel-module.md | 314 - .../v1.11/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.11/advanced/migrating-from-kubeadm.md | 161 - .../content/v1.11/advanced/oci-base-spec.md | 49 - website/content/v1.11/advanced/overlays.md | 113 - website/content/v1.11/advanced/sbom.md | 89 - website/content/v1.11/advanced/selinux.md | 55 - website/content/v1.11/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../v1.11/advanced/verifying-images.md | 37 - website/content/v1.11/advanced/watchdog.md | 69 - website/content/v1.11/introduction/_index.md | 4 - .../introduction/deploy-first-workload.md | 67 - .../v1.11/introduction/getting-started.md | 231 - .../content/v1.11/introduction/prodnotes.md | 392 - .../content/v1.11/introduction/quickstart.md | 62 - .../v1.11/introduction/support-matrix.md | 58 - .../v1.11/introduction/system-requirements.md | 69 - .../v1.11/introduction/troubleshooting.md | 432 - .../v1.11/introduction/what-is-new/index.md | 162 - .../v1.11/introduction/what-is-talos.md | 28 - .../content/v1.11/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 285 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/device-plugins.md | 145 - .../configuration/etcd-metrics.md | 57 - .../configuration/inlinemanifests.md | 139 - .../configuration/kubeprism.md | 58 - .../configuration/local-storage.md | 139 - .../configuration/node-labels.md | 47 - .../configuration/pod-security.md | 288 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 163 - .../configuration/synology-csi.md | 259 - .../configuration/usernamespace.md | 30 - .../v1.11/kubernetes-guides/network/_index.md | 5 - .../network/deploying-calico.md | 195 - .../network/deploying-cilium.md | 437 - .../v1.11/kubernetes-guides/network/multus.md | 216 - .../kubernetes-guides/upgrading-kubernetes.md | 400 - website/content/v1.11/learn-more/_index.md | 4 - .../content/v1.11/learn-more/architecture.md | 55 - .../content/v1.11/learn-more/components.md | 120 - .../content/v1.11/learn-more/control-plane.md | 145 - .../v1.11/learn-more/controllers-resources.md | 230 - website/content/v1.11/learn-more/faqs.md | 72 - .../content/v1.11/learn-more/image-factory.md | 182 - .../v1.11/learn-more/knowledge-base.md | 98 - website/content/v1.11/learn-more/kubespan.md | 207 - .../v1.11/learn-more/networking-resources.md | 434 - .../content/v1.11/learn-more/philosophy.md | 110 - .../v1.11/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.11/learn-more/talosctl.md | 61 - website/content/v1.11/reference/_index.md | 4 - website/content/v1.11/reference/api.md | 9707 ----------------- website/content/v1.11/reference/cli.md | 3085 ------ .../v1.11/reference/configuration/_index.md | 28 - .../reference/configuration/block/_index.md | 8 - .../block/existingvolumeconfig.md | 94 - .../configuration/block/rawvolumeconfig.md | 257 - .../configuration/block/swapvolumeconfig.md | 254 - .../configuration/block/uservolumeconfig.md | 284 - .../configuration/block/volumeconfig.md | 254 - .../configuration/block/zswapconfig.md | 37 - .../configuration/extensions/_index.md | 8 - .../extensions/extensionserviceconfig.md | 57 - .../configuration/hardware/_index.md | 8 - .../hardware/pcidriverrebindconfig.md | 33 - .../reference/configuration/network/_index.md | 8 - .../configuration/network/ethernetconfig.md | 87 - .../network/kubespanendpointsconfig.md | 33 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../runtime/watchdogtimerconfig.md | 35 - .../configuration/security/_index.md | 8 - .../security/trustedrootsconfig.md | 36 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 34 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 3609 ------ website/content/v1.11/reference/kernel.md | 288 - .../content/v1.11/schemas/config.schema.json | 4319 -------- .../v1.11/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.11/talos-guides/_index.md | 5 - .../talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 28 - .../talos-guides/configuration/containerd.md | 101 - .../configuration/disk-encryption.md | 238 - .../configuration/disk-management/_index.md | 29 - .../configuration/disk-management/common.md | 136 - .../configuration/disk-management/existing.md | 48 - .../configuration/disk-management/layout.md | 159 - .../configuration/disk-management/raw.md | 75 - .../disk-management/resources.md | 164 - .../configuration/disk-management/system.md | 70 - .../configuration/disk-management/user.md | 101 - .../editing-machine-configuration.md | 164 - .../talos-guides/configuration/image-cache.md | 183 - .../talos-guides/configuration/insecure.md | 105 - .../talos-guides/configuration/logging.md | 435 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 158 - .../talos-guides/configuration/nvidia-gpu.md | 147 - .../talos-guides/configuration/patching.md | 398 - .../configuration/performance-tuning.md | 75 - .../configuration/pull-through-cache.md | 171 - .../v1.11/talos-guides/configuration/rbac.md | 52 - .../reproducible-machine-config.md | 49 - .../v1.11/talos-guides/configuration/swap.md | 136 - .../configuration/system-extensions.md | 123 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.11/talos-guides/discovery.md | 168 - .../v1.11/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.11/talos-guides/howto/scaling-down.md | 17 - .../v1.11/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 33 - .../v1.11/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/bootloader.md | 57 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 174 - .../bare-metal-platforms/network-config.md | 71 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 253 - .../v1.11/talos-guides/install/boot-assets.md | 489 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 159 - .../install/cloud-platforms/aws.md | 491 - .../install/cloud-platforms/azure.md | 296 - .../install/cloud-platforms/cloudstack.md | 228 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 425 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 325 - .../install/cloud-platforms/kubernetes.md | 103 - .../install/cloud-platforms/nocloud.md | 142 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 107 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 160 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 141 - .../install/local-platforms/qemu.md | 345 - .../install/local-platforms/virtualbox.md | 198 - .../v1.11/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../single-board-computers/orangepi_5.md | 109 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock5b.md | 72 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 375 - .../single-board-computers/turing_rk1.md | 136 - .../single-board-computers/unofficial.md | 20 - .../v1.11/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 92 - .../install/virtualized-platforms/kvm.md | 284 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 271 - .../virtualized-platforms/vagrant-libvirt.md | 283 - .../install/virtualized-platforms/vmware.md | 337 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 12 - .../interactive-dashboard/index.md | 77 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.11/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 73 - .../talos-guides/network/ethernet-config.md | 106 - .../v1.11/talos-guides/network/host-dns.md | 112 - .../talos-guides/network/ingress-firewall.md | 247 - .../v1.11/talos-guides/network/kubespan.md | 258 - .../v1.11/talos-guides/network/multihoming.md | 44 - .../network/predictable-interface-names.md | 38 - .../v1.11/talos-guides/network/siderolink.md | 39 - .../content/v1.11/talos-guides/network/vip.md | 131 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.11/talos-guides/resetting-a-machine.md | 44 - .../v1.11/talos-guides/upgrading-talos.md | 172 - website/content/v1.12/_index.md | 56 - website/content/v1.12/advanced/_index.md | 4 - .../v1.12/advanced/advanced-networking.md | 108 - website/content/v1.12/advanced/air-gapped.md | 164 - .../content/v1.12/advanced/building-images.md | 120 - website/content/v1.12/advanced/ca-rotation.md | 187 - .../v1.12/advanced/cgroups-analysis.md | 336 - .../v1.12/advanced/customizing-the-kernel.md | 95 - .../v1.12/advanced/developing-talos.md | 441 - .../v1.12/advanced/disaster-recovery.md | 148 - .../content/v1.12/advanced/egress-domains.md | 44 - .../v1.12/advanced/etcd-maintenance.md | 226 - .../v1.12/advanced/extension-services.md | 208 - .../v1.12/advanced/install-kubevirt.md | 538 - .../content/v1.12/advanced/kernel-module.md | 314 - .../v1.12/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.12/advanced/migrating-from-kubeadm.md | 161 - .../content/v1.12/advanced/oci-base-spec.md | 49 - website/content/v1.12/advanced/overlays.md | 113 - website/content/v1.12/advanced/sbom.md | 89 - website/content/v1.12/advanced/selinux.md | 55 - website/content/v1.12/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../v1.12/advanced/verifying-images.md | 37 - website/content/v1.12/advanced/watchdog.md | 69 - website/content/v1.12/introduction/_index.md | 4 - .../introduction/deploy-first-workload.md | 67 - .../v1.12/introduction/getting-started.md | 231 - .../content/v1.12/introduction/prodnotes.md | 392 - .../content/v1.12/introduction/quickstart.md | 62 - .../v1.12/introduction/support-matrix.md | 58 - .../v1.12/introduction/system-requirements.md | 69 - .../v1.12/introduction/troubleshooting.md | 432 - .../v1.12/introduction/what-is-new/index.md | 9 - .../v1.12/introduction/what-is-talos.md | 28 - .../content/v1.12/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 285 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/device-plugins.md | 145 - .../configuration/etcd-metrics.md | 57 - .../configuration/inlinemanifests.md | 139 - .../configuration/kubeprism.md | 58 - .../configuration/local-storage.md | 139 - .../configuration/node-labels.md | 47 - .../configuration/pod-security.md | 288 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 163 - .../configuration/synology-csi.md | 259 - .../configuration/usernamespace.md | 30 - .../v1.12/kubernetes-guides/network/_index.md | 5 - .../network/deploying-calico.md | 195 - .../network/deploying-cilium.md | 437 - .../v1.12/kubernetes-guides/network/multus.md | 216 - .../kubernetes-guides/upgrading-kubernetes.md | 400 - website/content/v1.12/learn-more/_index.md | 4 - .../content/v1.12/learn-more/architecture.md | 55 - .../content/v1.12/learn-more/components.md | 120 - .../content/v1.12/learn-more/control-plane.md | 145 - .../v1.12/learn-more/controllers-resources.md | 230 - website/content/v1.12/learn-more/faqs.md | 72 - .../content/v1.12/learn-more/image-factory.md | 182 - .../v1.12/learn-more/knowledge-base.md | 98 - website/content/v1.12/learn-more/kubespan.md | 207 - .../v1.12/learn-more/networking-resources.md | 434 - .../content/v1.12/learn-more/philosophy.md | 110 - .../v1.12/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.12/learn-more/talosctl.md | 61 - website/content/v1.12/talos-guides/_index.md | 5 - .../talos-guides/configuration/_index.md | 5 - .../talos-guides/configuration/acquire.md | 101 - .../configuration/certificate-authorities.md | 28 - .../talos-guides/configuration/containerd.md | 101 - .../configuration/disk-encryption.md | 238 - .../configuration/disk-management/_index.md | 29 - .../configuration/disk-management/common.md | 136 - .../configuration/disk-management/existing.md | 48 - .../configuration/disk-management/layout.md | 159 - .../configuration/disk-management/raw.md | 75 - .../disk-management/resources.md | 164 - .../configuration/disk-management/system.md | 70 - .../configuration/disk-management/user.md | 101 - .../editing-machine-configuration.md | 157 - .../talos-guides/configuration/image-cache.md | 183 - .../talos-guides/configuration/insecure.md | 105 - .../talos-guides/configuration/logging.md | 435 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 158 - .../talos-guides/configuration/nvidia-gpu.md | 147 - .../talos-guides/configuration/patching.md | 324 - .../configuration/performance-tuning.md | 75 - .../configuration/pull-through-cache.md | 171 - .../v1.12/talos-guides/configuration/rbac.md | 52 - .../reproducible-machine-config.md | 49 - .../v1.12/talos-guides/configuration/swap.md | 136 - .../configuration/system-extensions.md | 123 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.12/talos-guides/discovery.md | 168 - .../v1.12/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.12/talos-guides/howto/scaling-down.md | 17 - .../v1.12/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 33 - .../v1.12/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/bootloader.md | 57 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 174 - .../bare-metal-platforms/network-config.md | 71 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 458 - .../v1.12/talos-guides/install/boot-assets.md | 566 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 164 - .../install/cloud-platforms/aws.md | 491 - .../install/cloud-platforms/azure.md | 296 - .../install/cloud-platforms/cloudstack.md | 228 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 425 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 325 - .../install/cloud-platforms/kubernetes.md | 103 - .../install/cloud-platforms/nocloud.md | 142 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 107 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 160 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 141 - .../install/local-platforms/qemu.md | 323 - .../install/local-platforms/virtualbox.md | 198 - .../v1.12/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../single-board-computers/orangepi_5.md | 109 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock5b.md | 72 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 375 - .../single-board-computers/turing_rk1.md | 136 - .../single-board-computers/unofficial.md | 20 - .../v1.12/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 92 - .../install/virtualized-platforms/kvm.md | 284 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 271 - .../virtualized-platforms/vagrant-libvirt.md | 283 - .../install/virtualized-platforms/vmware.md | 336 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 12 - .../interactive-dashboard/index.md | 77 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.12/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 73 - .../talos-guides/network/ethernet-config.md | 106 - .../v1.12/talos-guides/network/host-dns.md | 112 - .../talos-guides/network/ingress-firewall.md | 247 - .../v1.12/talos-guides/network/kubespan.md | 258 - .../v1.12/talos-guides/network/multihoming.md | 44 - .../network/predictable-interface-names.md | 38 - .../v1.12/talos-guides/network/siderolink.md | 39 - .../content/v1.12/talos-guides/network/vip.md | 131 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.12/talos-guides/resetting-a-machine.md | 44 - .../v1.12/talos-guides/upgrading-talos.md | 157 - website/content/v1.2/_index.md | 56 - website/content/v1.2/advanced/_index.md | 4 - .../v1.2/advanced/advanced-networking.md | 108 - website/content/v1.2/advanced/air-gapped.md | 167 - .../v1.2/advanced/customizing-the-kernel.md | 51 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.2/advanced/developing-talos.md | 301 - .../v1.2/advanced/disaster-recovery.md | 148 - .../v1.2/advanced/extension-services.md | 189 - .../v1.2/advanced/migrating-from-kubeadm.md | 136 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.2/advanced/static-pods.md | 100 - .../advanced/talos-api-access-from-k8s.md | 157 - .../advanced/troubleshooting-control-plane.md | 443 - website/content/v1.2/introduction/_index.md | 4 - .../v1.2/introduction/getting-started.md | 439 - .../content/v1.2/introduction/quickstart.md | 60 - .../v1.2/introduction/support-matrix.md | 53 - .../v1.2/introduction/system-requirements.md | 55 - website/content/v1.2/introduction/theila.md | 75 - .../content/v1.2/introduction/what-is-new.md | 319 - .../v1.2/introduction/what-is-talos.md | 28 - .../content/v1.2/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/discovery.md | 118 - .../configuration/pod-security.md | 170 - ...licated-local-storage-with-openebs-jiva.md | 194 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 141 - .../configuration/synology-csi.md | 259 - .../v1.2/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 209 - .../kubernetes-guides/network/kubespan.md | 190 - .../kubernetes-guides/upgrading-kubernetes.md | 349 - website/content/v1.2/learn-more/_index.md | 4 - .../content/v1.2/learn-more/architecture.md | 52 - website/content/v1.2/learn-more/components.md | 130 - website/content/v1.2/learn-more/concepts.md | 58 - .../content/v1.2/learn-more/control-plane.md | 145 - .../v1.2/learn-more/controllers-resources.md | 230 - website/content/v1.2/learn-more/discovery.md | 21 - website/content/v1.2/learn-more/faqs.md | 39 - .../content/v1.2/learn-more/knowledge-base.md | 98 - website/content/v1.2/learn-more/kubespan.md | 209 - .../v1.2/learn-more/networking-resources.md | 434 - website/content/v1.2/learn-more/philosophy.md | 73 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.2/learn-more/talosctl.md | 63 - website/content/v1.2/reference/_index.md | 4 - website/content/v1.2/reference/api.md | 3544 ------ website/content/v1.2/reference/cli.md | 2414 ---- .../content/v1.2/reference/configuration.md | 2924 ----- website/content/v1.2/reference/kernel.md | 183 - website/content/v1.2/reference/platform.md | 10 - website/content/v1.2/talos-guides/_index.md | 5 - .../v1.2/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 35 - .../configuration/disk-encryption.md | 183 - .../editing-machine-configuration.md | 155 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 51 - .../configuration/nvidia-fabricmanager.md | 38 - .../configuration/nvidia-gpu-proprietary.md | 221 - .../talos-guides/configuration/nvidia-gpu.md | 170 - .../talos-guides/configuration/patching.md | 253 - .../configuration/pull-through-cache.md | 113 - .../v1.2/talos-guides/configuration/rbac.md | 51 - .../configuration/system-extensions.md | 88 - .../v1.2/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 174 - .../bare-metal-platforms/equinix-metal.md | 185 - .../install/bare-metal-platforms/matchbox.md | 176 - .../install/bare-metal-platforms/sidero.md | 10 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 324 - .../install/cloud-platforms/azure.md | 294 - .../install/cloud-platforms/digitalocean.md | 159 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 127 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 55 - .../install/local-platforms/qemu.md | 301 - .../install/local-platforms/virtualbox.md | 192 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../install/single-board-computers/rpi_4.md | 111 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../install/virtualized-platforms/proxmox.md | 233 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../v1.2/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 54 - .../talos-guides/network/device-selector.md | 47 - .../content/v1.2/talos-guides/network/vip.md | 103 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.2/talos-guides/resetting-a-machine.md | 39 - .../v1.2/talos-guides/upgrading-talos.md | 174 - website/content/v1.3/_index.md | 56 - website/content/v1.3/advanced/_index.md | 4 - .../v1.3/advanced/advanced-networking.md | 108 - website/content/v1.3/advanced/air-gapped.md | 164 - .../v1.3/advanced/customizing-the-kernel.md | 51 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.3/advanced/developing-talos.md | 300 - .../v1.3/advanced/disaster-recovery.md | 148 - .../v1.3/advanced/extension-services.md | 192 - .../v1.3/advanced/migrating-from-kubeadm.md | 136 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.3/advanced/static-pods.md | 100 - .../advanced/talos-api-access-from-k8s.md | 157 - .../advanced/troubleshooting-control-plane.md | 443 - website/content/v1.3/introduction/_index.md | 4 - .../v1.3/introduction/getting-started.md | 466 - .../content/v1.3/introduction/quickstart.md | 54 - .../v1.3/introduction/support-matrix.md | 52 - .../v1.3/introduction/system-requirements.md | 71 - .../content/v1.3/introduction/what-is-new.md | 358 - .../v1.3/introduction/what-is-talos.md | 28 - .../content/v1.3/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/pod-security.md | 170 - ...licated-local-storage-with-openebs-jiva.md | 194 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 237 - .../configuration/synology-csi.md | 259 - .../v1.3/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 209 - .../kubernetes-guides/network/kubespan.md | 181 - .../kubernetes-guides/upgrading-kubernetes.md | 349 - website/content/v1.3/learn-more/_index.md | 4 - .../content/v1.3/learn-more/architecture.md | 56 - website/content/v1.3/learn-more/components.md | 120 - .../content/v1.3/learn-more/control-plane.md | 145 - .../v1.3/learn-more/controllers-resources.md | 230 - website/content/v1.3/learn-more/faqs.md | 39 - .../content/v1.3/learn-more/knowledge-base.md | 98 - website/content/v1.3/learn-more/kubespan.md | 209 - .../v1.3/learn-more/networking-resources.md | 434 - website/content/v1.3/learn-more/philosophy.md | 110 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.3/learn-more/talosctl.md | 62 - website/content/v1.3/reference/_index.md | 4 - website/content/v1.3/reference/api.md | 6612 ----------- website/content/v1.3/reference/cli.md | 2514 ----- .../content/v1.3/reference/configuration.md | 2979 ----- website/content/v1.3/reference/kernel.md | 214 - website/content/v1.3/talos-guides/_index.md | 5 - .../v1.3/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 188 - .../editing-machine-configuration.md | 159 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 72 - .../configuration/nvidia-fabricmanager.md | 38 - .../configuration/nvidia-gpu-proprietary.md | 221 - .../talos-guides/configuration/nvidia-gpu.md | 170 - .../talos-guides/configuration/patching.md | 330 - .../configuration/pull-through-cache.md | 171 - .../v1.3/talos-guides/configuration/rbac.md | 51 - .../configuration/system-extensions.md | 88 - .../content/v1.3/talos-guides/discovery.md | 155 - .../v1.3/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 185 - .../install/bare-metal-platforms/iso.md | 16 - .../install/bare-metal-platforms/matchbox.md | 176 - .../install/bare-metal-platforms/pxe.md | 37 - .../install/bare-metal-platforms/sidero.md | 10 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 324 - .../install/cloud-platforms/azure.md | 294 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 129 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 80 - .../install/local-platforms/qemu.md | 292 - .../install/local-platforms/virtualbox.md | 183 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../single-board-computers/nanopi_r4s.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../install/single-board-computers/rpi_4.md | 114 - .../single-board-computers/rpi_generic.md | 103 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../install/virtualized-platforms/proxmox.md | 224 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../v1.3/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 54 - .../talos-guides/network/device-selector.md | 47 - .../content/v1.3/talos-guides/network/vip.md | 96 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.3/talos-guides/resetting-a-machine.md | 39 - .../v1.3/talos-guides/upgrading-talos.md | 187 - website/content/v1.4/_index.md | 56 - website/content/v1.4/advanced/_index.md | 4 - .../v1.4/advanced/advanced-networking.md | 108 - website/content/v1.4/advanced/air-gapped.md | 164 - .../content/v1.4/advanced/building-images.md | 98 - .../v1.4/advanced/customizing-the-kernel.md | 51 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.4/advanced/developing-talos.md | 300 - .../v1.4/advanced/disaster-recovery.md | 148 - .../content/v1.4/advanced/etcd-maintenance.md | 76 - .../v1.4/advanced/extension-services.md | 192 - .../advanced/metal-network-configuration.md | 420 - .../v1.4/advanced/migrating-from-kubeadm.md | 136 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.4/advanced/static-pods.md | 100 - .../advanced/talos-api-access-from-k8s.md | 157 - .../advanced/troubleshooting-control-plane.md | 449 - .../content/v1.4/advanced/verifying-images.md | 37 - website/content/v1.4/introduction/_index.md | 4 - .../v1.4/introduction/getting-started.md | 466 - .../content/v1.4/introduction/quickstart.md | 60 - .../v1.4/introduction/support-matrix.md | 52 - .../v1.4/introduction/system-requirements.md | 71 - .../v1.4/introduction/what-is-new/index.md | 170 - .../what-is-new/interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../what-is-new/talos-dashboard.png | Bin 390343 -> 0 bytes .../v1.4/introduction/what-is-talos.md | 28 - .../content/v1.4/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/azure-ccm-csi.md | 227 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/pod-security.md | 170 - ...licated-local-storage-with-openebs-jiva.md | 214 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 249 - .../configuration/synology-csi.md | 259 - .../v1.4/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 296 - .../kubernetes-guides/network/kubespan.md | 181 - .../kubernetes-guides/upgrading-kubernetes.md | 352 - website/content/v1.4/learn-more/_index.md | 4 - .../content/v1.4/learn-more/architecture.md | 56 - website/content/v1.4/learn-more/components.md | 120 - .../content/v1.4/learn-more/control-plane.md | 145 - .../v1.4/learn-more/controllers-resources.md | 230 - website/content/v1.4/learn-more/faqs.md | 39 - .../content/v1.4/learn-more/knowledge-base.md | 98 - website/content/v1.4/learn-more/kubespan.md | 209 - .../v1.4/learn-more/networking-resources.md | 434 - website/content/v1.4/learn-more/philosophy.md | 110 - .../v1.4/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.4/learn-more/talosctl.md | 62 - website/content/v1.4/reference/_index.md | 4 - website/content/v1.4/reference/api.md | 7275 ------------ website/content/v1.4/reference/cli.md | 2841 ----- .../content/v1.4/reference/configuration.md | 3044 ------ website/content/v1.4/reference/kernel.md | 238 - .../v1.4/schemas/v1alpha1_config.schema.json | 2716 ----- website/content/v1.4/talos-guides/_index.md | 5 - .../v1.4/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 188 - .../editing-machine-configuration.md | 159 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 72 - .../configuration/nvidia-fabricmanager.md | 38 - .../configuration/nvidia-gpu-proprietary.md | 275 - .../talos-guides/configuration/nvidia-gpu.md | 161 - .../talos-guides/configuration/patching.md | 331 - .../configuration/pull-through-cache.md | 171 - .../v1.4/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 88 - .../content/v1.4/talos-guides/discovery.md | 155 - .../content/v1.4/talos-guides/howto/_index.md | 5 - .../v1.4/talos-guides/howto/scaling-down.md | 17 - .../v1.4/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 30 - .../v1.4/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 185 - .../install/bare-metal-platforms/iso.md | 16 - .../install/bare-metal-platforms/matchbox.md | 176 - .../bare-metal-platforms/network-config.md | 65 - .../install/bare-metal-platforms/pxe.md | 37 - .../install/bare-metal-platforms/sidero.md | 10 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 324 - .../install/cloud-platforms/azure.md | 294 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 129 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 80 - .../install/local-platforms/qemu.md | 292 - .../install/local-platforms/virtualbox.md | 183 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../single-board-computers/nanopi_r4s.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../install/single-board-computers/rpi_4.md | 114 - .../single-board-computers/rpi_generic.md | 103 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../install/virtualized-platforms/proxmox.md | 233 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.4/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 54 - .../talos-guides/network/device-selector.md | 66 - .../content/v1.4/talos-guides/network/vip.md | 96 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.4/talos-guides/resetting-a-machine.md | 39 - .../v1.4/talos-guides/upgrading-talos.md | 164 - website/content/v1.5/_index.md | 55 - website/content/v1.5/advanced/_index.md | 4 - .../v1.5/advanced/advanced-networking.md | 108 - website/content/v1.5/advanced/air-gapped.md | 164 - .../content/v1.5/advanced/building-images.md | 98 - .../v1.5/advanced/customizing-the-kernel.md | 54 - .../customizing-the-root-filesystem.md | 63 - .../content/v1.5/advanced/developing-talos.md | 334 - .../v1.5/advanced/disaster-recovery.md | 148 - .../content/v1.5/advanced/etcd-maintenance.md | 76 - .../v1.5/advanced/extension-services.md | 195 - .../advanced/metal-network-configuration.md | 420 - .../v1.5/advanced/migrating-from-kubeadm.md | 150 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.5/advanced/static-pods.md | 100 - .../advanced/talos-api-access-from-k8s.md | 157 - .../advanced/troubleshooting-control-plane.md | 449 - .../content/v1.5/advanced/verifying-images.md | 37 - website/content/v1.5/introduction/_index.md | 4 - .../v1.5/introduction/getting-started.md | 308 - .../content/v1.5/introduction/prodnotes.md | 366 - .../content/v1.5/introduction/quickstart.md | 60 - .../v1.5/introduction/support-matrix.md | 52 - .../v1.5/introduction/system-requirements.md | 71 - .../v1.5/introduction/what-is-new/index.md | 169 - .../v1.5/introduction/what-is-talos.md | 28 - .../content/v1.5/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/cluster-endpoint.md | 47 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/kubeprism.md | 61 - .../configuration/pod-security.md | 170 - ...licated-local-storage-with-openebs-jiva.md | 220 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 196 - .../configuration/synology-csi.md | 259 - .../v1.5/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 318 - .../kubernetes-guides/upgrading-kubernetes.md | 352 - website/content/v1.5/learn-more/_index.md | 4 - .../content/v1.5/learn-more/architecture.md | 56 - website/content/v1.5/learn-more/components.md | 120 - .../content/v1.5/learn-more/control-plane.md | 145 - .../v1.5/learn-more/controllers-resources.md | 230 - website/content/v1.5/learn-more/faqs.md | 55 - .../content/v1.5/learn-more/image-factory.md | 177 - .../content/v1.5/learn-more/knowledge-base.md | 98 - website/content/v1.5/learn-more/kubespan.md | 207 - .../v1.5/learn-more/networking-resources.md | 434 - website/content/v1.5/learn-more/philosophy.md | 110 - .../v1.5/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.5/learn-more/talosctl.md | 62 - website/content/v1.5/reference/_index.md | 4 - website/content/v1.5/reference/api.md | 7524 ------------- website/content/v1.5/reference/cli.md | 3064 ------ .../content/v1.5/reference/configuration.md | 3153 ------ website/content/v1.5/reference/kernel.md | 242 - .../v1.5/schemas/v1alpha1_config.schema.json | 2823 ----- website/content/v1.5/talos-guides/_index.md | 5 - .../v1.5/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 188 - .../editing-machine-configuration.md | 159 - .../talos-guides/configuration/logging.md | 404 - .../configuration/managing-pki.md | 72 - .../configuration/nvidia-fabricmanager.md | 38 - .../configuration/nvidia-gpu-proprietary.md | 184 - .../talos-guides/configuration/nvidia-gpu.md | 161 - .../talos-guides/configuration/patching.md | 340 - .../configuration/pull-through-cache.md | 171 - .../v1.5/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 105 - .../content/v1.5/talos-guides/discovery.md | 155 - .../content/v1.5/talos-guides/howto/_index.md | 5 - .../v1.5/talos-guides/howto/scaling-down.md | 17 - .../v1.5/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 30 - .../v1.5/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 185 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 176 - .../bare-metal-platforms/network-config.md | 65 - .../install/bare-metal-platforms/pxe.md | 37 - .../bare-metal-platforms/secureboot.md | 249 - .../v1.5/talos-guides/install/boot-assets.md | 269 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 333 - .../install/cloud-platforms/azure.md | 306 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 248 - .../install/cloud-platforms/nocloud.md | 129 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 151 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 80 - .../install/local-platforms/qemu.md | 292 - .../install/local-platforms/virtualbox.md | 183 - .../content/v1.5/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../single-board-computers/nanopi_r4s.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../single-board-computers/rpi_generic.md | 103 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../install/virtualized-platforms/proxmox.md | 233 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 104 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.5/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 66 - .../v1.5/talos-guides/network/kubespan.md | 222 - .../network/predictable-interface-names.md | 38 - .../content/v1.5/talos-guides/network/vip.md | 111 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.5/talos-guides/resetting-a-machine.md | 39 - .../v1.5/talos-guides/upgrading-talos.md | 171 - website/content/v1.6/_index.md | 54 - website/content/v1.6/advanced/_index.md | 4 - .../v1.6/advanced/advanced-networking.md | 108 - website/content/v1.6/advanced/air-gapped.md | 164 - .../content/v1.6/advanced/building-images.md | 118 - .../v1.6/advanced/customizing-the-kernel.md | 95 - .../content/v1.6/advanced/developing-talos.md | 334 - .../v1.6/advanced/disaster-recovery.md | 148 - .../content/v1.6/advanced/egress-domains.md | 44 - .../content/v1.6/advanced/etcd-maintenance.md | 76 - .../v1.6/advanced/extension-services.md | 198 - .../v1.6/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.6/advanced/migrating-from-kubeadm.md | 150 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.6/advanced/static-pods.md | 100 - .../advanced/talos-api-access-from-k8s.md | 157 - .../content/v1.6/advanced/verifying-images.md | 37 - website/content/v1.6/introduction/_index.md | 4 - .../v1.6/introduction/getting-started.md | 310 - .../content/v1.6/introduction/prodnotes.md | 369 - .../content/v1.6/introduction/quickstart.md | 60 - .../v1.6/introduction/support-matrix.md | 52 - .../v1.6/introduction/system-requirements.md | 71 - .../v1.6/introduction/troubleshooting.md | 426 - .../v1.6/introduction/what-is-new/index.md | 138 - .../v1.6/introduction/what-is-talos.md | 28 - .../content/v1.6/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/kubeprism.md | 51 - .../configuration/local-storage.md | 83 - .../configuration/pod-security.md | 178 - ...licated-local-storage-with-openebs-jiva.md | 203 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 196 - .../configuration/synology-csi.md | 259 - .../v1.6/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 295 - .../kubernetes-guides/upgrading-kubernetes.md | 354 - website/content/v1.6/learn-more/_index.md | 4 - .../content/v1.6/learn-more/architecture.md | 56 - website/content/v1.6/learn-more/components.md | 120 - .../content/v1.6/learn-more/control-plane.md | 145 - .../v1.6/learn-more/controllers-resources.md | 230 - website/content/v1.6/learn-more/faqs.md | 72 - .../content/v1.6/learn-more/image-factory.md | 177 - .../content/v1.6/learn-more/knowledge-base.md | 98 - website/content/v1.6/learn-more/kubespan.md | 207 - .../v1.6/learn-more/networking-resources.md | 434 - website/content/v1.6/learn-more/philosophy.md | 110 - .../v1.6/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.6/learn-more/talosctl.md | 62 - website/content/v1.6/reference/_index.md | 4 - website/content/v1.6/reference/api.md | 7867 ------------- website/content/v1.6/reference/cli.md | 3072 ------ .../v1.6/reference/configuration/_index.md | 28 - .../reference/configuration/network/_index.md | 8 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 33 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 3771 ------- website/content/v1.6/reference/kernel.md | 246 - .../content/v1.6/schemas/config.schema.json | 3212 ------ .../v1.6/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.6/talos-guides/_index.md | 5 - .../v1.6/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 196 - .../editing-machine-configuration.md | 157 - .../talos-guides/configuration/logging.md | 413 - .../configuration/managing-pki.md | 72 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 147 - .../talos-guides/configuration/nvidia-gpu.md | 146 - .../talos-guides/configuration/patching.md | 342 - .../configuration/pull-through-cache.md | 171 - .../v1.6/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 106 - .../content/v1.6/talos-guides/discovery.md | 158 - .../content/v1.6/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 14 - .../v1.6/talos-guides/howto/scaling-down.md | 17 - .../v1.6/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 19 - .../v1.6/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 176 - .../bare-metal-platforms/network-config.md | 66 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 251 - .../v1.6/talos-guides/install/boot-assets.md | 332 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/aws.md | 333 - .../install/cloud-platforms/azure.md | 306 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 274 - .../install/cloud-platforms/nocloud.md | 137 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 195 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 158 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 80 - .../install/local-platforms/qemu.md | 292 - .../install/local-platforms/virtualbox.md | 183 - .../content/v1.6/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 59 - .../single-board-computers/jetson_nano.md | 119 - .../libretech_all_h3_cc_h5.md | 59 - .../single-board-computers/nanopi_r4s.md | 59 - .../install/single-board-computers/pine64.md | 59 - .../install/single-board-computers/rock64.md | 59 - .../single-board-computers/rockpi_4.md | 98 - .../single-board-computers/rockpi_4c.md | 96 - .../single-board-computers/rpi_generic.md | 103 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../install/virtualized-platforms/proxmox.md | 233 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 12 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.6/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 59 - .../talos-guides/network/ingress-firewall.md | 234 - .../v1.6/talos-guides/network/kubespan.md | 222 - .../network/predictable-interface-names.md | 38 - .../content/v1.6/talos-guides/network/vip.md | 109 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.6/talos-guides/resetting-a-machine.md | 39 - .../v1.6/talos-guides/upgrading-talos.md | 182 - website/content/v1.7/_index.md | 55 - website/content/v1.7/advanced/_index.md | 4 - .../v1.7/advanced/advanced-networking.md | 108 - website/content/v1.7/advanced/air-gapped.md | 164 - .../content/v1.7/advanced/building-images.md | 119 - website/content/v1.7/advanced/ca-rotation.md | 187 - .../v1.7/advanced/customizing-the-kernel.md | 95 - .../content/v1.7/advanced/developing-talos.md | 334 - .../v1.7/advanced/disaster-recovery.md | 148 - .../content/v1.7/advanced/egress-domains.md | 44 - .../content/v1.7/advanced/etcd-maintenance.md | 76 - .../v1.7/advanced/extension-services.md | 201 - .../v1.7/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.7/advanced/migrating-from-kubeadm.md | 150 - website/content/v1.7/advanced/overlays.md | 45 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.7/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../content/v1.7/advanced/verifying-images.md | 37 - website/content/v1.7/advanced/watchdog.md | 69 - website/content/v1.7/introduction/_index.md | 4 - .../v1.7/introduction/getting-started.md | 312 - .../content/v1.7/introduction/prodnotes.md | 368 - .../content/v1.7/introduction/quickstart.md | 60 - .../v1.7/introduction/support-matrix.md | 54 - .../v1.7/introduction/system-requirements.md | 71 - .../v1.7/introduction/troubleshooting.md | 432 - .../v1.7/introduction/what-is-new/index.md | 214 - .../v1.7/introduction/what-is-talos.md | 28 - .../content/v1.7/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 281 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/kubeprism.md | 51 - .../configuration/local-storage.md | 83 - .../configuration/pod-security.md | 178 - ...licated-local-storage-with-openebs-jiva.md | 203 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 196 - .../configuration/synology-csi.md | 259 - .../v1.7/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 394 - .../v1.7/kubernetes-guides/network/multus.md | 143 - .../kubernetes-guides/upgrading-kubernetes.md | 387 - website/content/v1.7/learn-more/_index.md | 4 - .../content/v1.7/learn-more/architecture.md | 56 - website/content/v1.7/learn-more/components.md | 120 - .../content/v1.7/learn-more/control-plane.md | 145 - .../v1.7/learn-more/controllers-resources.md | 230 - website/content/v1.7/learn-more/faqs.md | 72 - .../content/v1.7/learn-more/image-factory.md | 182 - .../content/v1.7/learn-more/knowledge-base.md | 98 - website/content/v1.7/learn-more/kubespan.md | 207 - .../v1.7/learn-more/networking-resources.md | 434 - website/content/v1.7/learn-more/philosophy.md | 110 - .../v1.7/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.7/learn-more/talosctl.md | 62 - website/content/v1.7/reference/_index.md | 4 - website/content/v1.7/reference/api.md | 8138 -------------- website/content/v1.7/reference/cli.md | 3127 ------ .../v1.7/reference/configuration/_index.md | 28 - .../configuration/extensions/_index.md | 8 - .../extensions/extensionserviceconfig.md | 57 - .../reference/configuration/network/_index.md | 8 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../runtime/watchdogtimerconfig.md | 35 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 33 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 3795 ------- website/content/v1.7/reference/kernel.md | 247 - .../content/v1.7/schemas/config.schema.json | 3416 ------ .../v1.7/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.7/talos-guides/_index.md | 5 - .../v1.7/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 23 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 196 - .../editing-machine-configuration.md | 159 - .../talos-guides/configuration/logging.md | 429 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 147 - .../talos-guides/configuration/nvidia-gpu.md | 146 - .../talos-guides/configuration/patching.md | 342 - .../configuration/pull-through-cache.md | 171 - .../v1.7/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 106 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.7/talos-guides/discovery.md | 158 - .../content/v1.7/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.7/talos-guides/howto/scaling-down.md | 17 - .../v1.7/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 19 - .../v1.7/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/digital-rebar.md | 172 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 176 - .../bare-metal-platforms/network-config.md | 66 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 251 - .../v1.7/talos-guides/install/boot-assets.md | 487 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 159 - .../install/cloud-platforms/aws.md | 487 - .../install/cloud-platforms/azure.md | 306 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 426 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 274 - .../install/cloud-platforms/kubernetes.md | 105 - .../install/cloud-platforms/nocloud.md | 137 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 158 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 131 - .../install/local-platforms/qemu.md | 294 - .../install/local-platforms/virtualbox.md | 185 - .../content/v1.7/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 113 - .../v1.7/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 272 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 313 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.7/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 69 - .../v1.7/talos-guides/network/host-dns.md | 117 - .../talos-guides/network/ingress-firewall.md | 243 - .../v1.7/talos-guides/network/kubespan.md | 222 - .../network/predictable-interface-names.md | 38 - .../v1.7/talos-guides/network/siderolink.md | 36 - .../content/v1.7/talos-guides/network/vip.md | 109 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.7/talos-guides/resetting-a-machine.md | 39 - .../v1.7/talos-guides/upgrading-talos.md | 203 - website/content/v1.8/_index.md | 55 - website/content/v1.8/advanced/_index.md | 4 - .../v1.8/advanced/advanced-networking.md | 108 - website/content/v1.8/advanced/air-gapped.md | 164 - .../content/v1.8/advanced/building-images.md | 119 - website/content/v1.8/advanced/ca-rotation.md | 187 - .../v1.8/advanced/customizing-the-kernel.md | 95 - .../content/v1.8/advanced/developing-talos.md | 334 - .../v1.8/advanced/disaster-recovery.md | 148 - .../content/v1.8/advanced/egress-domains.md | 44 - .../content/v1.8/advanced/etcd-maintenance.md | 76 - .../v1.8/advanced/extension-services.md | 208 - .../content/v1.8/advanced/install-kubevirt.md | 538 - .../v1.8/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.8/advanced/migrating-from-kubeadm.md | 150 - website/content/v1.8/advanced/overlays.md | 113 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.8/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../content/v1.8/advanced/verifying-images.md | 37 - website/content/v1.8/advanced/watchdog.md | 69 - website/content/v1.8/introduction/_index.md | 4 - .../v1.8/introduction/getting-started.md | 319 - .../content/v1.8/introduction/prodnotes.md | 368 - .../content/v1.8/introduction/quickstart.md | 62 - .../v1.8/introduction/support-matrix.md | 56 - .../v1.8/introduction/system-requirements.md | 71 - .../v1.8/introduction/troubleshooting.md | 432 - .../v1.8/introduction/what-is-new/index.md | 218 - .../v1.8/introduction/what-is-talos.md | 28 - .../content/v1.8/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 287 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/device-plugins.md | 145 - .../configuration/kubeprism.md | 51 - .../configuration/local-storage.md | 101 - .../configuration/pod-security.md | 178 - .../replicated-local-storage-with-openebs.md | 143 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 200 - .../configuration/synology-csi.md | 259 - .../v1.8/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 408 - .../v1.8/kubernetes-guides/network/multus.md | 175 - .../kubernetes-guides/upgrading-kubernetes.md | 387 - website/content/v1.8/learn-more/_index.md | 4 - .../content/v1.8/learn-more/architecture.md | 55 - website/content/v1.8/learn-more/components.md | 120 - .../content/v1.8/learn-more/control-plane.md | 145 - .../v1.8/learn-more/controllers-resources.md | 230 - website/content/v1.8/learn-more/faqs.md | 72 - .../content/v1.8/learn-more/image-factory.md | 182 - .../content/v1.8/learn-more/knowledge-base.md | 98 - website/content/v1.8/learn-more/kubespan.md | 207 - .../v1.8/learn-more/networking-resources.md | 434 - website/content/v1.8/learn-more/philosophy.md | 110 - .../v1.8/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.8/learn-more/talosctl.md | 62 - website/content/v1.8/reference/_index.md | 4 - website/content/v1.8/reference/api.md | 8617 --------------- website/content/v1.8/reference/cli.md | 3129 ------ .../v1.8/reference/configuration/_index.md | 28 - .../reference/configuration/block/_index.md | 8 - .../configuration/block/volumeconfig.md | 84 - .../configuration/extensions/_index.md | 8 - .../extensions/extensionserviceconfig.md | 57 - .../reference/configuration/network/_index.md | 8 - .../network/kubespanendpointsconfig.md | 33 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../runtime/watchdogtimerconfig.md | 35 - .../configuration/security/_index.md | 8 - .../security/trustedrootsconfig.md | 36 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 33 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 3824 ------- website/content/v1.8/reference/kernel.md | 279 - .../content/v1.8/schemas/config.schema.json | 3635 ------ .../v1.8/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.8/talos-guides/_index.md | 5 - .../v1.8/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 25 - .../talos-guides/configuration/containerd.md | 65 - .../configuration/disk-encryption.md | 198 - .../configuration/disk-management.md | 280 - .../editing-machine-configuration.md | 163 - .../talos-guides/configuration/logging.md | 429 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 158 - .../talos-guides/configuration/nvidia-gpu.md | 157 - .../talos-guides/configuration/patching.md | 394 - .../configuration/performance-tuning.md | 75 - .../configuration/pull-through-cache.md | 171 - .../v1.8/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 106 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.8/talos-guides/discovery.md | 158 - .../content/v1.8/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.8/talos-guides/howto/scaling-down.md | 17 - .../v1.8/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 19 - .../v1.8/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 174 - .../bare-metal-platforms/network-config.md | 66 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 251 - .../v1.8/talos-guides/install/boot-assets.md | 487 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 159 - .../install/cloud-platforms/aws.md | 491 - .../install/cloud-platforms/azure.md | 306 - .../install/cloud-platforms/cloudstack.md | 228 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 425 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 323 - .../install/cloud-platforms/kubernetes.md | 103 - .../install/cloud-platforms/nocloud.md | 137 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 160 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 131 - .../install/local-platforms/qemu.md | 294 - .../install/local-platforms/virtualbox.md | 183 - .../content/v1.8/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 113 - .../v1.8/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 85 - .../install/virtualized-platforms/kvm.md | 12 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 270 - .../virtualized-platforms/vagrant-libvirt.md | 282 - .../install/virtualized-platforms/vmware.md | 315 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.8/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 69 - .../v1.8/talos-guides/network/host-dns.md | 112 - .../talos-guides/network/ingress-firewall.md | 243 - .../v1.8/talos-guides/network/kubespan.md | 231 - .../network/predictable-interface-names.md | 38 - .../v1.8/talos-guides/network/siderolink.md | 36 - .../content/v1.8/talos-guides/network/vip.md | 109 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.8/talos-guides/resetting-a-machine.md | 39 - .../v1.8/talos-guides/upgrading-talos.md | 168 - website/content/v1.9/_index.md | 55 - website/content/v1.9/advanced/_index.md | 4 - .../v1.9/advanced/advanced-networking.md | 108 - website/content/v1.9/advanced/air-gapped.md | 164 - .../content/v1.9/advanced/building-images.md | 119 - website/content/v1.9/advanced/ca-rotation.md | 187 - .../content/v1.9/advanced/cgroups-analysis.md | 285 - .../v1.9/advanced/customizing-the-kernel.md | 95 - .../content/v1.9/advanced/developing-talos.md | 337 - .../v1.9/advanced/disaster-recovery.md | 148 - .../content/v1.9/advanced/egress-domains.md | 44 - .../content/v1.9/advanced/etcd-maintenance.md | 76 - .../v1.9/advanced/extension-services.md | 208 - .../content/v1.9/advanced/install-kubevirt.md | 538 - .../v1.9/advanced/machine-config-oauth.md | 83 - .../advanced/metal-network-configuration.md | 420 - .../v1.9/advanced/migrating-from-kubeadm.md | 150 - .../content/v1.9/advanced/oci-base-spec.md | 49 - website/content/v1.9/advanced/overlays.md | 113 - .../advanced/proprietary-kernel-modules.md | 65 - website/content/v1.9/advanced/static-pods.md | 102 - .../advanced/talos-api-access-from-k8s.md | 157 - .../content/v1.9/advanced/verifying-images.md | 37 - website/content/v1.9/advanced/watchdog.md | 69 - website/content/v1.9/introduction/_index.md | 4 - .../v1.9/introduction/getting-started.md | 323 - .../content/v1.9/introduction/prodnotes.md | 368 - .../content/v1.9/introduction/quickstart.md | 62 - .../v1.9/introduction/support-matrix.md | 58 - .../v1.9/introduction/system-requirements.md | 71 - .../v1.9/introduction/troubleshooting.md | 432 - .../v1.9/introduction/what-is-new/index.md | 226 - .../v1.9/introduction/what-is-talos.md | 28 - .../content/v1.9/kubernetes-guides/_index.md | 5 - .../kubernetes-guides/configuration/_index.md | 5 - .../configuration/ceph-with-rook.md | 287 - .../configuration/deploy-metrics-server.md | 45 - .../configuration/device-plugins.md | 145 - .../configuration/kubeprism.md | 58 - .../configuration/local-storage.md | 101 - .../configuration/pod-security.md | 178 - .../configuration/seccomp-profiles.md | 118 - .../configuration/storage.md | 232 - .../configuration/synology-csi.md | 259 - .../configuration/usernamespace.md | 30 - .../v1.9/kubernetes-guides/network/_index.md | 5 - .../network/deploying-cilium.md | 437 - .../v1.9/kubernetes-guides/network/multus.md | 200 - .../kubernetes-guides/upgrading-kubernetes.md | 387 - website/content/v1.9/learn-more/_index.md | 4 - .../content/v1.9/learn-more/architecture.md | 55 - website/content/v1.9/learn-more/components.md | 120 - .../content/v1.9/learn-more/control-plane.md | 145 - .../v1.9/learn-more/controllers-resources.md | 230 - website/content/v1.9/learn-more/faqs.md | 72 - .../content/v1.9/learn-more/image-factory.md | 182 - .../content/v1.9/learn-more/knowledge-base.md | 98 - website/content/v1.9/learn-more/kubespan.md | 207 - .../v1.9/learn-more/networking-resources.md | 434 - website/content/v1.9/learn-more/philosophy.md | 110 - .../v1.9/learn-more/process-capabilities.md | 23 - .../learn-more/talos-network-connectivity.md | 74 - website/content/v1.9/learn-more/talosctl.md | 62 - website/content/v1.9/reference/_index.md | 4 - website/content/v1.9/reference/api.md | 9009 --------------- website/content/v1.9/reference/cli.md | 3264 ------ .../v1.9/reference/configuration/_index.md | 28 - .../reference/configuration/block/_index.md | 8 - .../configuration/block/volumeconfig.md | 84 - .../configuration/extensions/_index.md | 8 - .../extensions/extensionserviceconfig.md | 57 - .../reference/configuration/network/_index.md | 8 - .../network/kubespanendpointsconfig.md | 33 - .../network/networkdefaultactionconfig.md | 31 - .../network/networkruleconfig.md | 90 - .../reference/configuration/runtime/_index.md | 8 - .../configuration/runtime/eventsinkconfig.md | 33 - .../configuration/runtime/kmsglogconfig.md | 35 - .../runtime/watchdogtimerconfig.md | 35 - .../configuration/security/_index.md | 8 - .../security/trustedrootsconfig.md | 36 - .../configuration/siderolink/_index.md | 8 - .../siderolink/siderolinkconfig.md | 33 - .../configuration/v1alpha1/_index.md | 14 - .../configuration/v1alpha1/config.md | 4035 ------- website/content/v1.9/reference/kernel.md | 288 - .../content/v1.9/schemas/config.schema.json | 3750 ------- .../v1.9/schemas/v1alpha1_config.schema.json | 2931 ----- website/content/v1.9/talos-guides/_index.md | 5 - .../v1.9/talos-guides/configuration/_index.md | 5 - .../configuration/certificate-authorities.md | 28 - .../talos-guides/configuration/containerd.md | 101 - .../configuration/disk-encryption.md | 199 - .../configuration/disk-management.md | 282 - .../editing-machine-configuration.md | 165 - .../talos-guides/configuration/image-cache.md | 160 - .../talos-guides/configuration/logging.md | 432 - .../configuration/nvidia-fabricmanager.md | 37 - .../configuration/nvidia-gpu-proprietary.md | 158 - .../talos-guides/configuration/nvidia-gpu.md | 157 - .../talos-guides/configuration/patching.md | 394 - .../configuration/performance-tuning.md | 75 - .../configuration/pull-through-cache.md | 171 - .../v1.9/talos-guides/configuration/rbac.md | 52 - .../configuration/system-extensions.md | 106 - .../talos-guides/configuration/time-sync.md | 97 - .../content/v1.9/talos-guides/discovery.md | 168 - .../content/v1.9/talos-guides/howto/_index.md | 5 - .../talos-guides/howto/cert-management.md | 75 - .../v1.9/talos-guides/howto/scaling-down.md | 17 - .../v1.9/talos-guides/howto/scaling-up.md | 27 - .../howto/workers-on-controlplane.md | 19 - .../v1.9/talos-guides/install/_index.md | 5 - .../install/bare-metal-platforms/_index.md | 5 - .../bare-metal-platforms/equinix-metal.md | 144 - .../install/bare-metal-platforms/iso.md | 21 - .../install/bare-metal-platforms/matchbox.md | 174 - .../bare-metal-platforms/network-config.md | 71 - .../install/bare-metal-platforms/pxe.md | 39 - .../bare-metal-platforms/secureboot.md | 251 - .../v1.9/talos-guides/install/boot-assets.md | 488 - .../install/cloud-platforms/_index.md | 5 - .../install/cloud-platforms/akamai.md | 159 - .../install/cloud-platforms/aws.md | 491 - .../install/cloud-platforms/azure.md | 306 - .../install/cloud-platforms/cloudstack.md | 228 - .../install/cloud-platforms/digitalocean.md | 172 - .../install/cloud-platforms/exoscale.md | 8 - .../install/cloud-platforms/gcp.md | 425 - .../install/cloud-platforms/gcp/config.yaml | 21 - .../install/cloud-platforms/gcp/gcp-ccm.yaml | 276 - .../cloud-platforms/gcp/talos-ha.jinja | 282 - .../install/cloud-platforms/hetzner.md | 325 - .../install/cloud-platforms/kubernetes.md | 103 - .../install/cloud-platforms/nocloud.md | 142 - .../install/cloud-platforms/openstack.md | 148 - .../install/cloud-platforms/oracle.md | 261 - .../install/cloud-platforms/scaleway.md | 8 - .../install/cloud-platforms/upcloud.md | 246 - .../install/cloud-platforms/vultr.md | 160 - .../install/local-platforms/_index.md | 5 - .../install/local-platforms/docker.md | 131 - .../install/local-platforms/qemu.md | 294 - .../install/local-platforms/virtualbox.md | 191 - .../content/v1.9/talos-guides/install/omni.md | 27 - .../install/single-board-computers/_index.md | 5 - .../single-board-computers/bananapi_m64.md | 70 - .../single-board-computers/jetson_nano.md | 130 - .../libretech_all_h3_cc_h5.md | 72 - .../single-board-computers/nanopi_r4s.md | 70 - .../single-board-computers/orangepi_5.md | 109 - .../orangepi_r1_plus_lts.md | 68 - .../install/single-board-computers/pine64.md | 70 - .../single-board-computers/rock4cplus.md | 76 - .../install/single-board-computers/rock5b.md | 72 - .../install/single-board-computers/rock64.md | 70 - .../single-board-computers/rockpi_4.md | 88 - .../single-board-computers/rockpi_4c.md | 86 - .../single-board-computers/rpi_generic.md | 113 - .../single-board-computers/turing_rk1.md | 136 - .../single-board-computers/unofficial.md | 20 - .../v1.9/talos-guides/install/talosctl.md | 39 - .../install/virtualized-platforms/_index.md | 5 - .../install/virtualized-platforms/hyper-v.md | 92 - .../install/virtualized-platforms/kvm.md | 12 - .../virtualized-platforms/opennebula.md | 5 - .../install/virtualized-platforms/proxmox.md | 271 - .../virtualized-platforms/vagrant-libvirt.md | 283 - .../install/virtualized-platforms/vmware.md | 337 - .../vmware/cp.patch.yaml | 8 - .../virtualized-platforms/vmware/vmware.sh | 120 - .../install/virtualized-platforms/xen.md | 9 - .../interactive-dashboard/index.md | 70 - .../interactive-dashboard-1.png | Bin 275479 -> 0 bytes .../interactive-dashboard-2.png | Bin 91579 -> 0 bytes .../interactive-dashboard-3.png | Bin 81872 -> 0 bytes .../v1.9/talos-guides/network/_index.md | 5 - .../talos-guides/network/corporate-proxies.md | 60 - .../talos-guides/network/device-selector.md | 73 - .../v1.9/talos-guides/network/host-dns.md | 112 - .../talos-guides/network/ingress-firewall.md | 245 - .../v1.9/talos-guides/network/kubespan.md | 231 - .../network/predictable-interface-names.md | 38 - .../v1.9/talos-guides/network/siderolink.md | 39 - .../content/v1.9/talos-guides/network/vip.md | 109 - .../talos-guides/network/wireguard-network.md | 104 - .../v1.9/talos-guides/resetting-a-machine.md | 44 - .../v1.9/talos-guides/upgrading-talos.md | 167 - website/go.mod | 5 - website/go.sum | 4 - website/hugo.toml | 258 - website/layouts/404.html | 10 - .../_default/_markup/render-codeblock.html | 13 - website/layouts/index.netlify_redirect | 17 - .../layouts/partials/doc_latest_version.html | 10 - website/layouts/partials/hooks/body-end.html | 56 - website/layouts/partials/hooks/head-end.html | 13 - website/layouts/partials/version-banner.html | 28 - .../iscsi_tools_system_extension_release.html | 1 - .../layouts/shortcodes/k8s_prev_release.html | 1 - website/layouts/shortcodes/k8s_release.html | 1 - .../nvidia_container_toolkit_release.html | 1 - .../shortcodes/nvidia_driver_release.html | 1 - website/layouts/shortcodes/release.html | 1 - .../layouts/shortcodes/release_branch.html | 3 - .../shortcodes/release_version_trimmed.html | 1 - .../layouts/shortcodes/theila_release.html | 1 - website/layouts/shortcodes/version.html | 2 - website/layouts/sitemap.xml | 12 - website/package-lock.json | 851 -- website/package.json | 7 - website/static/css/clipboard.css | 67 - .../favicons/android-chrome-192x192.png | Bin 16623 -> 0 bytes .../favicons/android-chrome-512x512.png | Bin 55876 -> 0 bytes .../android-chrome-maskable-192x192.png | Bin 9161 -> 0 bytes .../android-chrome-maskable-512x512.png | Bin 26037 -> 0 bytes website/static/favicons/apple-touch-icon.png | Bin 14969 -> 0 bytes website/static/favicons/favicon-16x16.png | Bin 778 -> 0 bytes website/static/favicons/favicon-32x32.png | Bin 1860 -> 0 bytes website/static/favicons/favicon.ico | Bin 15406 -> 0 bytes website/static/images/Git-Icon-Black.png | Bin 2383 -> 0 bytes .../images/Sidero_stacked_darkbkgd_RGB.png | Bin 27079 -> 0 bytes .../images/Sidero_stacked_darkbkgd_RGB.svg | 1 - ...Horizontal_Logo_FullColor_RGB-for-site.svg | 1 - website/static/images/arges-arch.png | Bin 42718 -> 0 bytes .../images/certified-kubernetes-color.png | Bin 36536 -> 0 bytes website/static/images/cncf-color.png | Bin 24610 -> 0 bytes website/static/images/components.drawio.svg | 4 - .../images/controller-dependencies-v2.png | Bin 163519 -> 0 bytes ...troller-dependencies-with-resources-v2.png | Bin 597132 -> 0 bytes ...controller-dependencies-with-resources.png | Bin 361673 -> 0 bytes .../static/images/controller-dependencies.png | Bin 194407 -> 0 bytes website/static/images/endpoints-and-nodes.png | Bin 37438 -> 0 bytes website/static/images/grpc-stacked-color.png | Bin 46973 -> 0 bytes website/static/images/harbor-endpoints.png | Bin 179893 -> 0 bytes website/static/images/harbor-projects.png | Bin 222358 -> 0 bytes website/static/images/logo.svg | 3 - website/static/images/metal-overview.png | Bin 95006 -> 0 bytes .../images/no-cloud/proxmox-cloudinit.png | Bin 28829 -> 0 bytes .../static/images/no-cloud/proxmox-smbios.png | Bin 65871 -> 0 bytes .../images/proxmox-guide/click-upload.png | Bin 122408 -> 0 bytes .../static/images/proxmox-guide/create-vm.png | Bin 142265 -> 0 bytes .../static/images/proxmox-guide/edit-cpu.png | Bin 76031 -> 0 bytes .../static/images/proxmox-guide/edit-nic.png | Bin 163032 -> 0 bytes .../static/images/proxmox-guide/edit-os.png | Bin 168768 -> 0 bytes .../static/images/proxmox-guide/edit-ram.png | Bin 146498 -> 0 bytes .../images/proxmox-guide/edit-vm-name.png | Bin 149178 -> 0 bytes .../maintenance-mode-grub-menu-ip.png | Bin 19107 -> 0 bytes .../maintenance-mode-grub-menu.png | Bin 4809 -> 0 bytes .../images/proxmox-guide/maintenance-mode.png | Bin 119498 -> 0 bytes .../images/proxmox-guide/select-iso.png | Bin 134174 -> 0 bytes website/static/images/qemu.png | Bin 61804 -> 0 bytes website/static/images/talos-dev-banner.png | Bin 160259 -> 0 bytes .../static/images/theila-cluster-overview.png | Bin 70796 -> 0 bytes .../images/theila-cluster-selection.png | Bin 22135 -> 0 bytes website/static/images/theila-node-detail.png | Bin 105133 -> 0 bytes website/static/images/theila-node-monitor.png | Bin 127849 -> 0 bytes website/static/images/theila-nodes.png | Bin 60071 -> 0 bytes website/static/images/theila-pods.png | Bin 66809 -> 0 bytes website/static/images/track-reboot.gif | Bin 1184255 -> 0 bytes website/static/images/vbox-guide/add-iso.png | Bin 112495 -> 0 bytes website/static/images/vbox-guide/edit-cpu.png | Bin 104725 -> 0 bytes website/static/images/vbox-guide/edit-nic.png | Bin 91260 -> 0 bytes .../images/vbox-guide/edit-settings.png | Bin 245637 -> 0 bytes .../images/vbox-guide/maintenance-mode.png | Bin 369558 -> 0 bytes website/static/images/vbox-guide/new-vm.png | Bin 235158 -> 0 bytes .../static/images/vbox-guide/vm-memory.png | Bin 124954 -> 0 bytes website/static/images/vbox-guide/vm-name.png | Bin 173864 -> 0 bytes .../wireguard-guide/example-topology.png | Bin 17279 -> 0 bytes website/static/install | 142 - website/static/js/clipboard.js | 62 - 2792 files changed, 601271 deletions(-) delete mode 100644 netlify.toml delete mode 100644 website/.DS_Store delete mode 100644 website/.gitignore delete mode 100644 website/.hugo_build.lock delete mode 100644 website/LICENSE delete mode 100644 website/assets/icons/logo.svg delete mode 100644 website/assets/scss/_sidebar-tree.scss delete mode 100644 website/assets/scss/_styles_project.scss delete mode 100644 website/assets/scss/_variables_project.scss delete mode 100644 website/content/_index.html delete mode 100644 website/content/featured-background.png delete mode 100644 website/content/v0.10/_index.md delete mode 100644 website/content/v0.10/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.10/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.10/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.10/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.10/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.10/cloud-platforms/_index.md delete mode 100644 website/content/v0.10/cloud-platforms/aws.md delete mode 100644 website/content/v0.10/cloud-platforms/azure.md delete mode 100644 website/content/v0.10/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.10/cloud-platforms/gcp.md delete mode 100644 website/content/v0.10/cloud-platforms/openstack.md delete mode 100644 website/content/v0.10/guides/_index.md delete mode 100644 website/content/v0.10/guides/advanced-networking.md delete mode 100644 website/content/v0.10/guides/air-gapped.md delete mode 100644 website/content/v0.10/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.10/guides/configuring-containerd.md delete mode 100644 website/content/v0.10/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.10/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.10/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.10/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.10/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.10/guides/converting-control-plane.md delete mode 100644 website/content/v0.10/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.10/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.10/guides/deploy-metrics-server.md delete mode 100644 website/content/v0.10/guides/disaster-recovery.md delete mode 100644 website/content/v0.10/guides/disk-encryption.md delete mode 100644 website/content/v0.10/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.10/guides/managing-pki.md delete mode 100644 website/content/v0.10/guides/resetting-a-machine.md delete mode 100644 website/content/v0.10/guides/storage.md delete mode 100644 website/content/v0.10/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.10/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.10/guides/upgrading-talos.md delete mode 100644 website/content/v0.10/guides/vip.md delete mode 100644 website/content/v0.10/introduction/_index.md delete mode 100644 website/content/v0.10/introduction/getting-started.md delete mode 100644 website/content/v0.10/introduction/quickstart.md delete mode 100644 website/content/v0.10/introduction/system-requirements.md delete mode 100644 website/content/v0.10/introduction/what-is-new.md delete mode 100644 website/content/v0.10/introduction/what-is-talos.md delete mode 100644 website/content/v0.10/learn-more/_index.md delete mode 100644 website/content/v0.10/learn-more/architecture.md delete mode 100644 website/content/v0.10/learn-more/components.md delete mode 100644 website/content/v0.10/learn-more/concepts.md delete mode 100644 website/content/v0.10/learn-more/control-plane.md delete mode 100644 website/content/v0.10/learn-more/controllers-resources.md delete mode 100644 website/content/v0.10/learn-more/faqs.md delete mode 100644 website/content/v0.10/learn-more/philosophy.md delete mode 100644 website/content/v0.10/learn-more/talosctl.md delete mode 100644 website/content/v0.10/learn-more/upgrades.md delete mode 100644 website/content/v0.10/local-platforms/_index.md delete mode 100644 website/content/v0.10/local-platforms/docker.md delete mode 100644 website/content/v0.10/local-platforms/firecracker.md delete mode 100644 website/content/v0.10/local-platforms/qemu.md delete mode 100644 website/content/v0.10/local-platforms/virtualbox.md delete mode 100644 website/content/v0.10/reference/_index.md delete mode 100644 website/content/v0.10/reference/api.md delete mode 100644 website/content/v0.10/reference/cli.md delete mode 100644 website/content/v0.10/reference/configuration.md delete mode 100644 website/content/v0.10/reference/kernel.md delete mode 100644 website/content/v0.10/reference/platform.md delete mode 100644 website/content/v0.10/single-board-computers/_index.md delete mode 100644 website/content/v0.10/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.10/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.10/single-board-computers/rock64.md delete mode 100644 website/content/v0.10/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.10/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.10/virtualized-platforms/_index.md delete mode 100644 website/content/v0.10/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.10/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.10/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.10/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.10/virtualized-platforms/xen.md delete mode 100644 website/content/v0.11/_index.md delete mode 100644 website/content/v0.11/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.11/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.11/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.11/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.11/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.11/cloud-platforms/_index.md delete mode 100644 website/content/v0.11/cloud-platforms/aws.md delete mode 100644 website/content/v0.11/cloud-platforms/azure.md delete mode 100644 website/content/v0.11/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.11/cloud-platforms/gcp.md delete mode 100644 website/content/v0.11/cloud-platforms/openstack.md delete mode 100644 website/content/v0.11/guides/_index.md delete mode 100644 website/content/v0.11/guides/advanced-networking.md delete mode 100644 website/content/v0.11/guides/air-gapped.md delete mode 100644 website/content/v0.11/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.11/guides/configuring-containerd.md delete mode 100644 website/content/v0.11/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.11/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.11/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.11/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.11/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.11/guides/converting-control-plane.md delete mode 100644 website/content/v0.11/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.11/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.11/guides/deploy-metrics-server.md delete mode 100644 website/content/v0.11/guides/disaster-recovery.md delete mode 100644 website/content/v0.11/guides/disk-encryption.md delete mode 100644 website/content/v0.11/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.11/guides/managing-pki.md delete mode 100644 website/content/v0.11/guides/rbac.md delete mode 100644 website/content/v0.11/guides/resetting-a-machine.md delete mode 100644 website/content/v0.11/guides/storage.md delete mode 100644 website/content/v0.11/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.11/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.11/guides/upgrading-talos.md delete mode 100644 website/content/v0.11/guides/vip.md delete mode 100644 website/content/v0.11/introduction/_index.md delete mode 100644 website/content/v0.11/introduction/getting-started.md delete mode 100644 website/content/v0.11/introduction/quickstart.md delete mode 100644 website/content/v0.11/introduction/system-requirements.md delete mode 100644 website/content/v0.11/introduction/what-is-new.md delete mode 100644 website/content/v0.11/introduction/what-is-talos.md delete mode 100644 website/content/v0.11/learn-more/_index.md delete mode 100644 website/content/v0.11/learn-more/architecture.md delete mode 100644 website/content/v0.11/learn-more/components.md delete mode 100644 website/content/v0.11/learn-more/concepts.md delete mode 100644 website/content/v0.11/learn-more/control-plane.md delete mode 100644 website/content/v0.11/learn-more/controllers-resources.md delete mode 100644 website/content/v0.11/learn-more/faqs.md delete mode 100644 website/content/v0.11/learn-more/networking-resources.md delete mode 100644 website/content/v0.11/learn-more/philosophy.md delete mode 100644 website/content/v0.11/learn-more/talosctl.md delete mode 100644 website/content/v0.11/learn-more/upgrades.md delete mode 100644 website/content/v0.11/local-platforms/_index.md delete mode 100644 website/content/v0.11/local-platforms/docker.md delete mode 100644 website/content/v0.11/local-platforms/firecracker.md delete mode 100644 website/content/v0.11/local-platforms/qemu.md delete mode 100644 website/content/v0.11/local-platforms/virtualbox.md delete mode 100644 website/content/v0.11/reference/_index.md delete mode 100644 website/content/v0.11/reference/api.md delete mode 100644 website/content/v0.11/reference/cli.md delete mode 100644 website/content/v0.11/reference/configuration.md delete mode 100644 website/content/v0.11/reference/kernel.md delete mode 100644 website/content/v0.11/reference/platform.md delete mode 100644 website/content/v0.11/single-board-computers/_index.md delete mode 100644 website/content/v0.11/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.11/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.11/single-board-computers/pine64.md delete mode 100644 website/content/v0.11/single-board-computers/rock64.md delete mode 100644 website/content/v0.11/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.11/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.11/virtualized-platforms/_index.md delete mode 100644 website/content/v0.11/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.11/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.11/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.11/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.11/virtualized-platforms/xen.md delete mode 100644 website/content/v0.12/_index.md delete mode 100644 website/content/v0.12/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.12/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.12/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.12/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.12/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.12/cloud-platforms/_index.md delete mode 100644 website/content/v0.12/cloud-platforms/aws.md delete mode 100644 website/content/v0.12/cloud-platforms/azure.md delete mode 100644 website/content/v0.12/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.12/cloud-platforms/gcp.md delete mode 100644 website/content/v0.12/cloud-platforms/openstack.md delete mode 100644 website/content/v0.12/guides/_index.md delete mode 100644 website/content/v0.12/guides/advanced-networking.md delete mode 100644 website/content/v0.12/guides/air-gapped.md delete mode 100644 website/content/v0.12/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.12/guides/configuring-containerd.md delete mode 100644 website/content/v0.12/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.12/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.12/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.12/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.12/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.12/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.12/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.12/guides/deploy-metrics-server.md delete mode 100644 website/content/v0.12/guides/disaster-recovery.md delete mode 100644 website/content/v0.12/guides/disk-encryption.md delete mode 100644 website/content/v0.12/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.12/guides/managing-pki.md delete mode 100644 website/content/v0.12/guides/rbac.md delete mode 100644 website/content/v0.12/guides/resetting-a-machine.md delete mode 100644 website/content/v0.12/guides/storage.md delete mode 100644 website/content/v0.12/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.12/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.12/guides/upgrading-talos.md delete mode 100644 website/content/v0.12/guides/vip.md delete mode 100644 website/content/v0.12/introduction/_index.md delete mode 100644 website/content/v0.12/introduction/getting-started.md delete mode 100644 website/content/v0.12/introduction/quickstart.md delete mode 100644 website/content/v0.12/introduction/support-matrix.md delete mode 100644 website/content/v0.12/introduction/system-requirements.md delete mode 100644 website/content/v0.12/introduction/what-is-new.md delete mode 100644 website/content/v0.12/introduction/what-is-talos.md delete mode 100644 website/content/v0.12/learn-more/_index.md delete mode 100644 website/content/v0.12/learn-more/architecture.md delete mode 100644 website/content/v0.12/learn-more/components.md delete mode 100644 website/content/v0.12/learn-more/concepts.md delete mode 100644 website/content/v0.12/learn-more/control-plane.md delete mode 100644 website/content/v0.12/learn-more/controllers-resources.md delete mode 100644 website/content/v0.12/learn-more/faqs.md delete mode 100644 website/content/v0.12/learn-more/networking-resources.md delete mode 100644 website/content/v0.12/learn-more/philosophy.md delete mode 100644 website/content/v0.12/learn-more/talosctl.md delete mode 100644 website/content/v0.12/learn-more/upgrades.md delete mode 100644 website/content/v0.12/local-platforms/_index.md delete mode 100644 website/content/v0.12/local-platforms/docker.md delete mode 100644 website/content/v0.12/local-platforms/firecracker.md delete mode 100644 website/content/v0.12/local-platforms/qemu.md delete mode 100644 website/content/v0.12/local-platforms/virtualbox.md delete mode 100644 website/content/v0.12/reference/_index.md delete mode 100644 website/content/v0.12/reference/api.md delete mode 100644 website/content/v0.12/reference/cli.md delete mode 100644 website/content/v0.12/reference/configuration.md delete mode 100644 website/content/v0.12/reference/kernel.md delete mode 100644 website/content/v0.12/reference/platform.md delete mode 100644 website/content/v0.12/single-board-computers/_index.md delete mode 100644 website/content/v0.12/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.12/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.12/single-board-computers/pine64.md delete mode 100644 website/content/v0.12/single-board-computers/rock64.md delete mode 100644 website/content/v0.12/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.12/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.12/virtualized-platforms/_index.md delete mode 100644 website/content/v0.12/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.12/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.12/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.12/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.12/virtualized-platforms/xen.md delete mode 100644 website/content/v0.13/_index.md delete mode 100644 website/content/v0.13/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.13/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.13/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.13/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.13/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.13/cloud-platforms/_index.md delete mode 100644 website/content/v0.13/cloud-platforms/aws.md delete mode 100644 website/content/v0.13/cloud-platforms/azure.md delete mode 100644 website/content/v0.13/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.13/cloud-platforms/gcp.md delete mode 100644 website/content/v0.13/cloud-platforms/hetzner.md delete mode 100644 website/content/v0.13/cloud-platforms/nocloud.md delete mode 100644 website/content/v0.13/cloud-platforms/openstack.md delete mode 100644 website/content/v0.13/cloud-platforms/scaleway.md delete mode 100644 website/content/v0.13/cloud-platforms/upcloud.md delete mode 100644 website/content/v0.13/cloud-platforms/vultr.md delete mode 100644 website/content/v0.13/guides/_index.md delete mode 100644 website/content/v0.13/guides/advanced-networking.md delete mode 100644 website/content/v0.13/guides/air-gapped.md delete mode 100644 website/content/v0.13/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.13/guides/configuring-containerd.md delete mode 100644 website/content/v0.13/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.13/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.13/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.13/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.13/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.13/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.13/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.13/guides/deploy-metrics-server.md delete mode 100644 website/content/v0.13/guides/disaster-recovery.md delete mode 100644 website/content/v0.13/guides/discovery.md delete mode 100644 website/content/v0.13/guides/disk-encryption.md delete mode 100644 website/content/v0.13/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.13/guides/kubespan.md delete mode 100644 website/content/v0.13/guides/managing-pki.md delete mode 100644 website/content/v0.13/guides/rbac.md delete mode 100644 website/content/v0.13/guides/resetting-a-machine.md delete mode 100644 website/content/v0.13/guides/storage.md delete mode 100644 website/content/v0.13/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.13/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.13/guides/upgrading-talos.md delete mode 100644 website/content/v0.13/guides/vip.md delete mode 100644 website/content/v0.13/introduction/_index.md delete mode 100644 website/content/v0.13/introduction/getting-started.md delete mode 100644 website/content/v0.13/introduction/quickstart.md delete mode 100644 website/content/v0.13/introduction/support-matrix.md delete mode 100644 website/content/v0.13/introduction/system-requirements.md delete mode 100644 website/content/v0.13/introduction/what-is-new.md delete mode 100644 website/content/v0.13/introduction/what-is-talos.md delete mode 100644 website/content/v0.13/learn-more/_index.md delete mode 100644 website/content/v0.13/learn-more/architecture.md delete mode 100644 website/content/v0.13/learn-more/components.md delete mode 100644 website/content/v0.13/learn-more/concepts.md delete mode 100644 website/content/v0.13/learn-more/control-plane.md delete mode 100644 website/content/v0.13/learn-more/controllers-resources.md delete mode 100644 website/content/v0.13/learn-more/discovery.md delete mode 100644 website/content/v0.13/learn-more/faqs.md delete mode 100644 website/content/v0.13/learn-more/kubespan.md delete mode 100644 website/content/v0.13/learn-more/networking-resources.md delete mode 100644 website/content/v0.13/learn-more/philosophy.md delete mode 100644 website/content/v0.13/learn-more/talosctl.md delete mode 100644 website/content/v0.13/learn-more/upgrades.md delete mode 100644 website/content/v0.13/local-platforms/_index.md delete mode 100644 website/content/v0.13/local-platforms/docker.md delete mode 100644 website/content/v0.13/local-platforms/qemu.md delete mode 100644 website/content/v0.13/local-platforms/virtualbox.md delete mode 100644 website/content/v0.13/reference/_index.md delete mode 100644 website/content/v0.13/reference/api.md delete mode 100644 website/content/v0.13/reference/cli.md delete mode 100644 website/content/v0.13/reference/configuration.md delete mode 100644 website/content/v0.13/reference/kernel.md delete mode 100644 website/content/v0.13/reference/platform.md delete mode 100644 website/content/v0.13/single-board-computers/_index.md delete mode 100644 website/content/v0.13/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.13/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.13/single-board-computers/pine64.md delete mode 100644 website/content/v0.13/single-board-computers/rock64.md delete mode 100644 website/content/v0.13/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.13/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.13/virtualized-platforms/_index.md delete mode 100644 website/content/v0.13/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.13/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.13/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.13/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.13/virtualized-platforms/xen.md delete mode 100644 website/content/v0.14/_index.md delete mode 100644 website/content/v0.14/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.14/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.14/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.14/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.14/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.14/cloud-platforms/_index.md delete mode 100644 website/content/v0.14/cloud-platforms/aws.md delete mode 100644 website/content/v0.14/cloud-platforms/azure.md delete mode 100644 website/content/v0.14/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.14/cloud-platforms/gcp.md delete mode 100644 website/content/v0.14/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v0.14/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v0.14/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v0.14/cloud-platforms/hetzner.md delete mode 100644 website/content/v0.14/cloud-platforms/nocloud.md delete mode 100644 website/content/v0.14/cloud-platforms/openstack.md delete mode 100644 website/content/v0.14/cloud-platforms/scaleway.md delete mode 100644 website/content/v0.14/cloud-platforms/upcloud.md delete mode 100644 website/content/v0.14/cloud-platforms/vultr.md delete mode 100644 website/content/v0.14/guides/_index.md delete mode 100644 website/content/v0.14/guides/adding-a-proprietary-kernel-module.md delete mode 100644 website/content/v0.14/guides/advanced-networking.md delete mode 100644 website/content/v0.14/guides/air-gapped.md delete mode 100644 website/content/v0.14/guides/configuring-ceph-with-rook.md delete mode 100644 website/content/v0.14/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.14/guides/configuring-containerd.md delete mode 100644 website/content/v0.14/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.14/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.14/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.14/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.14/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.14/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.14/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.14/guides/deploy-metrics-server.md delete mode 100644 website/content/v0.14/guides/deploying-cilium.md delete mode 100644 website/content/v0.14/guides/disaster-recovery.md delete mode 100644 website/content/v0.14/guides/discovery.md delete mode 100644 website/content/v0.14/guides/disk-encryption.md delete mode 100644 website/content/v0.14/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.14/guides/kubespan.md delete mode 100644 website/content/v0.14/guides/logging.md delete mode 100644 website/content/v0.14/guides/managing-pki.md delete mode 100644 website/content/v0.14/guides/rbac.md delete mode 100644 website/content/v0.14/guides/resetting-a-machine.md delete mode 100644 website/content/v0.14/guides/storage.md delete mode 100644 website/content/v0.14/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.14/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.14/guides/upgrading-talos.md delete mode 100644 website/content/v0.14/guides/vip.md delete mode 100644 website/content/v0.14/introduction/_index.md delete mode 100644 website/content/v0.14/introduction/getting-started.md delete mode 100644 website/content/v0.14/introduction/quickstart.md delete mode 100644 website/content/v0.14/introduction/support-matrix.md delete mode 100644 website/content/v0.14/introduction/system-requirements.md delete mode 100644 website/content/v0.14/introduction/what-is-new.md delete mode 100644 website/content/v0.14/introduction/what-is-talos.md delete mode 100644 website/content/v0.14/learn-more/_index.md delete mode 100644 website/content/v0.14/learn-more/architecture.md delete mode 100644 website/content/v0.14/learn-more/components.md delete mode 100644 website/content/v0.14/learn-more/control-plane.md delete mode 100644 website/content/v0.14/learn-more/controllers-resources.md delete mode 100644 website/content/v0.14/learn-more/developing-talos.md delete mode 100644 website/content/v0.14/learn-more/discovery.md delete mode 100644 website/content/v0.14/learn-more/faqs.md delete mode 100644 website/content/v0.14/learn-more/kubespan.md delete mode 100644 website/content/v0.14/learn-more/networking-resources.md delete mode 100644 website/content/v0.14/learn-more/philosophy.md delete mode 100644 website/content/v0.14/learn-more/talosctl.md delete mode 100644 website/content/v0.14/learn-more/upgrades.md delete mode 100644 website/content/v0.14/local-platforms/_index.md delete mode 100644 website/content/v0.14/local-platforms/docker.md delete mode 100644 website/content/v0.14/local-platforms/qemu.md delete mode 100644 website/content/v0.14/local-platforms/virtualbox.md delete mode 100644 website/content/v0.14/reference/_index.md delete mode 100644 website/content/v0.14/reference/api.md delete mode 100644 website/content/v0.14/reference/cli.md delete mode 100644 website/content/v0.14/reference/configuration.md delete mode 100644 website/content/v0.14/reference/kernel.md delete mode 100644 website/content/v0.14/reference/platform.md delete mode 100644 website/content/v0.14/single-board-computers/_index.md delete mode 100644 website/content/v0.14/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.14/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.14/single-board-computers/pine64.md delete mode 100644 website/content/v0.14/single-board-computers/rock64.md delete mode 100644 website/content/v0.14/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.14/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.14/virtualized-platforms/_index.md delete mode 100644 website/content/v0.14/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.14/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.14/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.14/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.14/virtualized-platforms/vmware/cp.patch delete mode 100644 website/content/v0.14/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v0.14/virtualized-platforms/xen.md delete mode 100644 website/content/v0.6/_index.md delete mode 100644 website/content/v0.6/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.6/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.6/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.6/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.6/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.6/cloud-platforms/_index.md delete mode 100644 website/content/v0.6/cloud-platforms/aws.md delete mode 100644 website/content/v0.6/cloud-platforms/azure.md delete mode 100644 website/content/v0.6/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.6/cloud-platforms/gcp.md delete mode 100644 website/content/v0.6/guides/_index.md delete mode 100644 website/content/v0.6/guides/advanced-networking.md delete mode 100644 website/content/v0.6/guides/configuring-containerd.md delete mode 100644 website/content/v0.6/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.6/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.6/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.6/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.6/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.6/guides/managing-pki.md delete mode 100644 website/content/v0.6/guides/resetting-a-machine.md delete mode 100644 website/content/v0.6/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.6/guides/upgrading-talos.md delete mode 100644 website/content/v0.6/introduction/_index.md delete mode 100644 website/content/v0.6/introduction/quickstart.md delete mode 100644 website/content/v0.6/introduction/system-requirements.md delete mode 100644 website/content/v0.6/introduction/what-is-talos.md delete mode 100644 website/content/v0.6/learn-more/_index.md delete mode 100644 website/content/v0.6/learn-more/architecture.md delete mode 100644 website/content/v0.6/learn-more/faqs.md delete mode 100644 website/content/v0.6/local-platforms/_index.md delete mode 100644 website/content/v0.6/local-platforms/docker.md delete mode 100644 website/content/v0.6/local-platforms/firecracker.md delete mode 100644 website/content/v0.6/local-platforms/qemu.md delete mode 100644 website/content/v0.6/reference/_index.md delete mode 100644 website/content/v0.6/reference/configuration.md delete mode 100644 website/content/v0.6/virtualized-platforms/_index.md delete mode 100644 website/content/v0.6/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.6/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.6/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.6/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.6/virtualized-platforms/xen.md delete mode 100644 website/content/v0.7/_index.md delete mode 100644 website/content/v0.7/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.7/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.7/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.7/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.7/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.7/cloud-platforms/_index.md delete mode 100644 website/content/v0.7/cloud-platforms/aws.md delete mode 100644 website/content/v0.7/cloud-platforms/azure.md delete mode 100644 website/content/v0.7/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.7/cloud-platforms/gcp.md delete mode 100644 website/content/v0.7/guides/_index.md delete mode 100644 website/content/v0.7/guides/advanced-networking.md delete mode 100644 website/content/v0.7/guides/air-gapped.md delete mode 100644 website/content/v0.7/guides/configuring-containerd.md delete mode 100644 website/content/v0.7/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.7/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.7/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.7/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.7/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.7/guides/managing-pki.md delete mode 100644 website/content/v0.7/guides/resetting-a-machine.md delete mode 100644 website/content/v0.7/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.7/guides/upgrading-talos.md delete mode 100644 website/content/v0.7/introduction/_index.md delete mode 100644 website/content/v0.7/introduction/getting-started.md delete mode 100644 website/content/v0.7/introduction/quickstart.md delete mode 100644 website/content/v0.7/introduction/system-requirements.md delete mode 100644 website/content/v0.7/introduction/what-is-talos.md delete mode 100644 website/content/v0.7/learn-more/_index.md delete mode 100644 website/content/v0.7/learn-more/architecture.md delete mode 100644 website/content/v0.7/learn-more/components.md delete mode 100644 website/content/v0.7/learn-more/concepts.md delete mode 100644 website/content/v0.7/learn-more/faqs.md delete mode 100644 website/content/v0.7/learn-more/philosophy.md delete mode 100644 website/content/v0.7/learn-more/talosctl.md delete mode 100644 website/content/v0.7/learn-more/upgrades.md delete mode 100644 website/content/v0.7/local-platforms/_index.md delete mode 100644 website/content/v0.7/local-platforms/docker.md delete mode 100644 website/content/v0.7/local-platforms/firecracker.md delete mode 100644 website/content/v0.7/local-platforms/qemu.md delete mode 100644 website/content/v0.7/local-platforms/virtualbox.md delete mode 100644 website/content/v0.7/reference/_index.md delete mode 100644 website/content/v0.7/reference/api.md delete mode 100644 website/content/v0.7/reference/cli.md delete mode 100644 website/content/v0.7/reference/configuration.md delete mode 100644 website/content/v0.7/reference/platform.md delete mode 100644 website/content/v0.7/virtualized-platforms/_index.md delete mode 100644 website/content/v0.7/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.7/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.7/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.7/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.7/virtualized-platforms/xen.md delete mode 100644 website/content/v0.8/_index.md delete mode 100644 website/content/v0.8/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.8/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.8/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.8/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.8/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.8/cloud-platforms/_index.md delete mode 100644 website/content/v0.8/cloud-platforms/aws.md delete mode 100644 website/content/v0.8/cloud-platforms/azure.md delete mode 100644 website/content/v0.8/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.8/cloud-platforms/gcp.md delete mode 100644 website/content/v0.8/cloud-platforms/openstack.md delete mode 100644 website/content/v0.8/guides/_index.md delete mode 100644 website/content/v0.8/guides/advanced-networking.md delete mode 100644 website/content/v0.8/guides/air-gapped.md delete mode 100644 website/content/v0.8/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.8/guides/configuring-containerd.md delete mode 100644 website/content/v0.8/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.8/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.8/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.8/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.8/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.8/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.8/guides/managing-pki.md delete mode 100644 website/content/v0.8/guides/resetting-a-machine.md delete mode 100644 website/content/v0.8/guides/storage.md delete mode 100644 website/content/v0.8/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.8/guides/upgrading-talos.md delete mode 100644 website/content/v0.8/introduction/_index.md delete mode 100644 website/content/v0.8/introduction/getting-started.md delete mode 100644 website/content/v0.8/introduction/quickstart.md delete mode 100644 website/content/v0.8/introduction/system-requirements.md delete mode 100644 website/content/v0.8/introduction/what-is-talos.md delete mode 100644 website/content/v0.8/learn-more/_index.md delete mode 100644 website/content/v0.8/learn-more/architecture.md delete mode 100644 website/content/v0.8/learn-more/components.md delete mode 100644 website/content/v0.8/learn-more/concepts.md delete mode 100644 website/content/v0.8/learn-more/faqs.md delete mode 100644 website/content/v0.8/learn-more/philosophy.md delete mode 100644 website/content/v0.8/learn-more/talosctl.md delete mode 100644 website/content/v0.8/learn-more/upgrades.md delete mode 100644 website/content/v0.8/local-platforms/_index.md delete mode 100644 website/content/v0.8/local-platforms/docker.md delete mode 100644 website/content/v0.8/local-platforms/firecracker.md delete mode 100644 website/content/v0.8/local-platforms/qemu.md delete mode 100644 website/content/v0.8/local-platforms/virtualbox.md delete mode 100644 website/content/v0.8/reference/_index.md delete mode 100644 website/content/v0.8/reference/api.md delete mode 100644 website/content/v0.8/reference/cli.md delete mode 100644 website/content/v0.8/reference/configuration.md delete mode 100644 website/content/v0.8/reference/platform.md delete mode 100644 website/content/v0.8/single-board-computers/_index.md delete mode 100644 website/content/v0.8/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.8/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.8/single-board-computers/rock64.md delete mode 100644 website/content/v0.8/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.8/virtualized-platforms/_index.md delete mode 100644 website/content/v0.8/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.8/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.8/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.8/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.8/virtualized-platforms/xen.md delete mode 100644 website/content/v0.9/_index.md delete mode 100644 website/content/v0.9/bare-metal-platforms/_index.md delete mode 100644 website/content/v0.9/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v0.9/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v0.9/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v0.9/bare-metal-platforms/sidero.md delete mode 100644 website/content/v0.9/cloud-platforms/_index.md delete mode 100644 website/content/v0.9/cloud-platforms/aws.md delete mode 100644 website/content/v0.9/cloud-platforms/azure.md delete mode 100644 website/content/v0.9/cloud-platforms/digitalocean.md delete mode 100644 website/content/v0.9/cloud-platforms/gcp.md delete mode 100644 website/content/v0.9/cloud-platforms/openstack.md delete mode 100644 website/content/v0.9/guides/_index.md delete mode 100644 website/content/v0.9/guides/advanced-networking.md delete mode 100644 website/content/v0.9/guides/air-gapped.md delete mode 100644 website/content/v0.9/guides/configuring-certificate-authorities.md delete mode 100644 website/content/v0.9/guides/configuring-containerd.md delete mode 100644 website/content/v0.9/guides/configuring-corporate-proxies.md delete mode 100644 website/content/v0.9/guides/configuring-network-connectivity.md delete mode 100644 website/content/v0.9/guides/configuring-pull-through-cache.md delete mode 100644 website/content/v0.9/guides/configuring-the-cluster-endpoint.md delete mode 100644 website/content/v0.9/guides/configuring-wireguard-network.md delete mode 100644 website/content/v0.9/guides/converting-control-plane.md delete mode 100644 website/content/v0.9/guides/customizing-the-kernel.md delete mode 100644 website/content/v0.9/guides/customizing-the-root-filesystem.md delete mode 100644 website/content/v0.9/guides/disk-encryption.md delete mode 100644 website/content/v0.9/guides/editing-machine-configuration.md delete mode 100644 website/content/v0.9/guides/managing-pki.md delete mode 100644 website/content/v0.9/guides/resetting-a-machine.md delete mode 100644 website/content/v0.9/guides/storage.md delete mode 100644 website/content/v0.9/guides/troubleshooting-control-plane.md delete mode 100644 website/content/v0.9/guides/upgrading-kubernetes.md delete mode 100644 website/content/v0.9/guides/upgrading-talos.md delete mode 100644 website/content/v0.9/guides/vip.md delete mode 100644 website/content/v0.9/introduction/_index.md delete mode 100644 website/content/v0.9/introduction/getting-started.md delete mode 100644 website/content/v0.9/introduction/quickstart.md delete mode 100644 website/content/v0.9/introduction/system-requirements.md delete mode 100644 website/content/v0.9/introduction/what-is-new.md delete mode 100644 website/content/v0.9/introduction/what-is-talos.md delete mode 100644 website/content/v0.9/learn-more/_index.md delete mode 100644 website/content/v0.9/learn-more/architecture.md delete mode 100644 website/content/v0.9/learn-more/components.md delete mode 100644 website/content/v0.9/learn-more/concepts.md delete mode 100644 website/content/v0.9/learn-more/control-plane.md delete mode 100644 website/content/v0.9/learn-more/controllers-resources.md delete mode 100644 website/content/v0.9/learn-more/faqs.md delete mode 100644 website/content/v0.9/learn-more/philosophy.md delete mode 100644 website/content/v0.9/learn-more/talosctl.md delete mode 100644 website/content/v0.9/learn-more/upgrades.md delete mode 100644 website/content/v0.9/local-platforms/_index.md delete mode 100644 website/content/v0.9/local-platforms/docker.md delete mode 100644 website/content/v0.9/local-platforms/firecracker.md delete mode 100644 website/content/v0.9/local-platforms/qemu.md delete mode 100644 website/content/v0.9/local-platforms/virtualbox.md delete mode 100644 website/content/v0.9/reference/_index.md delete mode 100644 website/content/v0.9/reference/api.md delete mode 100644 website/content/v0.9/reference/cli.md delete mode 100644 website/content/v0.9/reference/configuration.md delete mode 100644 website/content/v0.9/reference/kernel.md delete mode 100644 website/content/v0.9/reference/platform.md delete mode 100644 website/content/v0.9/single-board-computers/_index.md delete mode 100644 website/content/v0.9/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v0.9/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v0.9/single-board-computers/rock64.md delete mode 100644 website/content/v0.9/single-board-computers/rockpi_4.md delete mode 100644 website/content/v0.9/single-board-computers/rpi_4.md delete mode 100644 website/content/v0.9/virtualized-platforms/_index.md delete mode 100644 website/content/v0.9/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v0.9/virtualized-platforms/kvm.md delete mode 100644 website/content/v0.9/virtualized-platforms/proxmox.md delete mode 100644 website/content/v0.9/virtualized-platforms/vmware.md delete mode 100644 website/content/v0.9/virtualized-platforms/xen.md delete mode 100644 website/content/v1.0/_index.md delete mode 100644 website/content/v1.0/advanced/_index.md delete mode 100644 website/content/v1.0/advanced/advanced-networking.md delete mode 100644 website/content/v1.0/advanced/air-gapped.md delete mode 100644 website/content/v1.0/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.0/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.0/advanced/developing-talos.md delete mode 100644 website/content/v1.0/advanced/disaster-recovery.md delete mode 100644 website/content/v1.0/advanced/extension-services.md delete mode 100644 website/content/v1.0/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.0/advanced/static-pods.md delete mode 100644 website/content/v1.0/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.0/introduction/_index.md delete mode 100644 website/content/v1.0/introduction/getting-started.md delete mode 100644 website/content/v1.0/introduction/quickstart.md delete mode 100644 website/content/v1.0/introduction/support-matrix.md delete mode 100644 website/content/v1.0/introduction/system-requirements.md delete mode 100644 website/content/v1.0/introduction/theila.md delete mode 100644 website/content/v1.0/introduction/what-is-new.md delete mode 100644 website/content/v1.0/introduction/what-is-talos.md delete mode 100644 website/content/v1.0/kubernetes-guides/_index.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/discovery.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.0/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.0/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.0/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.0/kubernetes-guides/network/kubespan.md delete mode 100644 website/content/v1.0/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.0/learn-more/_index.md delete mode 100644 website/content/v1.0/learn-more/architecture.md delete mode 100644 website/content/v1.0/learn-more/components.md delete mode 100644 website/content/v1.0/learn-more/concepts.md delete mode 100644 website/content/v1.0/learn-more/control-plane.md delete mode 100644 website/content/v1.0/learn-more/controllers-resources.md delete mode 100644 website/content/v1.0/learn-more/discovery.md delete mode 100644 website/content/v1.0/learn-more/faqs.md delete mode 100644 website/content/v1.0/learn-more/knowledge-base.md delete mode 100644 website/content/v1.0/learn-more/kubespan.md delete mode 100644 website/content/v1.0/learn-more/networking-resources.md delete mode 100644 website/content/v1.0/learn-more/philosophy.md delete mode 100644 website/content/v1.0/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.0/learn-more/talosctl.md delete mode 100644 website/content/v1.0/reference/_index.md delete mode 100644 website/content/v1.0/reference/api.md delete mode 100644 website/content/v1.0/reference/cli.md delete mode 100644 website/content/v1.0/reference/configuration.md delete mode 100644 website/content/v1.0/reference/kernel.md delete mode 100644 website/content/v1.0/reference/platform.md delete mode 100644 website/content/v1.0/talos-guides/_index.md delete mode 100644 website/content/v1.0/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.0/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.0/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.0/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.0/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.0/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.0/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.0/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.0/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.0/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.0/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.0/talos-guides/install/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.0/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.0/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.0/talos-guides/install/bare-metal-platforms/sidero.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.0/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.0/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.0/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.0/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.0/talos-guides/install/single-board-computers/rpi_4.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.0/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.0/talos-guides/network/_index.md delete mode 100644 website/content/v1.0/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.0/talos-guides/network/vip.md delete mode 100644 website/content/v1.0/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.0/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.0/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.1/_index.md delete mode 100644 website/content/v1.1/advanced/_index.md delete mode 100644 website/content/v1.1/advanced/advanced-networking.md delete mode 100644 website/content/v1.1/advanced/air-gapped.md delete mode 100644 website/content/v1.1/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.1/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.1/advanced/developing-talos.md delete mode 100644 website/content/v1.1/advanced/disaster-recovery.md delete mode 100644 website/content/v1.1/advanced/extension-services.md delete mode 100644 website/content/v1.1/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.1/advanced/static-pods.md delete mode 100644 website/content/v1.1/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.1/introduction/_index.md delete mode 100644 website/content/v1.1/introduction/getting-started.md delete mode 100644 website/content/v1.1/introduction/quickstart.md delete mode 100644 website/content/v1.1/introduction/support-matrix.md delete mode 100644 website/content/v1.1/introduction/system-requirements.md delete mode 100644 website/content/v1.1/introduction/theila.md delete mode 100644 website/content/v1.1/introduction/what-is-new.md delete mode 100644 website/content/v1.1/introduction/what-is-talos.md delete mode 100644 website/content/v1.1/kubernetes-guides/_index.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/discovery.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.1/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.1/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.1/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.1/kubernetes-guides/network/kubespan.md delete mode 100644 website/content/v1.1/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.1/learn-more/_index.md delete mode 100644 website/content/v1.1/learn-more/architecture.md delete mode 100644 website/content/v1.1/learn-more/components.md delete mode 100644 website/content/v1.1/learn-more/concepts.md delete mode 100644 website/content/v1.1/learn-more/control-plane.md delete mode 100644 website/content/v1.1/learn-more/controllers-resources.md delete mode 100644 website/content/v1.1/learn-more/discovery.md delete mode 100644 website/content/v1.1/learn-more/faqs.md delete mode 100644 website/content/v1.1/learn-more/knowledge-base.md delete mode 100644 website/content/v1.1/learn-more/kubespan.md delete mode 100644 website/content/v1.1/learn-more/networking-resources.md delete mode 100644 website/content/v1.1/learn-more/philosophy.md delete mode 100644 website/content/v1.1/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.1/learn-more/talosctl.md delete mode 100644 website/content/v1.1/reference/_index.md delete mode 100644 website/content/v1.1/reference/api.md delete mode 100644 website/content/v1.1/reference/cli.md delete mode 100644 website/content/v1.1/reference/configuration.md delete mode 100644 website/content/v1.1/reference/kernel.md delete mode 100644 website/content/v1.1/reference/platform.md delete mode 100644 website/content/v1.1/talos-guides/_index.md delete mode 100644 website/content/v1.1/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.1/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.1/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.1/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.1/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.1/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.1/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.1/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.1/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.1/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.1/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.1/talos-guides/install/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.1/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.1/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.1/talos-guides/install/bare-metal-platforms/sidero.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.1/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.1/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.1/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.1/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.1/talos-guides/install/single-board-computers/rpi_4.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.1/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.1/talos-guides/network/_index.md delete mode 100644 website/content/v1.1/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.1/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.1/talos-guides/network/vip.md delete mode 100644 website/content/v1.1/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.1/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.1/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.10/_index.md delete mode 100644 website/content/v1.10/advanced/_index.md delete mode 100644 website/content/v1.10/advanced/advanced-networking.md delete mode 100644 website/content/v1.10/advanced/air-gapped.md delete mode 100644 website/content/v1.10/advanced/building-images.md delete mode 100644 website/content/v1.10/advanced/ca-rotation.md delete mode 100644 website/content/v1.10/advanced/cgroups-analysis.md delete mode 100644 website/content/v1.10/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.10/advanced/developing-talos.md delete mode 100644 website/content/v1.10/advanced/disaster-recovery.md delete mode 100644 website/content/v1.10/advanced/egress-domains.md delete mode 100644 website/content/v1.10/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.10/advanced/extension-services.md delete mode 100644 website/content/v1.10/advanced/install-kubevirt.md delete mode 100644 website/content/v1.10/advanced/kernel-module.md delete mode 100644 website/content/v1.10/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.10/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.10/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.10/advanced/oci-base-spec.md delete mode 100644 website/content/v1.10/advanced/overlays.md delete mode 100644 website/content/v1.10/advanced/selinux.md delete mode 100644 website/content/v1.10/advanced/static-pods.md delete mode 100644 website/content/v1.10/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.10/advanced/verifying-images.md delete mode 100644 website/content/v1.10/advanced/watchdog.md delete mode 100644 website/content/v1.10/introduction/_index.md delete mode 100644 website/content/v1.10/introduction/deploy-first-workload.md delete mode 100644 website/content/v1.10/introduction/getting-started.md delete mode 100644 website/content/v1.10/introduction/prodnotes.md delete mode 100644 website/content/v1.10/introduction/quickstart.md delete mode 100644 website/content/v1.10/introduction/support-matrix.md delete mode 100644 website/content/v1.10/introduction/system-requirements.md delete mode 100644 website/content/v1.10/introduction/troubleshooting.md delete mode 100644 website/content/v1.10/introduction/what-is-new/index.md delete mode 100644 website/content/v1.10/introduction/what-is-talos.md delete mode 100644 website/content/v1.10/kubernetes-guides/_index.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/device-plugins.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/etcd-metrics.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/inlinemanifests.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/node-labels.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.10/kubernetes-guides/configuration/usernamespace.md delete mode 100644 website/content/v1.10/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.10/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.10/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.10/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.10/learn-more/_index.md delete mode 100644 website/content/v1.10/learn-more/architecture.md delete mode 100644 website/content/v1.10/learn-more/components.md delete mode 100644 website/content/v1.10/learn-more/control-plane.md delete mode 100644 website/content/v1.10/learn-more/controllers-resources.md delete mode 100644 website/content/v1.10/learn-more/faqs.md delete mode 100644 website/content/v1.10/learn-more/image-factory.md delete mode 100644 website/content/v1.10/learn-more/knowledge-base.md delete mode 100644 website/content/v1.10/learn-more/kubespan.md delete mode 100644 website/content/v1.10/learn-more/networking-resources.md delete mode 100644 website/content/v1.10/learn-more/philosophy.md delete mode 100644 website/content/v1.10/learn-more/process-capabilities.md delete mode 100644 website/content/v1.10/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.10/learn-more/talosctl.md delete mode 100644 website/content/v1.10/reference/_index.md delete mode 100644 website/content/v1.10/reference/api.md delete mode 100644 website/content/v1.10/reference/cli.md delete mode 100644 website/content/v1.10/reference/configuration/_index.md delete mode 100644 website/content/v1.10/reference/configuration/block/_index.md delete mode 100644 website/content/v1.10/reference/configuration/block/uservolumeconfig.md delete mode 100644 website/content/v1.10/reference/configuration/block/volumeconfig.md delete mode 100644 website/content/v1.10/reference/configuration/extensions/_index.md delete mode 100644 website/content/v1.10/reference/configuration/extensions/extensionserviceconfig.md delete mode 100644 website/content/v1.10/reference/configuration/hardware/_index.md delete mode 100644 website/content/v1.10/reference/configuration/hardware/pcidriverrebindconfig.md delete mode 100644 website/content/v1.10/reference/configuration/network/_index.md delete mode 100644 website/content/v1.10/reference/configuration/network/ethernetconfig.md delete mode 100644 website/content/v1.10/reference/configuration/network/kubespanendpointsconfig.md delete mode 100644 website/content/v1.10/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.10/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.10/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.10/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.10/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.10/reference/configuration/runtime/watchdogtimerconfig.md delete mode 100644 website/content/v1.10/reference/configuration/security/_index.md delete mode 100644 website/content/v1.10/reference/configuration/security/trustedrootsconfig.md delete mode 100644 website/content/v1.10/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.10/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.10/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.10/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.10/reference/kernel.md delete mode 100644 website/content/v1.10/schemas/config.schema.json delete mode 100644 website/content/v1.10/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.10/talos-guides/_index.md delete mode 100644 website/content/v1.10/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.10/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.10/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.10/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.10/talos-guides/configuration/disk-management.md delete mode 100644 website/content/v1.10/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.10/talos-guides/configuration/image-cache.md delete mode 100644 website/content/v1.10/talos-guides/configuration/insecure.md delete mode 100644 website/content/v1.10/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.10/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.10/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.10/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.10/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.10/talos-guides/configuration/performance-tuning.md delete mode 100644 website/content/v1.10/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.10/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.10/talos-guides/configuration/reproducible-machine-config.md delete mode 100644 website/content/v1.10/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.10/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.10/talos-guides/discovery.md delete mode 100644 website/content/v1.10/talos-guides/howto/_index.md delete mode 100644 website/content/v1.10/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.10/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.10/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.10/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.10/talos-guides/install/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/bootloader.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.10/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.10/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/cloudstack.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.10/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.10/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.10/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.10/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.10/talos-guides/install/omni.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/orangepi_5.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rock5b.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/turing_rk1.md delete mode 100644 website/content/v1.10/talos-guides/install/single-board-computers/unofficial.md delete mode 100644 website/content/v1.10/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.10/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.10/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.10/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.10/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.10/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.10/talos-guides/network/_index.md delete mode 100644 website/content/v1.10/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.10/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.10/talos-guides/network/ethernet-config.md delete mode 100644 website/content/v1.10/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.10/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.10/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.10/talos-guides/network/multihoming.md delete mode 100644 website/content/v1.10/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.10/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.10/talos-guides/network/vip.md delete mode 100644 website/content/v1.10/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.10/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.10/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.11/_index.md delete mode 100644 website/content/v1.11/advanced/_index.md delete mode 100644 website/content/v1.11/advanced/advanced-networking.md delete mode 100644 website/content/v1.11/advanced/air-gapped.md delete mode 100644 website/content/v1.11/advanced/building-images.md delete mode 100644 website/content/v1.11/advanced/ca-rotation.md delete mode 100644 website/content/v1.11/advanced/cgroups-analysis.md delete mode 100644 website/content/v1.11/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.11/advanced/developing-talos.md delete mode 100644 website/content/v1.11/advanced/disaster-recovery.md delete mode 100644 website/content/v1.11/advanced/egress-domains.md delete mode 100644 website/content/v1.11/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.11/advanced/extension-services.md delete mode 100644 website/content/v1.11/advanced/install-kubevirt.md delete mode 100644 website/content/v1.11/advanced/kernel-module.md delete mode 100644 website/content/v1.11/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.11/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.11/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.11/advanced/oci-base-spec.md delete mode 100644 website/content/v1.11/advanced/overlays.md delete mode 100644 website/content/v1.11/advanced/sbom.md delete mode 100644 website/content/v1.11/advanced/selinux.md delete mode 100644 website/content/v1.11/advanced/static-pods.md delete mode 100644 website/content/v1.11/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.11/advanced/verifying-images.md delete mode 100644 website/content/v1.11/advanced/watchdog.md delete mode 100644 website/content/v1.11/introduction/_index.md delete mode 100644 website/content/v1.11/introduction/deploy-first-workload.md delete mode 100644 website/content/v1.11/introduction/getting-started.md delete mode 100644 website/content/v1.11/introduction/prodnotes.md delete mode 100644 website/content/v1.11/introduction/quickstart.md delete mode 100644 website/content/v1.11/introduction/support-matrix.md delete mode 100644 website/content/v1.11/introduction/system-requirements.md delete mode 100644 website/content/v1.11/introduction/troubleshooting.md delete mode 100644 website/content/v1.11/introduction/what-is-new/index.md delete mode 100644 website/content/v1.11/introduction/what-is-talos.md delete mode 100644 website/content/v1.11/kubernetes-guides/_index.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/device-plugins.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/etcd-metrics.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/inlinemanifests.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/node-labels.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.11/kubernetes-guides/configuration/usernamespace.md delete mode 100644 website/content/v1.11/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.11/kubernetes-guides/network/deploying-calico.md delete mode 100644 website/content/v1.11/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.11/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.11/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.11/learn-more/_index.md delete mode 100644 website/content/v1.11/learn-more/architecture.md delete mode 100644 website/content/v1.11/learn-more/components.md delete mode 100644 website/content/v1.11/learn-more/control-plane.md delete mode 100644 website/content/v1.11/learn-more/controllers-resources.md delete mode 100644 website/content/v1.11/learn-more/faqs.md delete mode 100644 website/content/v1.11/learn-more/image-factory.md delete mode 100644 website/content/v1.11/learn-more/knowledge-base.md delete mode 100644 website/content/v1.11/learn-more/kubespan.md delete mode 100644 website/content/v1.11/learn-more/networking-resources.md delete mode 100644 website/content/v1.11/learn-more/philosophy.md delete mode 100644 website/content/v1.11/learn-more/process-capabilities.md delete mode 100644 website/content/v1.11/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.11/learn-more/talosctl.md delete mode 100644 website/content/v1.11/reference/_index.md delete mode 100644 website/content/v1.11/reference/api.md delete mode 100644 website/content/v1.11/reference/cli.md delete mode 100644 website/content/v1.11/reference/configuration/_index.md delete mode 100644 website/content/v1.11/reference/configuration/block/_index.md delete mode 100644 website/content/v1.11/reference/configuration/block/existingvolumeconfig.md delete mode 100644 website/content/v1.11/reference/configuration/block/rawvolumeconfig.md delete mode 100644 website/content/v1.11/reference/configuration/block/swapvolumeconfig.md delete mode 100644 website/content/v1.11/reference/configuration/block/uservolumeconfig.md delete mode 100644 website/content/v1.11/reference/configuration/block/volumeconfig.md delete mode 100644 website/content/v1.11/reference/configuration/block/zswapconfig.md delete mode 100644 website/content/v1.11/reference/configuration/extensions/_index.md delete mode 100644 website/content/v1.11/reference/configuration/extensions/extensionserviceconfig.md delete mode 100644 website/content/v1.11/reference/configuration/hardware/_index.md delete mode 100644 website/content/v1.11/reference/configuration/hardware/pcidriverrebindconfig.md delete mode 100644 website/content/v1.11/reference/configuration/network/_index.md delete mode 100644 website/content/v1.11/reference/configuration/network/ethernetconfig.md delete mode 100644 website/content/v1.11/reference/configuration/network/kubespanendpointsconfig.md delete mode 100644 website/content/v1.11/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.11/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.11/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.11/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.11/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.11/reference/configuration/runtime/watchdogtimerconfig.md delete mode 100644 website/content/v1.11/reference/configuration/security/_index.md delete mode 100644 website/content/v1.11/reference/configuration/security/trustedrootsconfig.md delete mode 100644 website/content/v1.11/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.11/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.11/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.11/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.11/reference/kernel.md delete mode 100644 website/content/v1.11/schemas/config.schema.json delete mode 100644 website/content/v1.11/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.11/talos-guides/_index.md delete mode 100644 website/content/v1.11/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.11/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.11/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/_index.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/common.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/existing.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/layout.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/raw.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/resources.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/system.md delete mode 100644 website/content/v1.11/talos-guides/configuration/disk-management/user.md delete mode 100644 website/content/v1.11/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.11/talos-guides/configuration/image-cache.md delete mode 100644 website/content/v1.11/talos-guides/configuration/insecure.md delete mode 100644 website/content/v1.11/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.11/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.11/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.11/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.11/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.11/talos-guides/configuration/performance-tuning.md delete mode 100644 website/content/v1.11/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.11/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.11/talos-guides/configuration/reproducible-machine-config.md delete mode 100644 website/content/v1.11/talos-guides/configuration/swap.md delete mode 100644 website/content/v1.11/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.11/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.11/talos-guides/discovery.md delete mode 100644 website/content/v1.11/talos-guides/howto/_index.md delete mode 100644 website/content/v1.11/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.11/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.11/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.11/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.11/talos-guides/install/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/bootloader.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.11/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.11/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/cloudstack.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.11/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.11/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.11/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.11/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.11/talos-guides/install/omni.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/orangepi_5.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rock5b.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/turing_rk1.md delete mode 100644 website/content/v1.11/talos-guides/install/single-board-computers/unofficial.md delete mode 100644 website/content/v1.11/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.11/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.11/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.11/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.11/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.11/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.11/talos-guides/network/_index.md delete mode 100644 website/content/v1.11/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.11/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.11/talos-guides/network/ethernet-config.md delete mode 100644 website/content/v1.11/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.11/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.11/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.11/talos-guides/network/multihoming.md delete mode 100644 website/content/v1.11/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.11/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.11/talos-guides/network/vip.md delete mode 100644 website/content/v1.11/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.11/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.11/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.12/_index.md delete mode 100644 website/content/v1.12/advanced/_index.md delete mode 100644 website/content/v1.12/advanced/advanced-networking.md delete mode 100644 website/content/v1.12/advanced/air-gapped.md delete mode 100644 website/content/v1.12/advanced/building-images.md delete mode 100644 website/content/v1.12/advanced/ca-rotation.md delete mode 100644 website/content/v1.12/advanced/cgroups-analysis.md delete mode 100644 website/content/v1.12/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.12/advanced/developing-talos.md delete mode 100644 website/content/v1.12/advanced/disaster-recovery.md delete mode 100644 website/content/v1.12/advanced/egress-domains.md delete mode 100644 website/content/v1.12/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.12/advanced/extension-services.md delete mode 100644 website/content/v1.12/advanced/install-kubevirt.md delete mode 100644 website/content/v1.12/advanced/kernel-module.md delete mode 100644 website/content/v1.12/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.12/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.12/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.12/advanced/oci-base-spec.md delete mode 100644 website/content/v1.12/advanced/overlays.md delete mode 100644 website/content/v1.12/advanced/sbom.md delete mode 100644 website/content/v1.12/advanced/selinux.md delete mode 100644 website/content/v1.12/advanced/static-pods.md delete mode 100644 website/content/v1.12/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.12/advanced/verifying-images.md delete mode 100644 website/content/v1.12/advanced/watchdog.md delete mode 100644 website/content/v1.12/introduction/_index.md delete mode 100644 website/content/v1.12/introduction/deploy-first-workload.md delete mode 100644 website/content/v1.12/introduction/getting-started.md delete mode 100644 website/content/v1.12/introduction/prodnotes.md delete mode 100644 website/content/v1.12/introduction/quickstart.md delete mode 100644 website/content/v1.12/introduction/support-matrix.md delete mode 100644 website/content/v1.12/introduction/system-requirements.md delete mode 100644 website/content/v1.12/introduction/troubleshooting.md delete mode 100644 website/content/v1.12/introduction/what-is-new/index.md delete mode 100644 website/content/v1.12/introduction/what-is-talos.md delete mode 100644 website/content/v1.12/kubernetes-guides/_index.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/device-plugins.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/etcd-metrics.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/inlinemanifests.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/node-labels.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.12/kubernetes-guides/configuration/usernamespace.md delete mode 100644 website/content/v1.12/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.12/kubernetes-guides/network/deploying-calico.md delete mode 100644 website/content/v1.12/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.12/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.12/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.12/learn-more/_index.md delete mode 100644 website/content/v1.12/learn-more/architecture.md delete mode 100644 website/content/v1.12/learn-more/components.md delete mode 100644 website/content/v1.12/learn-more/control-plane.md delete mode 100644 website/content/v1.12/learn-more/controllers-resources.md delete mode 100644 website/content/v1.12/learn-more/faqs.md delete mode 100644 website/content/v1.12/learn-more/image-factory.md delete mode 100644 website/content/v1.12/learn-more/knowledge-base.md delete mode 100644 website/content/v1.12/learn-more/kubespan.md delete mode 100644 website/content/v1.12/learn-more/networking-resources.md delete mode 100644 website/content/v1.12/learn-more/philosophy.md delete mode 100644 website/content/v1.12/learn-more/process-capabilities.md delete mode 100644 website/content/v1.12/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.12/learn-more/talosctl.md delete mode 100644 website/content/v1.12/talos-guides/_index.md delete mode 100644 website/content/v1.12/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.12/talos-guides/configuration/acquire.md delete mode 100644 website/content/v1.12/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.12/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/_index.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/common.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/existing.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/layout.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/raw.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/resources.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/system.md delete mode 100644 website/content/v1.12/talos-guides/configuration/disk-management/user.md delete mode 100644 website/content/v1.12/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.12/talos-guides/configuration/image-cache.md delete mode 100644 website/content/v1.12/talos-guides/configuration/insecure.md delete mode 100644 website/content/v1.12/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.12/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.12/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.12/talos-guides/configuration/performance-tuning.md delete mode 100644 website/content/v1.12/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.12/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.12/talos-guides/configuration/reproducible-machine-config.md delete mode 100644 website/content/v1.12/talos-guides/configuration/swap.md delete mode 100644 website/content/v1.12/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.12/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.12/talos-guides/discovery.md delete mode 100644 website/content/v1.12/talos-guides/howto/_index.md delete mode 100644 website/content/v1.12/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.12/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.12/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.12/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.12/talos-guides/install/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/bootloader.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.12/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.12/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/cloudstack.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.12/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.12/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.12/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.12/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.12/talos-guides/install/omni.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/orangepi_5.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock5b.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/turing_rk1.md delete mode 100644 website/content/v1.12/talos-guides/install/single-board-computers/unofficial.md delete mode 100644 website/content/v1.12/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.12/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.12/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.12/talos-guides/network/_index.md delete mode 100644 website/content/v1.12/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.12/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.12/talos-guides/network/ethernet-config.md delete mode 100644 website/content/v1.12/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.12/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.12/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.12/talos-guides/network/multihoming.md delete mode 100644 website/content/v1.12/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.12/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.12/talos-guides/network/vip.md delete mode 100644 website/content/v1.12/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.12/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.12/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.2/_index.md delete mode 100644 website/content/v1.2/advanced/_index.md delete mode 100644 website/content/v1.2/advanced/advanced-networking.md delete mode 100644 website/content/v1.2/advanced/air-gapped.md delete mode 100644 website/content/v1.2/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.2/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.2/advanced/developing-talos.md delete mode 100644 website/content/v1.2/advanced/disaster-recovery.md delete mode 100644 website/content/v1.2/advanced/extension-services.md delete mode 100644 website/content/v1.2/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.2/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.2/advanced/static-pods.md delete mode 100644 website/content/v1.2/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.2/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.2/introduction/_index.md delete mode 100644 website/content/v1.2/introduction/getting-started.md delete mode 100644 website/content/v1.2/introduction/quickstart.md delete mode 100644 website/content/v1.2/introduction/support-matrix.md delete mode 100644 website/content/v1.2/introduction/system-requirements.md delete mode 100644 website/content/v1.2/introduction/theila.md delete mode 100644 website/content/v1.2/introduction/what-is-new.md delete mode 100644 website/content/v1.2/introduction/what-is-talos.md delete mode 100644 website/content/v1.2/kubernetes-guides/_index.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/discovery.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.2/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.2/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.2/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.2/kubernetes-guides/network/kubespan.md delete mode 100644 website/content/v1.2/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.2/learn-more/_index.md delete mode 100644 website/content/v1.2/learn-more/architecture.md delete mode 100644 website/content/v1.2/learn-more/components.md delete mode 100644 website/content/v1.2/learn-more/concepts.md delete mode 100644 website/content/v1.2/learn-more/control-plane.md delete mode 100644 website/content/v1.2/learn-more/controllers-resources.md delete mode 100644 website/content/v1.2/learn-more/discovery.md delete mode 100644 website/content/v1.2/learn-more/faqs.md delete mode 100644 website/content/v1.2/learn-more/knowledge-base.md delete mode 100644 website/content/v1.2/learn-more/kubespan.md delete mode 100644 website/content/v1.2/learn-more/networking-resources.md delete mode 100644 website/content/v1.2/learn-more/philosophy.md delete mode 100644 website/content/v1.2/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.2/learn-more/talosctl.md delete mode 100644 website/content/v1.2/reference/_index.md delete mode 100644 website/content/v1.2/reference/api.md delete mode 100644 website/content/v1.2/reference/cli.md delete mode 100644 website/content/v1.2/reference/configuration.md delete mode 100644 website/content/v1.2/reference/kernel.md delete mode 100644 website/content/v1.2/reference/platform.md delete mode 100644 website/content/v1.2/talos-guides/_index.md delete mode 100644 website/content/v1.2/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.2/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.2/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.2/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.2/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.2/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.2/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.2/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.2/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.2/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.2/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.2/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.2/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.2/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.2/talos-guides/install/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.2/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.2/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.2/talos-guides/install/bare-metal-platforms/sidero.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.2/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.2/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.2/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.2/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.2/talos-guides/install/single-board-computers/rpi_4.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.2/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.2/talos-guides/network/_index.md delete mode 100644 website/content/v1.2/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.2/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.2/talos-guides/network/vip.md delete mode 100644 website/content/v1.2/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.2/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.2/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.3/_index.md delete mode 100644 website/content/v1.3/advanced/_index.md delete mode 100644 website/content/v1.3/advanced/advanced-networking.md delete mode 100644 website/content/v1.3/advanced/air-gapped.md delete mode 100644 website/content/v1.3/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.3/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.3/advanced/developing-talos.md delete mode 100644 website/content/v1.3/advanced/disaster-recovery.md delete mode 100644 website/content/v1.3/advanced/extension-services.md delete mode 100644 website/content/v1.3/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.3/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.3/advanced/static-pods.md delete mode 100644 website/content/v1.3/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.3/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.3/introduction/_index.md delete mode 100644 website/content/v1.3/introduction/getting-started.md delete mode 100644 website/content/v1.3/introduction/quickstart.md delete mode 100644 website/content/v1.3/introduction/support-matrix.md delete mode 100644 website/content/v1.3/introduction/system-requirements.md delete mode 100644 website/content/v1.3/introduction/what-is-new.md delete mode 100644 website/content/v1.3/introduction/what-is-talos.md delete mode 100644 website/content/v1.3/kubernetes-guides/_index.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.3/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.3/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.3/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.3/kubernetes-guides/network/kubespan.md delete mode 100644 website/content/v1.3/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.3/learn-more/_index.md delete mode 100644 website/content/v1.3/learn-more/architecture.md delete mode 100644 website/content/v1.3/learn-more/components.md delete mode 100644 website/content/v1.3/learn-more/control-plane.md delete mode 100644 website/content/v1.3/learn-more/controllers-resources.md delete mode 100644 website/content/v1.3/learn-more/faqs.md delete mode 100644 website/content/v1.3/learn-more/knowledge-base.md delete mode 100644 website/content/v1.3/learn-more/kubespan.md delete mode 100644 website/content/v1.3/learn-more/networking-resources.md delete mode 100644 website/content/v1.3/learn-more/philosophy.md delete mode 100644 website/content/v1.3/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.3/learn-more/talosctl.md delete mode 100644 website/content/v1.3/reference/_index.md delete mode 100644 website/content/v1.3/reference/api.md delete mode 100644 website/content/v1.3/reference/cli.md delete mode 100644 website/content/v1.3/reference/configuration.md delete mode 100644 website/content/v1.3/reference/kernel.md delete mode 100644 website/content/v1.3/talos-guides/_index.md delete mode 100644 website/content/v1.3/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.3/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.3/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.3/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.3/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.3/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.3/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.3/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.3/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.3/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.3/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.3/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.3/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.3/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.3/talos-guides/discovery.md delete mode 100644 website/content/v1.3/talos-guides/install/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.3/talos-guides/install/bare-metal-platforms/sidero.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.3/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.3/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.3/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.3/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/rpi_4.md delete mode 100644 website/content/v1.3/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.3/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.3/talos-guides/network/_index.md delete mode 100644 website/content/v1.3/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.3/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.3/talos-guides/network/vip.md delete mode 100644 website/content/v1.3/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.3/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.3/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.4/_index.md delete mode 100644 website/content/v1.4/advanced/_index.md delete mode 100644 website/content/v1.4/advanced/advanced-networking.md delete mode 100644 website/content/v1.4/advanced/air-gapped.md delete mode 100644 website/content/v1.4/advanced/building-images.md delete mode 100644 website/content/v1.4/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.4/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.4/advanced/developing-talos.md delete mode 100644 website/content/v1.4/advanced/disaster-recovery.md delete mode 100644 website/content/v1.4/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.4/advanced/extension-services.md delete mode 100644 website/content/v1.4/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.4/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.4/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.4/advanced/static-pods.md delete mode 100644 website/content/v1.4/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.4/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.4/advanced/verifying-images.md delete mode 100644 website/content/v1.4/introduction/_index.md delete mode 100644 website/content/v1.4/introduction/getting-started.md delete mode 100644 website/content/v1.4/introduction/quickstart.md delete mode 100644 website/content/v1.4/introduction/support-matrix.md delete mode 100644 website/content/v1.4/introduction/system-requirements.md delete mode 100644 website/content/v1.4/introduction/what-is-new/index.md delete mode 100644 website/content/v1.4/introduction/what-is-new/interactive-dashboard-2.png delete mode 100644 website/content/v1.4/introduction/what-is-new/talos-dashboard.png delete mode 100644 website/content/v1.4/introduction/what-is-talos.md delete mode 100644 website/content/v1.4/kubernetes-guides/_index.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/azure-ccm-csi.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.4/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.4/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.4/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.4/kubernetes-guides/network/kubespan.md delete mode 100644 website/content/v1.4/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.4/learn-more/_index.md delete mode 100644 website/content/v1.4/learn-more/architecture.md delete mode 100644 website/content/v1.4/learn-more/components.md delete mode 100644 website/content/v1.4/learn-more/control-plane.md delete mode 100644 website/content/v1.4/learn-more/controllers-resources.md delete mode 100644 website/content/v1.4/learn-more/faqs.md delete mode 100644 website/content/v1.4/learn-more/knowledge-base.md delete mode 100644 website/content/v1.4/learn-more/kubespan.md delete mode 100644 website/content/v1.4/learn-more/networking-resources.md delete mode 100644 website/content/v1.4/learn-more/philosophy.md delete mode 100644 website/content/v1.4/learn-more/process-capabilities.md delete mode 100644 website/content/v1.4/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.4/learn-more/talosctl.md delete mode 100644 website/content/v1.4/reference/_index.md delete mode 100644 website/content/v1.4/reference/api.md delete mode 100644 website/content/v1.4/reference/cli.md delete mode 100644 website/content/v1.4/reference/configuration.md delete mode 100644 website/content/v1.4/reference/kernel.md delete mode 100644 website/content/v1.4/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.4/talos-guides/_index.md delete mode 100644 website/content/v1.4/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.4/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.4/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.4/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.4/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.4/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.4/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.4/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.4/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.4/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.4/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.4/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.4/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.4/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.4/talos-guides/discovery.md delete mode 100644 website/content/v1.4/talos-guides/howto/_index.md delete mode 100644 website/content/v1.4/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.4/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.4/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.4/talos-guides/install/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.4/talos-guides/install/bare-metal-platforms/sidero.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.4/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.4/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.4/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.4/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/rpi_4.md delete mode 100644 website/content/v1.4/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.4/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.4/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.4/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.4/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.4/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.4/talos-guides/network/_index.md delete mode 100644 website/content/v1.4/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.4/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.4/talos-guides/network/vip.md delete mode 100644 website/content/v1.4/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.4/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.4/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.5/_index.md delete mode 100644 website/content/v1.5/advanced/_index.md delete mode 100644 website/content/v1.5/advanced/advanced-networking.md delete mode 100644 website/content/v1.5/advanced/air-gapped.md delete mode 100644 website/content/v1.5/advanced/building-images.md delete mode 100644 website/content/v1.5/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.5/advanced/customizing-the-root-filesystem.md delete mode 100644 website/content/v1.5/advanced/developing-talos.md delete mode 100644 website/content/v1.5/advanced/disaster-recovery.md delete mode 100644 website/content/v1.5/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.5/advanced/extension-services.md delete mode 100644 website/content/v1.5/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.5/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.5/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.5/advanced/static-pods.md delete mode 100644 website/content/v1.5/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.5/advanced/troubleshooting-control-plane.md delete mode 100644 website/content/v1.5/advanced/verifying-images.md delete mode 100644 website/content/v1.5/introduction/_index.md delete mode 100644 website/content/v1.5/introduction/getting-started.md delete mode 100644 website/content/v1.5/introduction/prodnotes.md delete mode 100644 website/content/v1.5/introduction/quickstart.md delete mode 100644 website/content/v1.5/introduction/support-matrix.md delete mode 100644 website/content/v1.5/introduction/system-requirements.md delete mode 100644 website/content/v1.5/introduction/what-is-new/index.md delete mode 100644 website/content/v1.5/introduction/what-is-talos.md delete mode 100644 website/content/v1.5/kubernetes-guides/_index.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/cluster-endpoint.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.5/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.5/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.5/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.5/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.5/learn-more/_index.md delete mode 100644 website/content/v1.5/learn-more/architecture.md delete mode 100644 website/content/v1.5/learn-more/components.md delete mode 100644 website/content/v1.5/learn-more/control-plane.md delete mode 100644 website/content/v1.5/learn-more/controllers-resources.md delete mode 100644 website/content/v1.5/learn-more/faqs.md delete mode 100644 website/content/v1.5/learn-more/image-factory.md delete mode 100644 website/content/v1.5/learn-more/knowledge-base.md delete mode 100644 website/content/v1.5/learn-more/kubespan.md delete mode 100644 website/content/v1.5/learn-more/networking-resources.md delete mode 100644 website/content/v1.5/learn-more/philosophy.md delete mode 100644 website/content/v1.5/learn-more/process-capabilities.md delete mode 100644 website/content/v1.5/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.5/learn-more/talosctl.md delete mode 100644 website/content/v1.5/reference/_index.md delete mode 100644 website/content/v1.5/reference/api.md delete mode 100644 website/content/v1.5/reference/cli.md delete mode 100644 website/content/v1.5/reference/configuration.md delete mode 100644 website/content/v1.5/reference/kernel.md delete mode 100644 website/content/v1.5/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.5/talos-guides/_index.md delete mode 100644 website/content/v1.5/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.5/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.5/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.5/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.5/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.5/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.5/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.5/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.5/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.5/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.5/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.5/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.5/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.5/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.5/talos-guides/discovery.md delete mode 100644 website/content/v1.5/talos-guides/howto/_index.md delete mode 100644 website/content/v1.5/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.5/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.5/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.5/talos-guides/install/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.5/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.5/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.5/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.5/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.5/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.5/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.5/talos-guides/install/omni.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.5/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.5/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.5/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.5/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.5/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.5/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.5/talos-guides/network/_index.md delete mode 100644 website/content/v1.5/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.5/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.5/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.5/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.5/talos-guides/network/vip.md delete mode 100644 website/content/v1.5/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.5/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.5/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.6/_index.md delete mode 100644 website/content/v1.6/advanced/_index.md delete mode 100644 website/content/v1.6/advanced/advanced-networking.md delete mode 100644 website/content/v1.6/advanced/air-gapped.md delete mode 100644 website/content/v1.6/advanced/building-images.md delete mode 100644 website/content/v1.6/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.6/advanced/developing-talos.md delete mode 100644 website/content/v1.6/advanced/disaster-recovery.md delete mode 100644 website/content/v1.6/advanced/egress-domains.md delete mode 100644 website/content/v1.6/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.6/advanced/extension-services.md delete mode 100644 website/content/v1.6/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.6/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.6/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.6/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.6/advanced/static-pods.md delete mode 100644 website/content/v1.6/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.6/advanced/verifying-images.md delete mode 100644 website/content/v1.6/introduction/_index.md delete mode 100644 website/content/v1.6/introduction/getting-started.md delete mode 100644 website/content/v1.6/introduction/prodnotes.md delete mode 100644 website/content/v1.6/introduction/quickstart.md delete mode 100644 website/content/v1.6/introduction/support-matrix.md delete mode 100644 website/content/v1.6/introduction/system-requirements.md delete mode 100644 website/content/v1.6/introduction/troubleshooting.md delete mode 100644 website/content/v1.6/introduction/what-is-new/index.md delete mode 100644 website/content/v1.6/introduction/what-is-talos.md delete mode 100644 website/content/v1.6/kubernetes-guides/_index.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.6/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.6/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.6/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.6/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.6/learn-more/_index.md delete mode 100644 website/content/v1.6/learn-more/architecture.md delete mode 100644 website/content/v1.6/learn-more/components.md delete mode 100644 website/content/v1.6/learn-more/control-plane.md delete mode 100644 website/content/v1.6/learn-more/controllers-resources.md delete mode 100644 website/content/v1.6/learn-more/faqs.md delete mode 100644 website/content/v1.6/learn-more/image-factory.md delete mode 100644 website/content/v1.6/learn-more/knowledge-base.md delete mode 100644 website/content/v1.6/learn-more/kubespan.md delete mode 100644 website/content/v1.6/learn-more/networking-resources.md delete mode 100644 website/content/v1.6/learn-more/philosophy.md delete mode 100644 website/content/v1.6/learn-more/process-capabilities.md delete mode 100644 website/content/v1.6/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.6/learn-more/talosctl.md delete mode 100644 website/content/v1.6/reference/_index.md delete mode 100644 website/content/v1.6/reference/api.md delete mode 100644 website/content/v1.6/reference/cli.md delete mode 100644 website/content/v1.6/reference/configuration/_index.md delete mode 100644 website/content/v1.6/reference/configuration/network/_index.md delete mode 100644 website/content/v1.6/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.6/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.6/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.6/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.6/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.6/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.6/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.6/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.6/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.6/reference/kernel.md delete mode 100644 website/content/v1.6/schemas/config.schema.json delete mode 100644 website/content/v1.6/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.6/talos-guides/_index.md delete mode 100644 website/content/v1.6/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.6/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.6/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.6/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.6/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.6/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.6/talos-guides/configuration/managing-pki.md delete mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.6/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.6/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.6/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.6/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.6/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.6/talos-guides/discovery.md delete mode 100644 website/content/v1.6/talos-guides/howto/_index.md delete mode 100644 website/content/v1.6/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.6/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.6/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.6/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.6/talos-guides/install/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.6/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.6/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.6/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.6/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.6/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.6/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.6/talos-guides/install/omni.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.6/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.6/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.6/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.6/talos-guides/network/_index.md delete mode 100644 website/content/v1.6/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.6/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.6/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.6/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.6/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.6/talos-guides/network/vip.md delete mode 100644 website/content/v1.6/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.6/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.6/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.7/_index.md delete mode 100644 website/content/v1.7/advanced/_index.md delete mode 100644 website/content/v1.7/advanced/advanced-networking.md delete mode 100644 website/content/v1.7/advanced/air-gapped.md delete mode 100644 website/content/v1.7/advanced/building-images.md delete mode 100644 website/content/v1.7/advanced/ca-rotation.md delete mode 100644 website/content/v1.7/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.7/advanced/developing-talos.md delete mode 100644 website/content/v1.7/advanced/disaster-recovery.md delete mode 100644 website/content/v1.7/advanced/egress-domains.md delete mode 100644 website/content/v1.7/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.7/advanced/extension-services.md delete mode 100644 website/content/v1.7/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.7/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.7/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.7/advanced/overlays.md delete mode 100644 website/content/v1.7/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.7/advanced/static-pods.md delete mode 100644 website/content/v1.7/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.7/advanced/verifying-images.md delete mode 100644 website/content/v1.7/advanced/watchdog.md delete mode 100644 website/content/v1.7/introduction/_index.md delete mode 100644 website/content/v1.7/introduction/getting-started.md delete mode 100644 website/content/v1.7/introduction/prodnotes.md delete mode 100644 website/content/v1.7/introduction/quickstart.md delete mode 100644 website/content/v1.7/introduction/support-matrix.md delete mode 100644 website/content/v1.7/introduction/system-requirements.md delete mode 100644 website/content/v1.7/introduction/troubleshooting.md delete mode 100644 website/content/v1.7/introduction/what-is-new/index.md delete mode 100644 website/content/v1.7/introduction/what-is-talos.md delete mode 100644 website/content/v1.7/kubernetes-guides/_index.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/replicated-local-storage-with-openebs-jiva.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.7/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.7/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.7/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.7/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.7/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.7/learn-more/_index.md delete mode 100644 website/content/v1.7/learn-more/architecture.md delete mode 100644 website/content/v1.7/learn-more/components.md delete mode 100644 website/content/v1.7/learn-more/control-plane.md delete mode 100644 website/content/v1.7/learn-more/controllers-resources.md delete mode 100644 website/content/v1.7/learn-more/faqs.md delete mode 100644 website/content/v1.7/learn-more/image-factory.md delete mode 100644 website/content/v1.7/learn-more/knowledge-base.md delete mode 100644 website/content/v1.7/learn-more/kubespan.md delete mode 100644 website/content/v1.7/learn-more/networking-resources.md delete mode 100644 website/content/v1.7/learn-more/philosophy.md delete mode 100644 website/content/v1.7/learn-more/process-capabilities.md delete mode 100644 website/content/v1.7/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.7/learn-more/talosctl.md delete mode 100644 website/content/v1.7/reference/_index.md delete mode 100644 website/content/v1.7/reference/api.md delete mode 100644 website/content/v1.7/reference/cli.md delete mode 100644 website/content/v1.7/reference/configuration/_index.md delete mode 100644 website/content/v1.7/reference/configuration/extensions/_index.md delete mode 100644 website/content/v1.7/reference/configuration/extensions/extensionserviceconfig.md delete mode 100644 website/content/v1.7/reference/configuration/network/_index.md delete mode 100644 website/content/v1.7/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.7/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.7/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.7/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.7/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.7/reference/configuration/runtime/watchdogtimerconfig.md delete mode 100644 website/content/v1.7/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.7/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.7/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.7/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.7/reference/kernel.md delete mode 100644 website/content/v1.7/schemas/config.schema.json delete mode 100644 website/content/v1.7/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.7/talos-guides/_index.md delete mode 100644 website/content/v1.7/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.7/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.7/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.7/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.7/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.7/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.7/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.7/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.7/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.7/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.7/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.7/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.7/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.7/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.7/talos-guides/discovery.md delete mode 100644 website/content/v1.7/talos-guides/howto/_index.md delete mode 100644 website/content/v1.7/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.7/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.7/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.7/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.7/talos-guides/install/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/digital-rebar.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.7/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.7/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.7/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.7/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.7/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.7/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.7/talos-guides/install/omni.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.7/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.7/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.7/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.7/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.7/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.7/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.7/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.7/talos-guides/network/_index.md delete mode 100644 website/content/v1.7/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.7/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.7/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.7/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.7/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.7/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.7/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.7/talos-guides/network/vip.md delete mode 100644 website/content/v1.7/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.7/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.7/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.8/_index.md delete mode 100644 website/content/v1.8/advanced/_index.md delete mode 100644 website/content/v1.8/advanced/advanced-networking.md delete mode 100644 website/content/v1.8/advanced/air-gapped.md delete mode 100644 website/content/v1.8/advanced/building-images.md delete mode 100644 website/content/v1.8/advanced/ca-rotation.md delete mode 100644 website/content/v1.8/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.8/advanced/developing-talos.md delete mode 100644 website/content/v1.8/advanced/disaster-recovery.md delete mode 100644 website/content/v1.8/advanced/egress-domains.md delete mode 100644 website/content/v1.8/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.8/advanced/extension-services.md delete mode 100644 website/content/v1.8/advanced/install-kubevirt.md delete mode 100644 website/content/v1.8/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.8/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.8/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.8/advanced/overlays.md delete mode 100644 website/content/v1.8/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.8/advanced/static-pods.md delete mode 100644 website/content/v1.8/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.8/advanced/verifying-images.md delete mode 100644 website/content/v1.8/advanced/watchdog.md delete mode 100644 website/content/v1.8/introduction/_index.md delete mode 100644 website/content/v1.8/introduction/getting-started.md delete mode 100644 website/content/v1.8/introduction/prodnotes.md delete mode 100644 website/content/v1.8/introduction/quickstart.md delete mode 100644 website/content/v1.8/introduction/support-matrix.md delete mode 100644 website/content/v1.8/introduction/system-requirements.md delete mode 100644 website/content/v1.8/introduction/troubleshooting.md delete mode 100644 website/content/v1.8/introduction/what-is-new/index.md delete mode 100644 website/content/v1.8/introduction/what-is-talos.md delete mode 100644 website/content/v1.8/kubernetes-guides/_index.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/device-plugins.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/replicated-local-storage-with-openebs.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.8/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.8/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.8/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.8/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.8/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.8/learn-more/_index.md delete mode 100644 website/content/v1.8/learn-more/architecture.md delete mode 100644 website/content/v1.8/learn-more/components.md delete mode 100644 website/content/v1.8/learn-more/control-plane.md delete mode 100644 website/content/v1.8/learn-more/controllers-resources.md delete mode 100644 website/content/v1.8/learn-more/faqs.md delete mode 100644 website/content/v1.8/learn-more/image-factory.md delete mode 100644 website/content/v1.8/learn-more/knowledge-base.md delete mode 100644 website/content/v1.8/learn-more/kubespan.md delete mode 100644 website/content/v1.8/learn-more/networking-resources.md delete mode 100644 website/content/v1.8/learn-more/philosophy.md delete mode 100644 website/content/v1.8/learn-more/process-capabilities.md delete mode 100644 website/content/v1.8/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.8/learn-more/talosctl.md delete mode 100644 website/content/v1.8/reference/_index.md delete mode 100644 website/content/v1.8/reference/api.md delete mode 100644 website/content/v1.8/reference/cli.md delete mode 100644 website/content/v1.8/reference/configuration/_index.md delete mode 100644 website/content/v1.8/reference/configuration/block/_index.md delete mode 100644 website/content/v1.8/reference/configuration/block/volumeconfig.md delete mode 100644 website/content/v1.8/reference/configuration/extensions/_index.md delete mode 100644 website/content/v1.8/reference/configuration/extensions/extensionserviceconfig.md delete mode 100644 website/content/v1.8/reference/configuration/network/_index.md delete mode 100644 website/content/v1.8/reference/configuration/network/kubespanendpointsconfig.md delete mode 100644 website/content/v1.8/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.8/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.8/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.8/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.8/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.8/reference/configuration/runtime/watchdogtimerconfig.md delete mode 100644 website/content/v1.8/reference/configuration/security/_index.md delete mode 100644 website/content/v1.8/reference/configuration/security/trustedrootsconfig.md delete mode 100644 website/content/v1.8/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.8/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.8/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.8/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.8/reference/kernel.md delete mode 100644 website/content/v1.8/schemas/config.schema.json delete mode 100644 website/content/v1.8/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.8/talos-guides/_index.md delete mode 100644 website/content/v1.8/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.8/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.8/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.8/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.8/talos-guides/configuration/disk-management.md delete mode 100644 website/content/v1.8/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.8/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.8/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.8/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.8/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.8/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.8/talos-guides/configuration/performance-tuning.md delete mode 100644 website/content/v1.8/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.8/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.8/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.8/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.8/talos-guides/discovery.md delete mode 100644 website/content/v1.8/talos-guides/howto/_index.md delete mode 100644 website/content/v1.8/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.8/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.8/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.8/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.8/talos-guides/install/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.8/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.8/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/cloudstack.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.8/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.8/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.8/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.8/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.8/talos-guides/install/omni.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.8/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.8/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.8/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.8/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.8/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.8/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.8/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.8/talos-guides/network/_index.md delete mode 100644 website/content/v1.8/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.8/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.8/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.8/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.8/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.8/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.8/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.8/talos-guides/network/vip.md delete mode 100644 website/content/v1.8/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.8/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.8/talos-guides/upgrading-talos.md delete mode 100644 website/content/v1.9/_index.md delete mode 100644 website/content/v1.9/advanced/_index.md delete mode 100644 website/content/v1.9/advanced/advanced-networking.md delete mode 100644 website/content/v1.9/advanced/air-gapped.md delete mode 100644 website/content/v1.9/advanced/building-images.md delete mode 100644 website/content/v1.9/advanced/ca-rotation.md delete mode 100644 website/content/v1.9/advanced/cgroups-analysis.md delete mode 100644 website/content/v1.9/advanced/customizing-the-kernel.md delete mode 100644 website/content/v1.9/advanced/developing-talos.md delete mode 100644 website/content/v1.9/advanced/disaster-recovery.md delete mode 100644 website/content/v1.9/advanced/egress-domains.md delete mode 100644 website/content/v1.9/advanced/etcd-maintenance.md delete mode 100644 website/content/v1.9/advanced/extension-services.md delete mode 100644 website/content/v1.9/advanced/install-kubevirt.md delete mode 100644 website/content/v1.9/advanced/machine-config-oauth.md delete mode 100644 website/content/v1.9/advanced/metal-network-configuration.md delete mode 100644 website/content/v1.9/advanced/migrating-from-kubeadm.md delete mode 100644 website/content/v1.9/advanced/oci-base-spec.md delete mode 100644 website/content/v1.9/advanced/overlays.md delete mode 100644 website/content/v1.9/advanced/proprietary-kernel-modules.md delete mode 100644 website/content/v1.9/advanced/static-pods.md delete mode 100644 website/content/v1.9/advanced/talos-api-access-from-k8s.md delete mode 100644 website/content/v1.9/advanced/verifying-images.md delete mode 100644 website/content/v1.9/advanced/watchdog.md delete mode 100644 website/content/v1.9/introduction/_index.md delete mode 100644 website/content/v1.9/introduction/getting-started.md delete mode 100644 website/content/v1.9/introduction/prodnotes.md delete mode 100644 website/content/v1.9/introduction/quickstart.md delete mode 100644 website/content/v1.9/introduction/support-matrix.md delete mode 100644 website/content/v1.9/introduction/system-requirements.md delete mode 100644 website/content/v1.9/introduction/troubleshooting.md delete mode 100644 website/content/v1.9/introduction/what-is-new/index.md delete mode 100644 website/content/v1.9/introduction/what-is-talos.md delete mode 100644 website/content/v1.9/kubernetes-guides/_index.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/_index.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/ceph-with-rook.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/deploy-metrics-server.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/device-plugins.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/kubeprism.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/local-storage.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/pod-security.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/seccomp-profiles.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/storage.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/synology-csi.md delete mode 100644 website/content/v1.9/kubernetes-guides/configuration/usernamespace.md delete mode 100644 website/content/v1.9/kubernetes-guides/network/_index.md delete mode 100644 website/content/v1.9/kubernetes-guides/network/deploying-cilium.md delete mode 100644 website/content/v1.9/kubernetes-guides/network/multus.md delete mode 100644 website/content/v1.9/kubernetes-guides/upgrading-kubernetes.md delete mode 100644 website/content/v1.9/learn-more/_index.md delete mode 100644 website/content/v1.9/learn-more/architecture.md delete mode 100644 website/content/v1.9/learn-more/components.md delete mode 100644 website/content/v1.9/learn-more/control-plane.md delete mode 100644 website/content/v1.9/learn-more/controllers-resources.md delete mode 100644 website/content/v1.9/learn-more/faqs.md delete mode 100644 website/content/v1.9/learn-more/image-factory.md delete mode 100644 website/content/v1.9/learn-more/knowledge-base.md delete mode 100644 website/content/v1.9/learn-more/kubespan.md delete mode 100644 website/content/v1.9/learn-more/networking-resources.md delete mode 100644 website/content/v1.9/learn-more/philosophy.md delete mode 100644 website/content/v1.9/learn-more/process-capabilities.md delete mode 100644 website/content/v1.9/learn-more/talos-network-connectivity.md delete mode 100644 website/content/v1.9/learn-more/talosctl.md delete mode 100644 website/content/v1.9/reference/_index.md delete mode 100644 website/content/v1.9/reference/api.md delete mode 100644 website/content/v1.9/reference/cli.md delete mode 100644 website/content/v1.9/reference/configuration/_index.md delete mode 100644 website/content/v1.9/reference/configuration/block/_index.md delete mode 100644 website/content/v1.9/reference/configuration/block/volumeconfig.md delete mode 100644 website/content/v1.9/reference/configuration/extensions/_index.md delete mode 100644 website/content/v1.9/reference/configuration/extensions/extensionserviceconfig.md delete mode 100644 website/content/v1.9/reference/configuration/network/_index.md delete mode 100644 website/content/v1.9/reference/configuration/network/kubespanendpointsconfig.md delete mode 100644 website/content/v1.9/reference/configuration/network/networkdefaultactionconfig.md delete mode 100644 website/content/v1.9/reference/configuration/network/networkruleconfig.md delete mode 100644 website/content/v1.9/reference/configuration/runtime/_index.md delete mode 100644 website/content/v1.9/reference/configuration/runtime/eventsinkconfig.md delete mode 100644 website/content/v1.9/reference/configuration/runtime/kmsglogconfig.md delete mode 100644 website/content/v1.9/reference/configuration/runtime/watchdogtimerconfig.md delete mode 100644 website/content/v1.9/reference/configuration/security/_index.md delete mode 100644 website/content/v1.9/reference/configuration/security/trustedrootsconfig.md delete mode 100644 website/content/v1.9/reference/configuration/siderolink/_index.md delete mode 100644 website/content/v1.9/reference/configuration/siderolink/siderolinkconfig.md delete mode 100644 website/content/v1.9/reference/configuration/v1alpha1/_index.md delete mode 100644 website/content/v1.9/reference/configuration/v1alpha1/config.md delete mode 100644 website/content/v1.9/reference/kernel.md delete mode 100644 website/content/v1.9/schemas/config.schema.json delete mode 100644 website/content/v1.9/schemas/v1alpha1_config.schema.json delete mode 100644 website/content/v1.9/talos-guides/_index.md delete mode 100644 website/content/v1.9/talos-guides/configuration/_index.md delete mode 100644 website/content/v1.9/talos-guides/configuration/certificate-authorities.md delete mode 100644 website/content/v1.9/talos-guides/configuration/containerd.md delete mode 100644 website/content/v1.9/talos-guides/configuration/disk-encryption.md delete mode 100644 website/content/v1.9/talos-guides/configuration/disk-management.md delete mode 100644 website/content/v1.9/talos-guides/configuration/editing-machine-configuration.md delete mode 100644 website/content/v1.9/talos-guides/configuration/image-cache.md delete mode 100644 website/content/v1.9/talos-guides/configuration/logging.md delete mode 100644 website/content/v1.9/talos-guides/configuration/nvidia-fabricmanager.md delete mode 100644 website/content/v1.9/talos-guides/configuration/nvidia-gpu-proprietary.md delete mode 100644 website/content/v1.9/talos-guides/configuration/nvidia-gpu.md delete mode 100644 website/content/v1.9/talos-guides/configuration/patching.md delete mode 100644 website/content/v1.9/talos-guides/configuration/performance-tuning.md delete mode 100644 website/content/v1.9/talos-guides/configuration/pull-through-cache.md delete mode 100644 website/content/v1.9/talos-guides/configuration/rbac.md delete mode 100644 website/content/v1.9/talos-guides/configuration/system-extensions.md delete mode 100644 website/content/v1.9/talos-guides/configuration/time-sync.md delete mode 100644 website/content/v1.9/talos-guides/discovery.md delete mode 100644 website/content/v1.9/talos-guides/howto/_index.md delete mode 100644 website/content/v1.9/talos-guides/howto/cert-management.md delete mode 100644 website/content/v1.9/talos-guides/howto/scaling-down.md delete mode 100644 website/content/v1.9/talos-guides/howto/scaling-up.md delete mode 100644 website/content/v1.9/talos-guides/howto/workers-on-controlplane.md delete mode 100644 website/content/v1.9/talos-guides/install/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/equinix-metal.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/iso.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/matchbox.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/network-config.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/pxe.md delete mode 100644 website/content/v1.9/talos-guides/install/bare-metal-platforms/secureboot.md delete mode 100644 website/content/v1.9/talos-guides/install/boot-assets.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/akamai.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/aws.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/azure.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/cloudstack.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/digitalocean.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/exoscale.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/gcp.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/gcp/config.yaml delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/gcp/gcp-ccm.yaml delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/gcp/talos-ha.jinja delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/hetzner.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/kubernetes.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/nocloud.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/openstack.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/oracle.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/scaleway.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/upcloud.md delete mode 100644 website/content/v1.9/talos-guides/install/cloud-platforms/vultr.md delete mode 100644 website/content/v1.9/talos-guides/install/local-platforms/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/local-platforms/docker.md delete mode 100644 website/content/v1.9/talos-guides/install/local-platforms/qemu.md delete mode 100644 website/content/v1.9/talos-guides/install/local-platforms/virtualbox.md delete mode 100644 website/content/v1.9/talos-guides/install/omni.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/bananapi_m64.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/jetson_nano.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/libretech_all_h3_cc_h5.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/nanopi_r4s.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/orangepi_5.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/orangepi_r1_plus_lts.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/pine64.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rock4cplus.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rock5b.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rock64.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rockpi_4.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rockpi_4c.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/rpi_generic.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/turing_rk1.md delete mode 100644 website/content/v1.9/talos-guides/install/single-board-computers/unofficial.md delete mode 100644 website/content/v1.9/talos-guides/install/talosctl.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/_index.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/hyper-v.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/kvm.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/opennebula.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/proxmox.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/vagrant-libvirt.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/vmware.md delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/vmware/cp.patch.yaml delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/vmware/vmware.sh delete mode 100644 website/content/v1.9/talos-guides/install/virtualized-platforms/xen.md delete mode 100644 website/content/v1.9/talos-guides/interactive-dashboard/index.md delete mode 100644 website/content/v1.9/talos-guides/interactive-dashboard/interactive-dashboard-1.png delete mode 100644 website/content/v1.9/talos-guides/interactive-dashboard/interactive-dashboard-2.png delete mode 100644 website/content/v1.9/talos-guides/interactive-dashboard/interactive-dashboard-3.png delete mode 100644 website/content/v1.9/talos-guides/network/_index.md delete mode 100644 website/content/v1.9/talos-guides/network/corporate-proxies.md delete mode 100644 website/content/v1.9/talos-guides/network/device-selector.md delete mode 100644 website/content/v1.9/talos-guides/network/host-dns.md delete mode 100644 website/content/v1.9/talos-guides/network/ingress-firewall.md delete mode 100644 website/content/v1.9/talos-guides/network/kubespan.md delete mode 100644 website/content/v1.9/talos-guides/network/predictable-interface-names.md delete mode 100644 website/content/v1.9/talos-guides/network/siderolink.md delete mode 100644 website/content/v1.9/talos-guides/network/vip.md delete mode 100644 website/content/v1.9/talos-guides/network/wireguard-network.md delete mode 100644 website/content/v1.9/talos-guides/resetting-a-machine.md delete mode 100644 website/content/v1.9/talos-guides/upgrading-talos.md delete mode 100644 website/go.mod delete mode 100644 website/go.sum delete mode 100644 website/hugo.toml delete mode 100644 website/layouts/404.html delete mode 100644 website/layouts/_default/_markup/render-codeblock.html delete mode 100644 website/layouts/index.netlify_redirect delete mode 100644 website/layouts/partials/doc_latest_version.html delete mode 100644 website/layouts/partials/hooks/body-end.html delete mode 100644 website/layouts/partials/hooks/head-end.html delete mode 100644 website/layouts/partials/version-banner.html delete mode 100644 website/layouts/shortcodes/iscsi_tools_system_extension_release.html delete mode 100644 website/layouts/shortcodes/k8s_prev_release.html delete mode 100644 website/layouts/shortcodes/k8s_release.html delete mode 100644 website/layouts/shortcodes/nvidia_container_toolkit_release.html delete mode 100644 website/layouts/shortcodes/nvidia_driver_release.html delete mode 100644 website/layouts/shortcodes/release.html delete mode 100644 website/layouts/shortcodes/release_branch.html delete mode 100644 website/layouts/shortcodes/release_version_trimmed.html delete mode 100644 website/layouts/shortcodes/theila_release.html delete mode 100644 website/layouts/shortcodes/version.html delete mode 100644 website/layouts/sitemap.xml delete mode 100644 website/package-lock.json delete mode 100644 website/package.json delete mode 100644 website/static/css/clipboard.css delete mode 100644 website/static/favicons/android-chrome-192x192.png delete mode 100644 website/static/favicons/android-chrome-512x512.png delete mode 100644 website/static/favicons/android-chrome-maskable-192x192.png delete mode 100644 website/static/favicons/android-chrome-maskable-512x512.png delete mode 100644 website/static/favicons/apple-touch-icon.png delete mode 100644 website/static/favicons/favicon-16x16.png delete mode 100644 website/static/favicons/favicon-32x32.png delete mode 100644 website/static/favicons/favicon.ico delete mode 100644 website/static/images/Git-Icon-Black.png delete mode 100644 website/static/images/Sidero_stacked_darkbkgd_RGB.png delete mode 100644 website/static/images/Sidero_stacked_darkbkgd_RGB.svg delete mode 100755 website/static/images/TalosSystems_Horizontal_Logo_FullColor_RGB-for-site.svg delete mode 100644 website/static/images/arges-arch.png delete mode 100644 website/static/images/certified-kubernetes-color.png delete mode 100644 website/static/images/cncf-color.png delete mode 100644 website/static/images/components.drawio.svg delete mode 100644 website/static/images/controller-dependencies-v2.png delete mode 100644 website/static/images/controller-dependencies-with-resources-v2.png delete mode 100644 website/static/images/controller-dependencies-with-resources.png delete mode 100644 website/static/images/controller-dependencies.png delete mode 100644 website/static/images/endpoints-and-nodes.png delete mode 100644 website/static/images/grpc-stacked-color.png delete mode 100644 website/static/images/harbor-endpoints.png delete mode 100644 website/static/images/harbor-projects.png delete mode 100644 website/static/images/logo.svg delete mode 100644 website/static/images/metal-overview.png delete mode 100644 website/static/images/no-cloud/proxmox-cloudinit.png delete mode 100644 website/static/images/no-cloud/proxmox-smbios.png delete mode 100644 website/static/images/proxmox-guide/click-upload.png delete mode 100644 website/static/images/proxmox-guide/create-vm.png delete mode 100644 website/static/images/proxmox-guide/edit-cpu.png delete mode 100644 website/static/images/proxmox-guide/edit-nic.png delete mode 100644 website/static/images/proxmox-guide/edit-os.png delete mode 100644 website/static/images/proxmox-guide/edit-ram.png delete mode 100644 website/static/images/proxmox-guide/edit-vm-name.png delete mode 100644 website/static/images/proxmox-guide/maintenance-mode-grub-menu-ip.png delete mode 100644 website/static/images/proxmox-guide/maintenance-mode-grub-menu.png delete mode 100644 website/static/images/proxmox-guide/maintenance-mode.png delete mode 100644 website/static/images/proxmox-guide/select-iso.png delete mode 100644 website/static/images/qemu.png delete mode 100644 website/static/images/talos-dev-banner.png delete mode 100644 website/static/images/theila-cluster-overview.png delete mode 100644 website/static/images/theila-cluster-selection.png delete mode 100644 website/static/images/theila-node-detail.png delete mode 100644 website/static/images/theila-node-monitor.png delete mode 100644 website/static/images/theila-nodes.png delete mode 100644 website/static/images/theila-pods.png delete mode 100644 website/static/images/track-reboot.gif delete mode 100644 website/static/images/vbox-guide/add-iso.png delete mode 100644 website/static/images/vbox-guide/edit-cpu.png delete mode 100644 website/static/images/vbox-guide/edit-nic.png delete mode 100644 website/static/images/vbox-guide/edit-settings.png delete mode 100644 website/static/images/vbox-guide/maintenance-mode.png delete mode 100644 website/static/images/vbox-guide/new-vm.png delete mode 100644 website/static/images/vbox-guide/vm-memory.png delete mode 100644 website/static/images/vbox-guide/vm-name.png delete mode 100644 website/static/images/wireguard-guide/example-topology.png delete mode 100755 website/static/install delete mode 100644 website/static/js/clipboard.js diff --git a/Makefile b/Makefile index 5634ea922..0fb9988a5 100644 --- a/Makefile +++ b/Makefile @@ -91,8 +91,6 @@ PKG_ZSTD ?= $(PKGS_PREFIX)/zstd:$(PKGS) GO_VERSION ?= 1.25 # renovate: datasource=npm depName=markdownlint-cli MARKDOWNLINTCLI_VERSION ?= 0.45.0 -# renovate: datasource=docker versioning=docker depName=hugomods/hugo -HUGO_VERSION ?= dart-sass-0.150.1 OPERATING_SYSTEM := $(shell uname -s | tr "[:upper:]" "[:lower:]") ARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/') TALOSCTL_DEFAULT_TARGET := talosctl-$(OPERATING_SYSTEM) @@ -343,20 +341,8 @@ generate: ## Generates code from protobuf service definitions and machinery conf .PHONY: docs docs: ## Generates the documentation for machine config, and talosctl. - @rm -rf docs/configuration/* - @rm -rf docs/talosctl/* @$(MAKE) local-$@ DEST=./ PLATFORM=linux/amd64 -.PHONY: docs-preview -docs-preview: ## Starts a local preview of the documentation using Hugo in docker - @docker run --rm --interactive --tty \ - --volume $(PWD):/src \ - --volume $(HOME)/.cache/hugo_cache:/tmp/hugo_cache \ - --workdir /src/website \ - --publish 1313:1313 \ - hugomods/hugo:$(HUGO_VERSION) \ - server - # Local Artifacts .PHONY: kernel diff --git a/netlify.toml b/netlify.toml deleted file mode 100644 index 094ace47b..000000000 --- a/netlify.toml +++ /dev/null @@ -1,11 +0,0 @@ -[build] -command = "hugo --gc --minify" -publish = "public" -base = "website" - -[build.environment] -HUGO_VERSION = "0.150.1" -NODE_VERSION = "23.10" - -# must match the version in /website/go.mod -GO_VERSION = "1.25.1" diff --git a/website/.DS_Store b/website/.DS_Store deleted file mode 100644 index 2fe9223d99261cacb0e396cd6a92324fccb77bed..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6148 zcmeHKF-`+P475q4M50MaxnJN1t0=sH4%UOXYB36j&Hle_H~$KUk;GFu&oVb{^Squ z+>%KFDIf);fE17dS5}}3?DGD~=ju2qAO&t;0e&AEoY)J;#Q1bzh!y}iM>q`g=p}%S z0bnm26A^)VQh`bJYB4 \ No newline at end of file diff --git a/website/assets/scss/_sidebar-tree.scss b/website/assets/scss/_sidebar-tree.scss deleted file mode 100644 index 42b86fedf..000000000 --- a/website/assets/scss/_sidebar-tree.scss +++ /dev/null @@ -1,246 +0,0 @@ -@mixin themable-sidebars($text-color, $hover-color, $bg-color, $border-color) { - // - // Left side navigation - // - .td-sidebar-nav { - padding-right: 0.5rem; - margin-right: -15px; - margin-left: -15px; - - @include media-breakpoint-up(md) { - @supports (position: sticky) { - max-height: calc(100vh - 10rem); - overflow-y: auto; - } - } - - - @include media-breakpoint-up(md) { - display: block !important; - } - - - &__section { - li { - list-style: none; - } - - ul { - padding: 0; - margin: 0; - } - - @include media-breakpoint-up(md) { - & .ul-1 ul { - padding-left: 1.5em; - } - } - - - padding-left: 0; - } - - &__section-title { - display: block; - font-weight: $font-weight-medium; - - .active { - font-weight: $font-weight-bold; - } - - a { - color: $text-color; - } - } - - .tree-root { - margin-left: 1rem; - } - - .td-sidebar-link { - display: block; - padding-bottom: 0.375rem; - - &__page { - color: $text-color; - font-weight: $font-weight-light; - } - } - - a { - text-decoration: none; - - &:hover { - color: $hover-color; - text-decoration: none; - } - - &.active { - font-weight: $font-weight-bold; - } - } - - .dropdown { - a { - color: $text-color; - } - - .nav-link { - padding: 0 0 1rem; - } - } - - & > .td-sidebar-nav__section { - padding-top: .5rem; - } - - ul:not(.ul-1, .ul-0) { - &, li label { // Layout of icons - padding-right: 0.5em; - &:before{ - margin-left: -1.5rem; - display: inline-block; - text-align: center; - min-width: 1em; - } - } - } - - .td-sidebar-link.tree-root{ - font-weight: $font-weight-bold; - color: $text-color; - border-bottom: 1px $border-color solid; - margin-bottom: 1rem; - } - } - - .td-sidebar { - @include media-breakpoint-up(md) { - padding-top: 4rem; - background-color: $bg-color; - padding-right: 1rem; - border-right: 1px $border-color solid; - } - - - padding-bottom: 1rem; - - &__toggle { - line-height: 1; - color: $text-color; - margin: 1rem; - } - - &__search { - padding: 1rem 15px; - margin-right: -15px; - margin-left: -15px; - } - - &__inner { - order: 0; - - @include media-breakpoint-up(md) { - @supports (position: sticky) { - position: sticky; - top: 4rem; - z-index: 10; - height: calc(100vh - 6rem); - } - } - - - @include media-breakpoint-up(xl) { - flex: 0 1 320px; - } - - - .td-search-box { - width: 100%; - } - } - - #content-desktop {display: block;} - #content-mobile {display: none;} - - @include media-breakpoint-down(md) { - - #content-desktop {display: none;} - #content-mobile {display: block;} - } - } - - // - // Right side toc - // - .td-sidebar-toc { - background-color: $bg-color; - border-left: 1px solid $border-color; - - @supports (position: sticky) { - position: sticky; - top: 4rem; - overflow-y: auto; - } - - order: 2; - padding-top: 0.75rem; - padding-bottom: 1.5rem; - vertical-align: top; - - } - - .td-page-meta { - a { - text-decoration: none; - display: block; - font-weight: $font-weight-medium; - } - } - - .td-toc { - - a { - text-decoration: none; - display: block; - font-weight: $font-weight-light; - padding-bottom: .25rem; - } - - li { - list-style: none; - display: block; - } - - li li { - margin-left: 0.5rem; - } - - #TableOfContents { - // Hugo's ToC is a mouthful, this can be used to style the top level h2 entries. - > ul > li > ul > li > a {} - - a { - color: $text-color; - - &:hover { - color: $hover-color; - text-decoration: none; - } - } - } - - ul { - padding-left: 0; - } - } -} - - -html[data-bs-theme="dark"] { - @include themable-sidebars(white, mix($secondary, white, 80), mix($gray-900, black, 90), black); -} - -html[data-bs-theme="light"] { - @include themable-sidebars( black, $secondary, $gray-100, $gray-300) -} diff --git a/website/assets/scss/_styles_project.scss b/website/assets/scss/_styles_project.scss deleted file mode 100644 index fa93bfd50..000000000 --- a/website/assets/scss/_styles_project.scss +++ /dev/null @@ -1,46 +0,0 @@ -@import 'td/code-dark'; - -.version-banner { - position: sticky; - top: 5rem; - z-index: 1; -} - -.white-bold-text { - font-weight: bold; - color: white; -} - -.td-page-meta__child { - display: none !important; -} - -blockquote { - border-color: $secondary !important; -} - -@mixin code-type($bg-color) { - .code-type { - border-top-left-radius: 5px; - border-top-right-radius: 5px; - border-top: 1px solid $secondary; - background-color: $bg-color; - width: fit-content; - padding-top: 1px; - padding-left: 10px; - padding-right: 10px; - } -} - - -html[data-bs-theme="dark"] { - @include code-type($primary) -} - -html[data-bs-theme="light"] { - @include code-type($gray-100) -} - -details { - margin-top: 1rem; -} diff --git a/website/assets/scss/_variables_project.scss b/website/assets/scss/_variables_project.scss deleted file mode 100644 index 2138b9f99..000000000 --- a/website/assets/scss/_variables_project.scss +++ /dev/null @@ -1,19 +0,0 @@ -/* - -Add styles or override variables from the theme here. - -*/ - -$google_font_name: "Fira Sans" !default; -$google_font_family: "Fira+Sans:300,300i,400,400i,700,700i" !default; - - -$primary: #281D49; -$secondary: #F92A20; - -$link-color: $secondary; -$link-color-dark: mix(white, $secondary, 20); - -$border-color: $gray-300 !default; -$bs-bg-color-dark: #212529; - diff --git a/website/content/_index.html b/website/content/_index.html deleted file mode 100644 index 8777b1283..000000000 --- a/website/content/_index.html +++ /dev/null @@ -1,169 +0,0 @@ -+++ -title = "Talos Linux" -images = ["images/talos-dev-banner.png"] -+++ - - - - - - - -{{< blocks/cover title="Talos Linux" image_anchor="top" color="black">}} -
-
- -
-
-

The Kubernetes Operating System

-
-{{< /blocks/cover>}} - -
-
-
-
-

What is Talos Linux?

-

- Talos Linux is Linux designed for Kubernetes – secure, immutable, and - minimal. -

-
    -
  • - Supports cloud platforms, bare metal, and virtualization platforms -
    • -
  • - All system management is done via an API. No SSH, shell or console -
    • -
  • - Production ready: supports some of the largest Kubernetes clusters - in the world -
    • -
  • Open source project from the team at Sidero Labs
    • -
-
-
-

- It only takes 3 minutes to launch a Talos cluster on your laptop - inside Docker. -

-
-
- - Try it now - -
-
-
-
-
-
- -
-
-

Why Talos Linux?

-
-
-

Security

-

- Talos reduces your attack surface. It's minimal, hardened and - immutable. All API access is secured with mutual TLS (mTLS) - authentication. -

-
-
-

Predictability

-

- Talos eliminates configuration drift, reduces unknown factors by - employing immutable infrastructure ideology, and delivers atomic - updates. -

-
-
-

Evolvability

-

- Talos simplifies your architecture, increases your agility, and always - delivers current stable Kubernetes and Linux versions. -

-
-
-
-
- -
-
-

Features

-
-
-

Minimal

-

- Talos consists of only a handful of binaries and shared libraries: - just enough to run containerd and a small set of system services. -

-

- This aligns with NIST's recommendation in the Application Container - Security Guide. -

-
-
-

Hardened

-

Hardened by design:

-
    -
  • - Built with the Kernel Self Protection Project configuration - recommendations. -
    • -
  • All access to the API is secured with Mutual TLS.
    • -
  • - Settings and configuration described in the CIS guidelines are - applied by default. -
    • -
-
-
-

Immutable

-

- Talos improves security further by mounting the root filesystem as - read-only and removing any host-level such as a shell and SSH. -

-
-
-

Ephemeral

-

- Talos runs in memory from a SquashFS, and persists nothing, leaving - the primary disk entirely to Kubernetes. -

-
-
-

Current

-

- Delivers the latest stable versions of Kubernetes and Linux. -

-
-
-
-
- -
-
-
-
- Certified Kubernetes -
-
-
-
- Certified Kubernetes -

- We are a - - Cloud Native Computing Foundation - - member. -

-
-
-
-
\ No newline at end of file diff --git a/website/content/featured-background.png b/website/content/featured-background.png deleted file mode 100644 index f831a3bc51a6dd8fd522511231126aae96fd9a89..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 738169 zcmYg&cRba9^#8T5y+h`;GP6^*Yj09katW0vLfNiyQ6e%*$jZo;RSDM!QAT7Hu2Ebo zSJt(z-|Oo0{e8dxRR830Ugtc|^E}UZdu(ZLKu>d)1_FW58yV_ehCmp>KcPNQO7K^5 z>la@LL;zx>t9>Ofd+n83=ED0FFXsK7oSA#UGl#jh&Dw5mhOiV;qqga<_XqMMwg`_X z{m$uHDem{29AZumy}%EF1kB!nvz>H=;$=wE@^W>VBv8q0s-i)AnCutFCO+-U)wkA; zG9)uRvtu*3sNBFC180esJBEUycVSUQj_G5k*6II*1IOqkEO|;%6Pr#{!q3%v{e+ zx1Y{>yR01v;JMq8m0Y{sLL~E*$1hP0=U6|{?!#bR^DZh;;iZPbaJ({I2Rb?4kVMxF z1*><0i31PUu<_q5m3-Fqyu5Au=l$<&&StIF49bJZbey3g`}jH^p~WWkNLj1e>7ahN zd}gH2sbF30=karNPkr&y6!cgQpD@~1P2Zva_Fa)Bj?ZYU*F`y0M($K``;8-}K+V1Bww?vhZ-yEnzGK#38 z{5i%m-!BuG)cE&4FE9HM#KupW8hdph#jOYG(34#qd_Xzk272kU(~0u5iYV<&NYJUN zLrL8Yn$5Ea&U+6#EwSfFQ1Jr7T?|oZ-?-GC0mdlwGp3_{O%(4~4%5-Ar#@AST<~y@ z&j-Nrw84H&(azT7zOtN(#(ViYG)DGRS*yA}5o>H(GTG7)NY;^uW3GARUUm@{N?J~? zFaPHK!@XH=&zuL^TaG*j4wDvF@0K+=jI3YM8)Q>-_x$|l#oErhvDb47rr2*TPzV_W z(iZYQKq5ZC1^TJY2P;mZ8!sT(nbJGczyCCgNl)crxG5pVLRC}r@A8qCi6w0Lh3zT! zKhtuFU&x{%L0@rGpKDTL>p1#9&a-VT@ zzq@##+|bT)Ai?#F^wH-U)NJ+CoK($Ulm|NhXs1K8WRJWZqgbI{%5}v4Y%``m7XDs_ z-QFSv)q5bv)eHQ$#@Ne5h#Af2$fGF;Qd&a*}JTnqnU8Dl|)E<;}#QP-9RttCSI9x@@(@Fm4mj=DGYFZ12-3EF5O9V!FqK$0Zh*2EL5&=J}%nP+Txljo#}DoJ0q z^}GX2NW@8L_1+tXmdY8jvXT1qFza?=>!ji2=Qppn0P^+`#b zL3ZJ__x$8IIpVk{WGR3bBT1o#H8CClv2|^Isd+Np6>2XN?&4l}piAuz;W%aTEVGzd z@3X_qAHSGEMvq<>UWS{giZS3In3B;l2ts}G^2_z5ohi%rem>eFC#!6$NTT>Y>8LLf3zGi+u)@`--_GSzH_k8r|p_YAa*@e+o z>m3tq+s4>Eb%hPe5d4n-hBqvPmIW$e>?1~p4(aGD@Mj)ze2ot_BDit7VOMlH5VCZDS0A+672?Yb+;yfm3zo)e$9u77IKxYsnjT}CO3 z^!8e5eLAju)75ro-4WB(+AALX&}oEcu(qXlsv15vb3b|QY^a~@Ka;OAeQ==&!Jjc) zDppL3YBi3Xt(Jb+jwn7hb|$8kk5n|;blRln2S*ed7U(6)2ugv@57sEO{cR1b1>QC) zJ;|)yf%ar0?AWR$qjK~ z#gJBp3Y`^&BSds?<0%4|ifHuq*o6zNOb7J0dT75H{NxAFjBh!&6NOF@`GzqJ2UURH z!-A#D=ukd)5P4!5?V0RGZMo03ukEi4z4tm?&g#sB%0JZ z(0-hayWBEYq>p}{Jw-y(?a;-T>!Gyu!~M6QDBxDA327K!GTm&znW znh*)W=p%6SlmPbQMDpve1tYHq^nydaF>nlph*TdrghzQ(7Vw$3&31V$0nE zBc`8fVY;Vh=JEr%q?#YI_BQmBkt5w1++$i~qB#U+<04SD^~x#qfPi7^)VW!;_|W}m zme7G`5xDAv1WWQUDFGL5dlz79@)!8rLCo{a$mvQA2$_Th$p8ad%xdyUo#&z2Ci0P* zvZLp(H`m0|M#92qx$$g9*NA_2X-;Yb1&1cM|^))Cf4J39b_cN7@VQWUm~wuW zmYFLbTCs1v12<^P^09eIkQDBsG9|O4CtnFz z$6Y_>NPFdXw>%W?Es}Z#vJy`JWyssp^fz03H+K|ToClx3FQ$5Etg_q6bVRS?$9gG( zSQUV->7V!8laXK|qzg>H@Fzh4!lmy(L#Qi$V9Kkwfm6raH>qd-z-HIlzVK9W6c+O% z#46X#wd`DZ8%UoRIF4u6$w|b?AYacg5)pfS1N~v?2@$ll53)D1?qeQ=9vvF+8E+^k zRGzwaHh$9#t%Q?G-s*Q_ikl(w0sHfI1Rv@}dj~fhE#ADTvmy6zmz{botd!#@UHb8i z=-*h#Irk^&3H37M$U2aOAr~cwTZ}kxF^>{_hO0Z*&IjJ<+(tlrTsCD{fx+9X+@ySd zd22OK&ZZx~Z*6Qo6b~VpL&C)CR{eVjzTeka2w}T6buSlIkoS(u!b+z?%5tX1uPy|O zRRml(li9L6Hb(s)Slbx;2k+n*2T7TeBRz($k>c`dDcW0^kECN0fi2boc*zGBxhuk6 z3TvqQ2tJyj93~;wurL@ttNqKcNQ)tp$Z|Af``htwouM};o zCJq@}TzK6uh_%MZPuvwh3vs^0BT6DkuD)n3WO^Z9Vl{-?u;tpscfYp}lM=sif8_c< zexBYy2Q57*xMiGK+u*qRDv^7Q<4g)LT~RTVH9rO-3yKBVyz*|I(zswLMv>ALD@_8m zw0Gt@DthNugA+9u9#=vG^Y4pEt^sqoWB;>zAH!hzzSQb&d{UM?p8rz*RgbC{ru+d9qN z1ShK<3#Fs-mGO($_d>tymVERUrS5k^dIl&ZsCo;woPr`RVYXi_@Y6f3c;)zf==O66 z`I}!xxWrj+m{+LF5AU-!?TAxEysUwcSda@h7c@lr0}(-Qk1*W1rH!*)O+I6Y7lgs} z^=X#p5H7zc%x|nHm1dOQ@D)gAzk}{L3rkBAZ_A@4SrWIKIZLj25qTn~Ozs%+7aR8U z*uFi<*faagTDF?{#9PXznb)JxmAw1qTivBoWMx0DgjkNsuwVC3A@JdyFjFUPC6;mQ zo#;wtqR1K2T~grkn!hFhmzSjvHi1N;hbLmguf2Y!TeBHE>rL}29IKYs*(w;>psZAK z9B&w?cWdh+5hHFyj8L>ADs>zL7M?s}V&)PTt~}naDd2#Y@5bD|ZTaVX6?b>y z3y=#3-becdSX)n(!>=B^(e(W@A8QX62%BO5-}b1ijrqVck0R(yV+bq)Z=l}~&NhO= z?Azx&N1qQgcocd~l4XLZA?Xqm7f4fIrAekS)y~MO$Um9>ZF11@Af8Ts<`I#{_O=(#Ie;9A+8Mxbvp&ly zt+G3|l;Q~TPf$a{7~Fu!=G5xtm;=i46Kmq?lM@g;(M3xIrIP*5LCDOgHMurc5ITI3pp zCAlSOL`VSbL5d;X@~&rn9%kq~yQ)@NKd@%`o%i18+}D$!*%{b3)pL69cMK5%M|p2Z zHu71*YNE>;--cbR`dk)%{lEqFu7Zcq@-S6BWW913g=B9&O-m+vWwEYJ>Hj?5_Dj%m z!BhC);mM={X)wzK9*$K`WX<`dSv-(L{n>flqTd58$dc2GQ9KVY!*1jaCEPqU`+{MR z(0^vX!BPzOwZI%wJSrSLArU096hMHLDM*l4FgaT;xISZaOTV*mW+ha(nSqSqB4R7s zZ>ZEFHc0IfPYyb1?a9FSZoDsJAAaXPe*8*p0~29XOYfh|6dQYQ;1=(FAKKe?1uMf0 zCG@%Q9^6fg$bnt}2r%mu#ec~WjBe0;aGHkQ7j!|H1}3uT867Zp{wy*HP8BvDrX?v1 zWo8x<6rz6&I?WUgBLI@^lt)}rqUU11@O_n&X%^lFZTZCvKAKs^rOorUI&J0Tj)Mg( z*bK8Nl_dj8txZuaY&?=+0I-tV>L{s_w}yKBy$X)eF6hE=<}6l#qv{TgQK za=f58rFx64`S!ZWzbCx(!I<*=4>aK4Uq#${{D9cUvDod)Bc#R^h!R6RO=OG!3b>x^ z$X`AeGr#!Fu=jAEhs;n{Qf#D_*s3hcf}b3#Rr^>DJrFsV&@D>mltxe zld#kOlBve{wszvx(9%Zpca}>+Pa7VMs69jmtfp>h^q~2}O>-ndm%6SFN{?z}FOK(f z*p$7FdVc@dkD&jt4~FvQkyg?sIQS+DBD4$dB4N-ihu1D#Kykl{A*G#{gqrm?89`L>1Fc4B) z{?gY5z~7fY2MY?C>gr3d@XP7SWMCO5hfSk1P0UZ|WoW~Q*$Cm-SEmn5k65+80_UkC z`dVwrn`f1|I_N9m*O=sZ*wg93lD*DSvQQ0a#LiJI!-;4{*%bo{Y1hN0sl?s2og_`d zj-TkyC*I+!r^)EU@h6FT;W`f}HS7l_3GEd5t>ex=s(%6U_ z+pc#dAy0;c^lcEEb<%x*a@TfP31RO4!MXhVhdpb$lMbddBGuiXlY%z1#720NBWay~ z(~g8&g93PJtstH|-Z{L8vG}-HXqnMv;C9ms=_SUI{G#L?9m9;|G)3Wih(}Hrzwsj~ zI0@`&zsN?AfbQB*nr6GNq4+J9Gceg{hY{*~x>k2vCSh+rHjn9?6nRW!#5AMTfmqGxG|DzfP7u>x*<%OJOcdWfr68u zP^)HI9Ye}uIFefajo9~H71P6XwKVpJt+MONiL|Z1)TrQCTN;zxG3arlsBqVAzFZU< z%vg1j703o>t0Oo`s4p8H!UWBA^;KB-m33uuu+LYd4EQG%XQ3W%rV!(I5 zWydChb#cmU-=_LPCOn6qZ3B%$NsbH?`7E#zldJ_3_xS8c3U$)`#;?glxXx$;W%@?x#b?M=i1hJ(w`r zNPZ7FKt=2$Z%_!C(Z6c8VurlWUdYFcWweQ-iYz>Ll2B~zUyb=4I}3%D%?iYfG#CBu zOkU=re#D$C5Z%lHCygmA6ujRn7R;=dbfkq3FuNBdJE+xxmdzgZY(6+3fjCRi-kS4{ z)1k2-x1sjZwYuN()MdcH(R04+XCZkvY^t?m=EK9)?qyCXz)RYvBQp?jv0p!U3w_76mvg3-} zj@!aZ%>KLVTvF;OMn0%#=M7}bhp9r$R8m0sOzc+J{+XG;$;`!K7y=VBx4cXv|Ke#B z$Cd5RjFNFkJ@**j$>pD*;=97hO*8o(r^o=t-bw{HyNwTw`%kq8Fx%sLtHN8@ z5?h{-?k>*U)=yU1O6zO5~Bk) zCkO21To;y2jW3b`6(-sPJr^ey36Nn1m|82v+5ES9WK|J|AtzCM=IHMVZFKxBWf0rQtC$;;!IxGi6 zp!+@b2v?~vVn1ej_#epYki#OA>Nq{DEvb<=xh}QgBQVG(V@gSRTES7!q3d3xg$v+6 z`1P`epmuXk1ArKrxx%0JQ zV6Trp+tqQe(G68F$i4c`bMQUBvTEyUZuc$IuGTA+MX^;&tyV*6(>jxUZv1E^dV0*% zKmXo&y~*W#{|~7cx@3r`_Qbz;c zyNIyY1?N5{)rJunM(h+Wc?<>0TVwe)B+$=94eJ6ujul#j3nH@k#Vf6iAq zt?Dtn#y1a=mo5biL|BrUC`Q7mV4~;Pjbw!N!eCO;iPSlcAx7=AQU~tb9q8fVj`!>B zYOL0Mb-orA%@5zuhONi=$TC3&e0}6;U#(8MB=M8dePE`vp>fl-3hGx0L-LLv;IZM; z!j6aCU49QE`F5;&c~C9zV|^F$1ceVsCPB_j)!1q*cDbld7N+C-=i&|cCW zeDuX6k_h!L7s!!l;Cj+IL}YY)&BxvOVm8Fg1(Wk5x@!&1942$1JfWGY#6T&I{J&&jq&{VMmhE z(qR2bN_CaWx=-gZ2}B@umdWQ~n@%R;aokmOj}3KRLb36N>UfXI;UMMg4^{Ktjf~HgIv@Eqf(etMKZ9Ry;>MhmbhLt1(s1aOw?S`}c zF3AP#{Xc%+1|a4Gov6T4;v)fOF6RGhtK|IO%Usz0mKQ9*R_{h?>2x1vR8b5ZZ#$a@ zuV^A%9jAwUX=j_|cAg0(g}0rB;9ksgEKAI#a$)yQLb6vE%BDYf`>LTE z5v6-^Wg1`A^Q^?8r`VK$) zt7H6?Xg&=8kuj`}z8%B=>359wso`r?$Oo=v@arT35woRLmJvqksl01G`I6fL%uv20 zW1JhM=CMrR$s)O*r{cS3>W8Z%4>$a`u3h)eZN)2-y&@dhf4n2j{-E@B-}39+y#+7+ z`KM^Kfm;Z!-|N)*T3Le10nKmRRpy9$T9JXrq*h<#pod}{N9?=Cl-H7=$EP~?_xju2 zIKZ2SV3RNZIY>y@(6G-mG#V`r4`)hCi%;N}hc`06cyY=xufm`w1cCE1;5dSm>VY$f z>lwTGYc@FN7$s8w4uNaQw=AJ{=Qs-oE8C)j1nflo<)bB*BK#7w8$Rw@R4pwjYwhq^ zeJ`2Fiq~i;u97^7f_;2ZyQ+iVi-Z2NIQ7W0w(E`i#W_w+26cCcb$BQ9Zpu(KtdWoT zz$|*mdj;n8cJJmqscAE?_o-H#X|O1TkvB@0+URABHhi-l^Alb;NPbaeU3E^TpAUSjI$Ve1qn;xhJ(e5jL{x zwv~DHgnGZ?ckj6k(YPj+j}5h277zg68AXry~Ig zNqTBcVcj*M^A=GgeCgSslpXtlO9fjx;aCBcAkRON<$M#76kqL~ALBUg&_j|x_nYC( zpchr!=3;dx1jU)8-tIoWqQa5w`Md1+1G4#i&a|5Cc!(3i6fO4WK7YYd{EZ}WkG}Py zli?P-V|;L+&k7-;Bc0IJeyCX;2x)DiVq zQ(Ru@LJ|XD`RGDrcmb;LYlkvkQs@_#m3^sUpdjo9w~NPRrlaXNz8?TNl9Vi+0!Nbm z&T<#R+OpmAzC%np*=CFZ{3{&s`r^jY#B)+xB z-FQN{BwFM~sVA4r*}=rWnDNp<@L=IddMEmclpl9)7xKU`k<0?(d{x8Y&^nkgyY6C9 zUYGbTD!0D(;qfass+aoDu9YOL^#e8HU9K%d#iQCpk+8ZhjVh<8TImvYLlISj439no_!};OSPvF-jHOTz&n z2L?$=U=JIetqG3;A&8pYAO|Wq<&RNQL>Q{5R~r|=9gO9SLjUA6q>IK?4@FYIj%dsA zHGL}DY{!&t8S8qo=hKjpiHSySHHnu$&#Q2EX*f)Do-}tK>|Nr&F+5!}1t6rU3Jst# z7#vk9U$I`bzM9+Y|J(7i``+b;i8h)9p_iuv^ESu#E@!lOQ>nY#?qXrA8Go~4AD5uQ z>EG_&$qB5w%K)_S%9o#)yFt@hNntWNaZv@fO|<())TduxXTP%)9VN4DMZc-=9}Y9( zs7b0(ymT*6Y2ao%?fKIO9Az@P=UOdK*Q(A zRD41TX}fItmW--jL*yDoYj z)FTwo!*6$=40+Qiw|om+j0E=@MQScTHk8Scdr;r*3dH5)zlO#M+1XrpN~AlgSrAA| zVhVT(Ntk3l$w|)vywkD`sv6Pz06w$r06rgOokozF23SRV$u+HGIP43JA6E031(jlJ z?k_}WwI#J;LP>QEY}Mkz{_m-a(_1PZLt?@oT<<(ow+T@g-3j}te7yznX5|Zm=e^C9 z^zIJ@4mu*&Cy%!m^ac)noTN2UlTH%ipK2x&r@jeV3l8awy)RV z=$jLVO1DTHG0l`2DjL>!T^duW#7me~KAl_=Jhk}?G3F1_BQ2jeo)MJg-%W#WF^ zncK>K7%)<-(~onNZu)w1DJr~C=qM@woZQ3wwj& zs> zkNm_7w6+K28sEpeFph9JAL@f{2q{`VW8VZjP8Wg(FmmPx>jIBT>a?wxSz?F`*6!)!&C9##QglZag)q4sS|UWuthK^&Xcs~4?Osz&>M0oXQOW8m0L`gNy+Um z9npHiL&zMX)FgFf)zVyeNj1(nihNG)qFK#laafVNH+-q^S{;F6wQ5d1?6~klb4KkW$@CRT-|Z$}k25Tq-0 zSDOcx>%RG!N5KOt_xPpw&S;ceOmN)!*y--wcH#y zs3Y?UxWDamed}VFE9N$P$kn&c<1<@>s-^$TOMT3(T}=x)8r~mRB$VagD1uBKZ0KW2df!B+VDXoXWi4X<|>Lkc5x?P^>qKwpDJO!?*9I9h*+CH8cH5@eA?m5n?i}Qa8Wf_!8D7 zbEJwI9ix@a5D&6hrLOde!wKlWb+V?Gb*qh{nv5)Z=fyrZt2Ru+`!8CF17@) z)~<_KkOUx$XG}2Y9O8EW09EnHp9mQyI-R=~Q7#st>bRWu_t`TjD_ER9yHPOKb{fB% z5VwrErJNnI5o)o__Vvr242DOs{LYo1Cs)G$jey>c6X**sF74}Ux22jF1P{65w zsj-|EaB}21&=j9WK}|@sCw}|q!vc=$+ut=jL=>dr^M94nZM}BJD_@V0MIl|TvKq^L z+@8;|zg^mw>=9Gv7ANDB%t(r+v8F!%Yx6?_mG9CQGh*Wtv33cc;J5K%FZJ~vLuQXB zkDq+`&T2@m?*+M0KI@U9F$=_}u=u_zgWXNE)wlcKlZf->S*}#ZJ`Ma?V*$#hJPUFo zehyOgj9_!@ILg;4@jBD^MQ?%atliq(wCxzagMR;Ihb+T$;Dj!D%g{7ABl}ynQx36P zAZEUKlkzfY4s)t&^rv;zZ?rPOcle8scU>hyButOl*##Kp5cmu2Uula^;L>*#6=Aci zQeMw*;^s;A1!~N1!&0xRJyJ!WItYzR`L5AB9j{RVpn>K& z-*r?m`NzH75X7Z}jl7_z-G}E&9nib`Z0Jj+yBV41W5R#z3NLnQ{Y#3dr!!7O?y8Z8 zD;M0E^$^SFyoe$&Mb}jG786(xl=2E~QQJ3H}a`7vC}L(#h90(HJ~%+L_; zpB|roimjyl|P)`U{ecbawEOX?8yW!*FW;d?BU>*MB*rAOx|G;IKoSeqx=#+z!VG(Tn zzu?k2Eh|rm=z^n?mhO0=ZSQkH`;Lo>&GK`1 z)m;v}*=WuV>8P#t%x{_Y= z5)eoj)AL@DtuLPz8l1KpZ2@580f*->r;F$`Y5vQVPHN1ey;Sg~p2a#C z-0)jZ!ss@OopJA!V6YCLuWx*F*R1owkNZqRs+dUs6h>Il%*D%+g7?6P@5!Iv7qa?D zVjU$icAso-#&`R~pzco`gF9k0*yfw0o*Bk*Q*ug<8F$KWFb)&s$pSrmEU`<&wfBHNy8wlqb@g4^8i-ZpPfRCu)bDp*TP7fWjg z=me3CgcFmW7$19}!9;YugruZj`Fjsj5Sfg!`1p^G1uv`9g@q_ilia7X-w`i;d!fuA z%Q&8#KTMBFeABuOZb2cEcgDX;{>-$am3d9LuW9Epb;26e_LGFdHR=3cjW<@EtTE2R zbZk)dEvJ5rLRyHaSr**FJ*4)4IAZWA;UG$~E1ic5#n5n3miWkX*f?QI zPK$Ma*(wU_@Gg6zjDbzz3=X+S;OP9cow%V5K456nthY)E-{VIt&*XptU}gG0Sd07w z=7erCZP?P&LMfq22XyjhsN5{LZ}fbN8&;OvUU-NPps>j%e4Ox|mg{X?6!J=gXTUR` zfM@s+pOF{9mpJKD_8qtI3FWNUy=PlNQWdsccCGsUm6p+;tV&?@u-&hIcVUn{CMS5K zck0RUT6mBKp~?E!;Ld!x1(Bu8^7ba%=rqXyBWPk{$SGf%uh+{~_8cb>P~jzYC_r;1 z)(`uLxMLMtWp1gb8VN`0V3m38lXOvFVA5M8Vhk?Xh~0{O;UVBTqA)Ww1?#O{!GxS2 zaYNpk-NQNp_>V~mOk^1chn*cJ$aY0NRo%v=VUoVhW2Sm+3Gaj!OxMNW7Snr~49i3M zHHV9xBdKLeDe$(NY+0UiG=R1-AVScbPOyAJkcy>)OdHYkZ#`<*XL4b zthAP6BX$=0a6@6->BpG#FdOpmP9t(XUcG!G4&=^<>bq+n3Wlv;jv(s}^<2&dH&Rt5 zuIdrrRCPOyPqwp1?etA|CP`(Ls?>^=j9&irT)BGI1mBg0VLFdr*pVd%+}(Gei`|13 zAK#OEJ46w3`(iEMV<_t>@}fZtV9;dnkL7?oa|Nh_f4S*M=eq0y%94R`0`LLSE_8n| z)Zy^H>N~IIUF!-?oRd$l1)Ci*pnK1R zm&QuXEoUONaLpP|>=Qfz>w;LlS9aRFGZR$cps9CVLOp%i?BVs=Bur*(>{iQrbR4nm z^trLgt-gnoOR}WnY$(5k3VYG^{=Dfv`zKfTkrzzX8hlW$%ISan+3tTxrvj3eBL^asK=gr zO`K9oL_Y3oMlnAWB|~3cP4qDp>+DSJTS|w&zsY7j#==RA){@hY@v1t5uEU@29(J`} zUDMMut4#b}0OB-C|4?>Li-^gjDzb*gua zz)Dyh=+HS41?kw*HJ@0#;(%9at)&z?F=d;Wt;d*{6Xrn?o? zi?>nUy2pHmwoLh|bZbxG0zx#2ex3~JD}l|=+t1Ax`h|v9_fID~9`@?JD>Ls>zf7!6 zmCGxavE^RgHaTijAVyqaL|v`*vOw8qalw^mE`uU}QQK5D^M}U`M-EanrPKn4b$H3h zvKc{#E`V!@eEZv_z5_k%JE|yj5;!_x_dx1?0`x%Lj%kM)rwEM-wUbgCrvO0_0)UsX z`!nwCwj~ODwIP}Y+^U)7`0p*9=%V*_=mPg~D9ID~Hl7%tPZEv{Fg9B7<&2zQ zY3S3dW$r5ulx9>9HZ7&aCUjIE(clvk(Q?^r(nPYIJL45maqjKgP<|3QoSDJsv-dazNJi~O< zOoasMn7*rk>41rgW0u??84LbZ-(@Gc-vKIAGmkXJ!kFQi;%U2Ui}S`ITb(uT&nJ?B z!V}zh7NG_32HRHU)Hd=h3`sj>?pi|%&{B7wR;1RRD-SPrh6>_o8D)3&*u4T{aT^Zm zE>0U?q?*=7C+JD5%?+S-Kp*8eocp_ti~Q#193!C5#<%q2LD}fAVB5YZ6VJGxU#QQz zILCCE3j1E4oKvEz#TC!-A9QzJL#@}!UAvKG-{?=en_oy|E7u(+gMp3Kg?VLX#ZB47 zh_8Z{OTDJ@8BNPK9JB88_gZ8+ui4X>>;t|lT?@3{$|r-P=hF7TY>E*DDiXM-rA4Ob zIRyHH@dg=ls*p*UMS&hmx=0*oFqD>Q8~CLJ^0>@{2C=11u~H3RDZ6f=6s3-snZyNP zr2k$74lQhT-Hl)z2cWnXB!q)TVk5-Vy+jMQ$4Pw7dI0}gV7D677{5njB7G*WVRw&Y zHEE2HHAZk+8qIxb)YcRj)Y5e{q+Mb_>N5Kt6047SgL?X>t|d~8{Eq%*7xk0iKmGpB zSF=553$9-+nGY{rOb6&&y!{b{h%(>4sp*=?2c z6^%3A#+6yiXj}USg1AMU#W9#Of(=fUMIIOF9+rVJp1pmBeKjcDEZDm?E=*aPNo{~? zsa2&!y*l8Ey3LeAPq5PLehc{8IiDD|E60xoLe{~`TDp;usP%O7_v|e>!|I@YY%xvd zC@TDmPc;|(T4@))`~VMQjl?X6R&BRjWVN>z+u+W}D9EnwF>5Fkx-0;34sDJ`vj~PW zr3(GupdA#PDx%XzX@j8IyL2!esZ*MSZ+dJ1!Tcm6u9ZaJN*y|N>>Tt!2xST7@mIKi z`As?_nI$!Mf1!g}dBu|d#$z++!>Z`$hrEf^iN)`|SMWPArxXDq6ogzcJqbgueehPJ zX$h)k96ZzkB<_4+>Xv3?qdm$!UR(WKXXoJ;7rPf9Fadxf&VJd~oefX{y&vMnrRSRo z{LR>yp$%_QrS_M%K>;`928XWHE{ISKXijyvmBOtKUb_8ec+ zPM!of+y)%)6|h{$)aweiu^&mEF`*+@9dFnESgYR^X5BBNq@MJ3^kEq5<>m6VA0BZ? zPkwX*9tU<7K({W=1$awP-+c}J$`<8d?pFKZyE*IYrca?Idb0r%CPCoO3nvZw78C@` z3wJII^f+g3w^o|(`!YDuqp<-e$%$aqA%H401egMgrsZtnZQ<+O8Dd;?dcnZw$*jy# zOvzo(K?vmE?*#y0tZ^eNCTO51+Qw_0KTw=l-dp~ChV6^N&j#F{&SXdK;vzYh7rc#6 zjGVsM2S%5@p|{pr%A%OrgCter9c)orZdSHfMOSIz)cLaySDJPwW~_GY?r&r-jPGPh zj$2&KGDckAx-}K^Asint9)9|EA%51BbQ{^T_Uy^ytV-nOIGRp;qbKuUMLXsG}IdD>Lrl0VLjus5OKwrpPe4G;(4n+AW z1YzKo`25TIi`vlR-Dst1wu~bcFKU8~W1Hp?y>dR`g(Z|cPE+bUFX`@Wx0qyYPH)mk zlb~<@aD9bRhY^}pnhkV2Yt$I4cbIkta&2_e3MUX5`BAzmMBCOmlYQi$ZVoc>|8`E<=$!_9>`1cgPSkPVc}V;gT* zR$)|d(#U6C`;sM`mt(z8MdVY??5 zN|Qcwo?Pq?Gr=~yJ0&q%>WXMr5R!j^VFiIX*>kraP==##!L|>f`53mfBO^AirBQWo zGS|n?EGH;01)8J8n))lyW2fkF714^&;uzWVSCsjfz0b64(O_0&S4TgGLC9RdHDrqo zQN0j<=ii#j*KN@Gg0HZIWHpcJyycwhhD^+$a@XvS+c_c41I4m`ruy&tEb~pte;6vn z9sY0)HkfqnB3#`zv9k8GYHBVyDI2R&p=rIfH)}xb(0vj+lx4f~Jy~F9t>63<1_(2- zRByh=h>?u}dnc~kZmBfS^f0I0=S9sos%dT+5z`6qgb*s+x@HTscx*ExAR6F91RZeW ze+ahzI`Vi=pGbYpb#OT7N+$xE^gZ>zq%okCVpy9j)|&Ohvm8l((2sO_{}uFur2Mnz zj+KAzjp^^q9zUKVvcrJ$Zlo~Z^=RlYC%j*j$xWhR#KlK?7=6M; znW|7ymta61eyjGw5>S32S7}TR^s#$VFP)9ANGb?t>p4K<`Z`up4)*&87-CXC{%-&Zg)i-$_HYRuYK!M9H>4+dW! za!m2fVH|o0`Xc`!P2-b>7dGFMDe|n)n^AHQo}NU9?*#KWrfL7@n~y;5K#yu|i)t#o zQQ?Dd?4EKo_l-@$O2@DeocIeNcq0G-3^%jLq`YrdR0#t(q&-;9sA0)G({bgY#N&2E zmhU9g?B>Y1uOYN&TK?{D@Q*POc)P%g^m*ab51I3CvKgcIZwLCvqzTmM=d+Pg7}ITb zN`Xg7WcJ>_PXFf_uj~@ffQRFrQ}a$I$u;ulE{^>D?3G73I|e?Twx^i;)-iiI zCKvK&qD5;iyY~+`H6pfv7vUS3SD@GZpraXDuP9k>i#3eQy74x9Pv*F2MGr4**mu7^ zr2XCGmOCBh!8HgyDz2&bKF5Ksw?$+(<{eRhfu)a>Iv6884gfNb3w%%V3up^)wsAQ* zd)L$VEr4L%Y$vuvHZ6O=axk6}DXkk1X2_n-BNt4MrvuyDt8Y=vVT#5HP>nXPGnvo| zCec8PDI?8(#yMH=Ws(q0k`r3LsNuujLYl*NE4Y8^DoRRwAhBCrfQZj@7#SVSwDEQ~ zKiQ!^8N0Nryb$a&6(dU==1G6Lcky<<2gBT1vNzwHi3w%Edj`*UlZ+G%lUiVo#Jps} zi{P?4{uP~$p7*^1FLjx4ah zvaw^lI-6zpj+i3pMFD^eyB6$JAT+HT{0?5!C0=@y9*5~75pfG`jckl4rpW8-(v*ZcE(eE$M=an606 zy3ToaG(9ChKCg2PNjD+Ccs>;da=Wf;O^ZRKg)YN)DiOoQFHYM(gm*i{0Rrdf zVc?24=byQT`9CPulC}Y(h8DG7qS=61p5e_xQ2>N{gNY#G;BB&T7&V3@J)BU|$Alz& z*uI|}0e@Ih&yY>tjo1PfApw*9n@4_%QK7EY*x!Y^fdu>d6ol*24Np;mDff+%1&MA% zzj7XjTBcwg!^^#t+R#PToJzMZPI`Abo{Tt`ZXX!Yx>}ci3@9yK=XhXU<+7824*A_N zy>~(h`Ls@ex6AZowQ}^Bbjp?HJkm$rDyc?}l}$5pkZ@3;!kggR^@hDPf?tczKPm zb?&mDbI463$u4B`muuS`8W;EF8c(G%cd3Cl+F-K-$^)N2o!TKG2<*0j91K$=xb*GwOkMIF_J^m;bgg=$Ntpnhr?cn;C?2PvK)G3?YcLK;ZMz?H#h2(DnoP`+;?UnAhz;FXgCh0?3#WKa{%f%^$oNg^ zJ1G%|(%Sg+xLWMBo(>3zw8D0GBIQ~lyF6)fIj($t|-BJ&r$ zy7y|`Do$@MC8B#o=`sD*EQZv$s^DYwbmQ^BO(pA#@oNo+6@&ts^FC~z-hIHTxWd}SDP8<{u)<1f8S;662;@JtEbKE`Y8zM7HttgYy$P!I zZ{7a~=~^jfq}X-zI&xu{Bpv;j&mYYyNMIG+g=E3UqNCSi?xYLfGLCdqGQ)_e#zS;j zJ>Gn3_sBdB;skyNq(~qQX9kl!JE1$_)(Mg|RL|y?8=_>1Lmz_~47UK})2H%e8{)km zD2a%HvelGO19=5W$@Fk#n9_C{@yU}aG}eT->t?n|6GX+WaGmoPX1sO1r;#?(zIwO8 zp1T77n6j;`kw&B?i$giMEmqu-@(b5nXUKC7l^QY-Yi(&heLzz|)XA4#s&JC3EcuCK z?gm}51I?X)nzQ8Y417@*>oQ%G~5{Hurx1S|W>TlIH+I&rZSj}#Db|SRKUj-Dfe|cc^SHVB^FSqefPDCxVB;1|WN}7oFLUqZHN)7H}h5=lVB7UP7%Rnc@(;eZH z4HA-xG zJ$;*9lmrBt50BT}Y>Twn{7cv$Syq_T?of^#d5q)skldm4^EJOP{)+P?COfUc))*QC zcWk10+4oKO?46kZMqtb+*ah30^ee>P4BePGx)bZyM2KN7NY15+kY153=5U0${~ZOZa`t2zXsE7tYsw=*;+qolUTGHPQGc>U7v=>3m6-|7HOJ zwDY``Y5K%1{VPkYNqj}s)UBV#-u8E9dUY_R4+|twp4{uNOe^ZL^4#zHHkGz$IfE>R z=HiU2t?8Vry#WR&Z7J?6*&dtEcb=RS;!bE(Y+*)37m`5#8+BPF6r|TGKhg96!qPnS zIa_$Fk>ncQEC3OU=;B<(-bpN|80ds~RJrhOcGZFBX3pVK&1@ehWRmPZN26EVnfa_Z z{hNpv<;^K7-=%!Q!Eoj_yjWHT+L6)YN+^edOHivPe`AIAlr0+C(&#i_*z%>=+0hh) zEwFgIR{GgL*xKAS{$ULsP!0Bsbi72yv&Lk{p$T_?;vgObpTj`C*@}0+py*YsJD+!8 zEh3?9O9)g$Fml+&i0S}2p}fu#h6LnpB;o&pkLkEXPv@;WP0DHLcsi@={>K^Fcb8Te ziD50aHQ*o+sPSgon=}@0(TDR%6(^yz)xO*$Wl-0l#Wp+pC27%i;LC2%DP{z?I;D@P z$iv3|U!Mb=h36)7WIb>$+fPzPv|r%wF1NGK+P%^*jfwtJN>uakas1KS8=oy|cSPBb z?j&UI>IK3tj0l1zF-jw|!UtRD?YqH{`HhWn_#ZB0+Q1=H@ZznY_`>> z^1uAyNFh*rGvVJ)JCmUf$f)109(FcHJ&sy3>2Bz!b^LBOlk6lh_H%2z4lU+EaBMRS zG;+TDgV$D)-XywxSu088I+tl1D~de>gbYY-neKdNz#^E3IJ72Glk9{nv=_|X%`wtk z5%9Lu;|Np@85>t`Kt4i=`U2w;(qKu8oJET&2qzi%zn2oBYq!X~Q9Yw@j&ZSMlwD{! zGR&i_oEv!VJEFEARDv5izK%ITe`-E;tTF#^v5V(|!{x48QArUz)Pr+=dPL$`oP0t0a!xEl*RM$z65wK)l z&f!cRyen8tPe=Z?qN)F@NnMN6*%4p0jOP^OO}AYo%@2O?wvtLtG#J=e1Mlu32pd^GVNG`}mdv)Gi@FUJZ7w+d7fHvtUX+tA4 zO5(Bl5}F?NOC^S3kwmO8>XA3kp#r$SQLlY^O~9Fh=+$yDY3Q){*+#w+Ikt1aEbvZv zH-f=Qr0(S+Z1Ws-mxCO(9-}G)EF@1C^Ff zkXsrB7k2~y*<}f4X)0;AhBBl)SlY6zWsJ<7l)llYxvUK5oFX%n3GtJ!`P`#VuEOhM=w*e?M7RX}$J(R!sx?6JWp z$Q1!03x1CKK@kC;ea04{rJRZe4o1sX({p$!%!w`2_=hZpfM(g-zv2m}*Q3g&KUv75 zbhYx0>&i!TO7ItB+a(S?($E~r?O)%L%8&EXtJnXSZdE<2d6?Uk-S-Q(HUC5_$Ot%@ z4+?YjX1EpOLuyoU1cDRK*Rr_zU)kIv@%_bRHKrp9gz!gf^~hAT>p0;z%0Cf5oIbd z&+gNhi43MtD*53vHS+Uauw0Pi)fsO+Mma;#dz`&*V_;<)fF!NUF(Uqciw6btyF&UD zv=rFuDjR;1d{T}{`&$2PE@^*bWwX9CuCNY%IiA-*<3Z7hMe3b(z9fonI{=)l@+PBJ z%2WIR?_W_5P$s_!4BxxCjS*$krKceZ6vsZUUj@m^P3K)G`_OykY8Kh_~g2?oP@VWaLK zDFCD<%d?%WCWp-2o$p0KN^2kS#@*OKsHE???5kz$?J2rfng1q?=ax+@eG}W>^8X_` z&@vnY`vu@U5{4^q{pvq1;2e?8w}F1r*BKIZl)|SB)9uUN2MOZE)Ya05F5+Y{OH;Sj zu%NU<4ZVoei@i$R(>0DGE};AV(!OEQ^1`kg9rwCp_gCA<(b#yN?CBm0JfiDkhv>Sc zx~Vb=Vvw}VLmM$3@45QqI-v&5H6B>@U{!d zWr|Lr2o3uGm2XbWaBpIE0ObK&K$ejDTVsNXdmZn2BDA6i34> z8(Mja{YDr~ELM6zq9E{O&i#W|s>OE=Ky74}K&%#odrvWt3g#>#LqT44Aj!SAp2E)m z{>ojsB?VqOAB8U?`4r`(BhH>5|4gWL%b_uc7;Jm%2)50dHbGVwYZItxaWJ4R5!Vz} z=>9}LVa`TwMq&Xu*qKS9L`{=YIcb*c+?>VFJ=dQZY9Qw}2_o)fzgW;4-^+bdbB>dXfHWP}= zA5-&}f-a83M)rZnwKYipcrWll8C@}Fz9#WShpzO?K>i#BWA=9-hjo}NGIk=-QG{Pm zD-GC49D!*#6k<_fG}WU*Pc0{*FGMnrq~N%NuEjs23Rl?QHK=Jg`W<{v`0SYX)AIGR z!@i71PlKGAp?DhSZ@b_N#^(qJKiY5p;MI?7;5| z{6;{ll+AQ@8RXZBB`mj+0$EW9-N}ZEk#G?(1FKYg4OSlohA=&T7kS2EY@Na4SH#&A znLib43AM8JqZG=@W~>yMtm@Vqh&25?s$+{@_zt&q{Ng0GAv?0TUfBF-q-J@q&pwxH zKNF__zjzz+(n10BMKbZX0Q50pR9x;VgHNuIpFi))fGwx)KR>shtRdk)Ci6@f>BZDu zT?^K=FqY#+dVghj74OHdFV#|%lR-T4pj=j1U!^gO*o7aP#B}r~{EIX>mP;LJb*;F) zzYkE|-LXc5SBY@Td!5O)m-)2KK1)}CdVQ&eGzumGYE@R2)+mX;#!+laR3z+|Kgltl z{4A0Qd>}^7q&nAH$3gkFjn&K->apvv9x_;$e^mya$V4o@Y<=moQiugIZOY8^FG?4y z1sI{f2-|8awHNn@_AK>Mg6vW^M&Qme{A*Dp(NbKe@le2{(9boiHar^>GMUZS^{(VI zu$uJudRjGWcwOtH%$E}t*%UH`F_+8n|3eeN4@v$X8r-fr!V0YK4`dEqj&*_0;Guxo z9a*~1?J9BGx=DAO*1uS>O7asU`Cq=$uOz4N6}ew1O&^3468upWHNaRklm@``IZK?INN5fD*)1e{{{Ze*Z*vEPLdyB zJ3xU?fIP-Moj^4nCvd)edI>rXb922?ug)ZOl{kEFgQ|~i?3w7(3(M6m$hbXLqFuJD zH3QrlfO}+O$qaJfy@6+nRbz$q5*`z_0qhcLcJBj=Ntq4Z@a?ap<{6#x%Kz(j$<#7ElOX)gk7@zTFCr+s+^0hl>h^1en zAu>OH#a_jHRXwPMaa|>TczD_1(b$|(J$6V5rz_n4=<#GWXqQ@PZ9xh;M~>2$F^Br5CIg3aSEGYUQ19C`wiaP=2(QCz$(_ zuZ4WB>)K!Zq{8dGcP6P|;|}hEE#F^yU`%eSu|kj9d^QwkXG=>v(qONAW9g^S=@po51dWS7I#zNX25*C}M=iQB⋘S~ zsa@EVrTTfZFrM1D`#qmW)7n9)M6nF?Vtm(%{%xtZ1o_U6Ar^~V)v{_F4_}zsmJX(%>`HwNAq5!^YNp=KTi`IhfAH{Blq))o$i#ETkQ%6C31XNY zNU~Y+66p18qz`o7d+sx^)ST_wyF@c^hmpeaoFgJh(h(pj{5c z=*6O=FNzlVes=%HvW-Z=7)~C9b-6F7Tk`E>G~NjakfJ+Vh{3f2GQi6enEuZopm_xh zQh+!hOiqv>=>|wvruw4AR}!dlNeZ4@w}<+3UbEylNem5t)wN6TRlzY9a{uH6o$&B! z9Q6m>`TuDFJdkcPIG@R#Li5tH&>dEBoRho9kkZ$~X`&(6u%PRiJIgFKW5E?MfX@|b zp6t%2yfT+AKHhsNFXl@0i`IXg@W+=;AkmZZ6Fn zM_l^oCT9wxNDvw`&}P>_B0lr-?jS}$)YvQwq^Qt>(B1#E3L^T{xO6eq*=Rs=U|8%) zShM7g@5u!u{N_27jTSh!|Le{vJScp|Wi^1@qdmDenv^8Z;cOlhRM;-)iK9)p2;WOz zUPORqcKN(!gQF1@l2zPyO1(1imE+Oa(}DPf`9=($-p=25Kn)_mIb{F2%zaBHLO3nm zNv@#?Jh->B>PmiZIz%J0_c9eCN`q48iq7BqXR@1+%w5;vf3~rkD6H=k5UZ@rXG}ut zo4p6ynI;D!J*@8!$9#LfJv9?m|GKPyu+h+rEn$@fQ7*)`R|kY2#>C)Y5wH{)EuaXv zC^m(p0M>S>TnTS}Wmgb0z!ZscTeU`GJ@Xa z9D-o?Ftmg(t{)eIod_n(jm4UE^rN*v>&F+Xm92|P^)opCV9?Cs@#JNuDu7y|8tKo( z25At{NCGHmFZk%5YA(rM1@_r?ebw%VKiKppsurou@Jn=UgGeo3^6H z?RPsF261v$_H}_}ocwh4$l=AH`YTf#auUq(DMQ(hl^M^Sdyf`erFJzIE8Dj3+b#w* z8~?hMhRrhQpSy(}$-`wYxWW@aRb=Z_ES|;3bK?4KKhIFgHUOH!gAYQD@9v7!{1K1o zLSB9W(fB#T5P*y#28N=rLnP51H#uLCc&AeJB@jeYa%`5}a`t;|pyLLig(Gki91{yk zC|G3@Bnj1u^XsLw_XE_D)r&jluLe?M-@W$RA1=Xa8-nk7Uj0dBa)%RX*!tr$lsXI7Nhpcqkc5v;H&}t zx?=@gJ~pGMqcuHv2e$f*; zw379>PK&NwvxCY^=j>u=uuo#6L+$zcR?WH_!H(UBEl?;xVvQLoOm@(CfW-a(f|y1lrC z-bywlp7H*siO%Wdnz+%TnA7MdJpJI_gwkntKr?i9ARz`-!v%`fhddY9+hAF9uC6^J z3bun!atPsIGu|}5*4;H`z4`$y{Ylf89tDCVLI&rgdg->|Ph`g`uIYP;#-I6!VO!kw zS8sDsQZOgmgIMw(h89}&uOj-VS>?5-(HXbF#NjxSM(C%c-cRLMV4641)d%#oz|C&k zCh485l1I1pcEnE1?Ax5G;;eCvAJ9C%h?1_=ZpXdSKTsDY-+t+uKmDU>_R~<%N$nh& z0m)_gE~=sRm-eA+r)d`u==33UaJhUDAi3T!Y4g1idL#YVYy5Y{v2-SZ&3fonHi~eB zNGj^XbWp=Wfa`=h@q%a_%21^^EXthjn3E*vy^Nl}cEZQ{7e7Hi4_;~(Ak6nrBSvg< zmT8&FEO3k6ML0>5c(+CjPU^p+cHKFt7?osT{P=m%))# z&Mqk&X9%_++5QFyJ|Q)ZvuEiXb$$d7V}q;VLY|o zT*M9G}toQ6zfEhg(9QFPEqIH@MYq6x9ZP&+nu;h$MU^dLYNuL(ZFJP!&gsAO zD-aX_Ut?%itQc-#4gW)zXloE~L5}(8{p1G&&XdL^J~sj1K1k&W;mJisi$Pw{;CCT~ z<)XWlz``vKyd_xeGVvzsqlH1RCz^6Bav7!(D6e;NSF%xQ@`SRQx0bq|`&a%*{)^2{ z%@^<0UhPA?lBJaiO9>Rv9l$_AN<$%>yDPQaOg#LExqI$YaM&*)GzOk&^CL4XyP*YJ zX?@gwP6KR3DSFgtA>na9*$Kjb==zl=A)0%q4LDrEPYh!Nm4BAWJXE5A0ZV};!@XKIJBozp!OhzTTNK~OhtZ~%Ia*J9kfh=DygTj=FMxC z_Z#)4{}2_X9L80c4ibkx@F@nvq7R}g90g-%)Yr%CeFaZ~-ky`8Bek+#{Q72m`L)}v zncj1*AAAc5uO`BX<$%YdBVT`nB>omnsC4FvHQ;CEjS*Ua5Mb-a|0 zeo3vT8zfYJhyKdnO6(gYWj0e%OXbaO2JKaoC<*_~ri0@2iCSC0YMD|yemztb#y;i~ zW*Bu%<)34(zVtnil>)7h;*i&1@%?@}DqdxSomzBEt%(am7Z|d_#5HHMcRDP+v@IFU zzz&g0Igo8FR=lD}^Rok8@^s==(VyvH-(CV*Wl@z7%)K03g)#hW85+L{m)i)wE5Cy8 zhG_X5XMY9a$j9avunH>?z=QMOFEn9QU!?@B75R;IpN2f)-uj{#@ghW2nvhV?Ca(Ht56?$hQh3i-jUf z3EI%`6-=0;vhP@#<$8z@%pD4?aHPGePcou5URK)b{?uRKd|`>WUU766zHOrrgnvzj zFRjA9$1c@Ke+$&wn2Aa0toD92l2O-NdsK#}vXq0_!cc$hMbaCiczeCHos$x~J$s8> z2LBl=-9Vvc;hS=QE3cdw*qE6^!Bl6fVsPP+r^R3Gvi#QtRCZpZlGZ%OwU7t6#X6=grN>Zqy70dEu`? zzuXYtZ<_78=j{snoEBs`^(~YCy}#{;xQee6`}g>zy{OGp(2)86id z$98!YS)&SU=B$GRHuLD2INJ4QIOB{ck@YO3IPdHR$W#^y6-J4PsQ|JQfNTaJi%4YB z(>)dX%y!TGW96x+k{u%XCuWG2Ep4gGs1&QDg2)x>$cfRsg@0M9&LmXE9y$}|2fh6P zwFN1oz3}V2%s^l}S8?a0Izay0$z7Bmr~k-b(E~2|8W*c$^|SdW{@8U4_a<6xS8`f! z81_yz^oN^bt0c`&$QNhRY_h8|z3kh^f8Oh?JTRt7zp*WL)C*@H82;ir3}REN`5!`u zT{Q~qqOA_{(-kqJ*!*dGNSf`|p)6 zSt|N(Ii1cKtzVXl`c4OuLTzsnG7OpYSSn4Vf-73whl>H@-(1Y3@iCVQdl}|Q@>)zN zN_dmYn~)O1Q$df!Z23;1&g%~evM1#e3;{nH=k zIpBf;0|rk5Zl7DN@1K!(26IN_f)v_`4po+5TX4IR+;%e!-y@-?Hvf3&97s|?3ckpt zM?o9S$}4J+tG=asdc77Ltt}B*ktjeg(4FnX;uK;vBWdt1 z7++Xwe6sjI6G8m{{H6BhzFqS;r>FN6vw9Z7mUV)Y5ZKN5QnVl|XBMK zqjYG8)uGZVhdf6-?AO3hc2iF$VlWS*#>J_=^oYSSpEwG5;OeoLlkAThFPWkGZv~FI zUQ4K0SRjYP&N2R@TIRIlRWx!>ja&?>vKd0+|>ZtQ`@`YyJJyP(n}afyYpzfga-xm1!3SW z0pHAAWs&7cESGJHWrrLud1YXAJ5sFl;?Gq-8ZUJ7`6k>CUqz^d2cn_3!8ZF>uRQv* z2P+6CDJ8D1jOv!U{phY5CIE&}c(Omm@mUB1oj4C~mZe_$g32i0L;ss{&1M*3aT}{V zqNXworI?DguK7@a{!$Au(59+#=cyN_mTKNg;{?Mm7;rjbyk5JPBN*fp^ygF2$oFOS zsgH?6XCjx7pc|1Vgef>z@(PACW!6#>KnIH4e~YYt%XaB9{4`CvFlOPY%+3195gwo+ zV^%$8O37|Nn2XES0_u5U@P4F3{OwSb-B6wM{WoLof^BHpJ=CSnXC3kJ60R{JmWA#g}wqYliO)S4`hq$ESD5|PcbNa@?C>Go! z3dMscO)ZTEAciK#kV{04rcXo)K#zooY7xxH$UlDWSprLLqU%?>5l5M3l@TFy2Oa@p zE5TfY325vKGc6_J;8D~3#aAVj5~1o{AHiicE5tRcprLy$UZE9da!x%5@t{Yd^x-(I z@KKUurSi9f?_Bpc8tB=9w8znSYw_D<;?Om-Aqh43y`0aoFJl!@npGP5`d=EWt%1xUEy70`Y6jJ#T!TEk`0$AoX6z6jjn_#p+ zvoQd3{Ljml^@l5&Zm89*Md6FqXa12!sEn~1sbFqMT8Uyd?wbhDz^WSacH}3rZ(EsV zC`p)d%rattHMtcbb-4z2Wf-Pff!SZ5c-BMT>en26<*9W*V3!cI zk4`?AZ}%np)#O~0J09X+0IN^z`let9h>IKZW#Ohe3}?c*?GVp$U%MWrKRBLTMyr_`F`{@UuLfisP6;W{QbA{Fa z<&llAZaxDH!ldpC#pQC8sddTUnH~U<$)Q500qE~O}j&olorV0pyB^Y}%pZ!9A7e?D`qYQN1lFy{^8?5&%p#-6m`o;+v)79cA0TSHsI+-H{JrYwK@GhDlm4UxpQ5qO5$05gS` zfa9IOOyf?fXMg<3y7{Pd>j#ERJ?nn&|C()_nf9h%=95YwLGe)F2hYr7+LPJJ(#u*dY?~-G6K5k>}C^AYa{z3%t>mB}afqa9#B33bw zoI*=GCTvtyqN(}8m%p7?^SDV(XdP@k!KfqvPVCHCtD7A@UIo^?HG17VJuuO#vt)d8~<=Gv* zp&GFhOz{O=nf$>gRUhE0e%9~L+)YTOdp$g@=C^&{TI+#*O%vkZ^U@3$O<^%xoUyH} zC-}`ef9TAe>?AFg2V4*c8;$pID zUzen@3mrBg`&V~GLPBM6B4g&Z|Sx|rHmmjA37`JvAqAV%|z<& zd(II3`hQP~i0bkfEzSa8L>-8+be83ffBpdj*y?G|>a25}%OsscX#_<;Q9FcNolEupc38-Iem7fx;I4ljGQ* zTt(;JqL3O~D@sZB!C(sprTN!QRB;)*3-+KM^PsX{=SuKJXgUhlxx88>+R}Q-^6);m zo!-vOa$U5FJzpZ!LqoegG1W;J8GtW-IR-T)4)l0}_j29e(gIB4@4;sB|Lilq!$IoM z%@qZU{ax&PM<0_rgpY>SK#=$NYtS9U{4e=}m;m2Ia`j>(f?afrp;3IXQ4K}U#ys%sxGb-+`NTu-rj`Y+S0$owse`# zef)rjTtL$$Ur=o1R|6{O*&kRuPyy4ehAfBdCZ%G|1Q!*7PMt>2h**P4+jzB)NiS$$$JdL-F&s93GE`6a6cJas`M*7}QUQ`J zd>WyqM*${GA-3HFbNDnu9F=?I0~l}#nWYc+7bgR{=<+D}T~oz#j6opz3B)(>spyRp zuPrNj^5s1nhHsSX8l)dPKW?6#U^8Tl)Hx>49^bBPVF8X;ZH$Y5r;I&RzUI0GMV26HrXMgdI3nBNwz~BXu0mEAL1cc ziBA8P5v=u%m#3YRU^q7@8(o(Vkx9NtM>!3iCbRW;S0^>R(DFiXDAqtG1AR}+ zHzz`6%w4djGaWKz7tOSQ?AB53({cpe!r&T?w5MH6UI|3VX=BP?JTuH4lq)@$Id}5& z&Pbq~eUV3Z?7Nh2P)}Q?%x7``p1D)){v+ec_r?3cO4x67s%sI+x~9|ab##1NP{_U=(>(e4GF7|@Ym$T59##e z&^PPZE72YzZgDO^SPOOyi^fcPcn;@jS++r9B>Xlj79jl~x_M;+HdEYSHhGB0GYIoqzNv z$72GE3%Uf1q&3*N{5Il!D)pKo9|(P2w@mKZ#IN=DWE^c@axwDfo_9FIIc$JFw??HR z@Ag*z<1>;O`Un!{)ccfrp?w;0Uqupj8-{YpE11(Cz8+VK6F0n{F5pB6ucG)xvY^$= z!yTpPVySOB>w*`e{YTmfeHo!|{=~ZAzgWkxxYp$}vI$UiBV+q*{;J>{{HsUd%XY=LFj+#`?+~Acwr{9NZ}7;Za0K*m%fqg$D;wq z9p4)vyMupKXV7&w=q|-vj4objlC9p-O~=3vE<*SB6nzwOztoGG@ZTe;JgPN9f8Svf zzLY9jr{*7v^iHR;%}nOay~`Hbi`IU(Ao$Te4p+{-fcVAoWs9gv*9<{HbVOroaEg;`vBU9PuH9oiKpc%5Xj+ zD~6M@AECrhQXelq{F=&25$nxW78>6*jaMGQZhFiiy@ob#%Po7I$rYVaiCisjBnTA@ zkewQ>qUg`QC3*37UyF4!*5A}jNjZ+j{}5?2h7m``sy?u6`t*4v02isbWqiSIv2}<* zd#<*3-rcD7=7EHQ=WV>D(FY~=3E@rtq`&Y+pLuTvd;W0kOTJPK(2ft|7yUN~YK8q;C>&M;l z#dD^W5>IL)pTxHW<63CDFHxhupyj@iNaA!8b@ThazH}9+Q`WUAYW=0(ocfS+@NdL2 z`i%gv7*}S<|14G?1Fd>8*`pKLQEgB0GCJk0VTjDPf-6&0f_4_k4=q!^==U_*h3C}? zB>V55a-I2I-5h6UnU-|Ca%ZO{LF2=-$O%}DDKJ^1A*Sgzwwa|GdNmW4VQSdo19tg< z6?2>s|HYei?56P4*%`DG^Y>~~Gq%z#zO(-lbs}u~rb%>)ZvN+f=(_>o9`<3o`5J6Z zY@?u6#Yko+&g^OUvMezNL=rRSSzEiQ{ekh7iLi@y!3SdowSr>GNRRXgHj%I?%X=#KQEVobvO#cv70#iGhbjC6WymV zdo7~JtdVBFWzT}9C2U%zJpLkKi>`TaME{4v;m>k&K2N68japx?`vrKP`=^A1wQWTLeE~lVG~W>ar2V8^*Cb7zLZiZUMUkC!=BzyVuNMyRZz{88|hnz zZa4m9tIfR~S2sok-jzFxG>x20p)tiZW)W#-JvGss`@hB>7KyUo^RZ*Amv%Xl*8eW) z7{KDfZhHNlQ11HJ06I~k!90ApC(SV;#z`N@3Ur+~fam4@-pu#rF-)`(3AVZ7#a4K0 zuU>xPeU5V`OmE-+l!%%RzPZo<+xxs@Yv^`A{&tovj&r%}_CD=-3`K4UYC?9!GpGCL zW{n$V?v_^HAJ*>yJ@V4irX0u5B`%0VuDci?9U|Oha7U_aVFg?fGpJVEk9d4C@o=dG zeT}2m(Jx=dpZXA)8+^JQVm~+M@PVid6JuAPGig|nnb5S}YtM3{Li?U(kG3YIL0>W* zl@Q4>96i`5qTib?P?A@w^Df3smA$v-JL8D=#+uw<#(d?N^RjLa$T#pWi!Jn@D@q$; z4D8O_syu2u|8WPf8B;<_XgI-d*;x!&N^G05J@5E_(IhsSwU7RF=RspqW?A+hg>?(L zfy=JOI}}ZyN(WL<8T7(a`XcF^8f^A5-{DP4+(eR-yt5?x%-Pa(z44GM3>h@!x;dCZRYDV4s#On3^XIlvYw=!cT zH08yH8Kr2US<(qAPI=E@F|fQy&9CvV-8M5&O#i0^VEQPX3B%~54&9c-9)}YPec=eb ziFLjN+;GUHnP=IHoqf-Q0snf#y~ELNFsssU^$Fkf zlPmG*J+zEz@h!0RdxbDVTK4+yya?O#d+9RzUh?ADqcZNCsGIlr`~CHEzbvFQ<|jJK zhs0pGrU)i>Z|aeZILZAW-4D*Xb=zSRp(!w2XiaF}CF)k45Tm#s*K?T8CZ%w?5ElB0 zKU{#8u2oRX6yEq{5mdQ9u+8zhT`*_YReini!8l3}I?NmYw(!-<7^m2^M}PSHjFMxB zT^jY1wUeb+>#X4LYe!56w+@ejMJ>9@QFjY0!Zus-0sRq8xN~cJs8#N62R zpR{5P4oFG`DpjZD@a|Zq9`_2@m$y!Mv zvg{JN?wBZbI%Cj`PsvgTGu8g*v)|6cF?J%!RsN%ppLwfNY}M&WY8)7AkBp@G8v@0{ zciL0uB8oxit&wU!Hd{+rmSu7=0IVnZ$!sUh;(aY4uUX1nH9nZxV#-Z-zpg#r*zq-MjMO2@jB@F_J%Ri}8z-p4KHm*S@eDb@4D9c` zHvdtdOF!=QVQ?iGNw(^_vnxWr-?fG64SdfQx3kHSQq(x+7d#fUA*A%ub^4WqJmEm{4w7(_9pKCN9K$|`_ z_aAf9?fklVnmEnRbH@cj+!|ooX!QJhXLIqG;T?+Qv1hes3rt@r^F(t!o*gyP zoI@x~>upnZy_N6oQmn~r>_N;LV^wdlMLnS^Mcl-vO3#Psu277;yahtjFmXSkBz2s6 z!rkJeL}30Eq8({D03K1q-lH^&ke>ssw^?ZEBphU+tVT{?$;=Ao@=|7-Pnn-_zcNjETz1c4$S5h0Z`JIEX*=Ld$rEYU)$-{vTHQ@;qF{mnPg- z@2dFBjB?kY!%cY7`3NVGq<=EZ`6ezVS&icje4hSCF}KZKH&sJgeK^FYMrJ?2;SaTz z4P&52`YTywHrO&r(C`;VI$9$xdhAfm`M5QTimiqRA9tem^m(iKT{8o|eVkJ+V%FZ~E9owj5P z>yFFW8kd!Hj80Z#{SN~8@s^3>kz0Ba)?06a7c=F0lV-j=MTc+-B2blSTp<1&2fh;G z;mRZ7W6z7_Wmu(VDB*k6-nmb(cr76CwpoZkTHs%Q&OpfJigfztOv_^?bqj}WOX@}1 z$^9=ta>wm>XW8>?rX)Y-gZMkID}?yC^Q7M<&WGC7=!bK}p5L2|VHBnnDnV`D(0v}1 zHacepd7>!LmxIl4;4WU#m+#;1%`bg8Wd^fQ=4h<76WOM6<5&*37;pFRVUVQr ze{d}6e-zQ$Xt=5B(pHN>Y)_6(?@+DEbfazzL}cgqjyoJTb=%z7BmUCcprYS9sg%l8q8xCi^|9luy`Q5Y+wt?~Ap40l|0$@>;B0Q6e>p1n{4m`bN zlDI`dQ}JFaCW5Lnk)kUYF%wTczt^{cldovFYanO=FHl1+dQO6vzrz*4XL~QuSla%K z%LB8kI9tfakOFqrtLh!#@ss5S{bhGOHg~tXL~1=gD%6iK{{L~*fzpSQg|CFD6k#J? zbEE#${v=JsCdGhYXp5(-C;Q#$J{8k_9%8Czz6`Whir~_FQ*bb*2BI@wt7_=p8ulkq zx{8T-x-@DwV{xXdF~pHWTe`9_>dYjWNdd%}&2gF}xXNq5%>R&pV$VePNzA4!jj42* zM?*LGPMbhvH@772X~Ze|`c&grDR1+?e==hozH2$Yiyjg_`rQGu@TRRSHgXNzt1LC? zOf$NG5D`gkB(1#rMiIpD-F`CbZHG8pXbWHAfQ&zV6Vnw=$@8~MZfAXhtRKZX zf1AOL??0X%;%YmWKYROOfXth6!wR?VFWFk%k;?DvI6ldFef~xwZCH4JobP_oXu+VO*tWX1!;@yWL$V*v3^X@n zmTO)nGePiqz@frrlVDr;o^1SPi_F;;2>IWH3s`}tNgB9Qwh;dFG)26pRoUXKN&i5h zi_;_D!`AQQzrD#_0HLMT$z^sJQjMPot)MS}AAe3yxFG{l&ONpTwuHz%S?VC`9zWk_ zs((CVUUKCxYfefzN_QR3$JK1I_PXC;3A8<->FeLVabKmtn7?j(fX6J7ZYOc-&~snb zvogXUCg<3TARc6uhcBl#6|cT4i^RU%wBlNMnEYH2@EId6P*`U74o`&Ms3 zsh^Nv7+a7r%{&qav51S;GKhP2UkQt*WDDa>KSUd{g{s$03kE+PU~%Mfdb#0wS)w4F zw}=3|7DWR%Fa#*zdfnNwpBwJ#N!(Y&*V~~);s;dQ6u_Si^?19_2mYA6BNlVT#=Xn z^GEJSzG57YW;Cd~=+w_#zm+1S5^V-lw|&hs!(QH&YBAvp%;}9Q7tmgX%f1wyd84-# zYgL_1l>AMZjS3=p9%JYExyE=oN-gP&8h0cQjas9o$^6QDe)SMOPAh`dLx73)0HtSV zT#?T^q=@C{RY7`Xwxs%)QpBcny&F)~$>Pyr=LHWQlK7h_f%~Fijj>^pUysYQ>!j@s zLtq`EhwBZTW&4)LYK0x-;9Cy6y*3;10n+FC(-aq+_zV&*7)s%_tvQg{9geem@V75R z=AkY2-gsG4Ah<%c2~Yl5c5xhho7DDa+zAcp>YXFJukCY$S~AX72ow(l0WOF_o!`VB z_lUp)xrGvrutH|BtHgj;H#4 z|2MM9NM`mfg<>%P-eA9u?g88c088osA9MDIA11~UJ#)NQT!)~)+`ex-{y zF@-mg2Bb1VA>|Gicw>KBA3dlEiX$KXsjqQvnWFc+&IIkNs7t+|22xrlMxh|Y{SQY_ z{P0qnPt;=cO~I2Edp+`b8;5m-q)BD&)5p8hD--KXp?1{h!p<8V74YI;+i3{Qt^HFq zjo01`S6ot2YF&qYAYO_#%{)kKM1+qz_P(+WwFk#W@x;_A|Lnwea%#9a9!pD{ebP|wI*3RRYQW8oe9zN<};<5o=)fvEM%FddzR~rQF}iO+Y4T0 zV(vV;G>09g-YIV69{{_{b)6VxCMaLi(T%Gsp42cX1^09Eb%h)2(#lBxo{1u=vEJ)k z?Tp1F*(MgKAg50=Ns3t6wD$G@TfFF=)uQI;eOade*upP}tF$K&f-~S#^wop6`Q?Q0 z`R+}2s!>qF=N<*shRrn6{5;bpL6JnzxTj7{efx9kx}LaWeKyq}$=>4Z&JUU@o@G^P zP_1}gI$GRwKVnV&C-kl?1kz%5XZk5>azOB)E^X>q>AQG_{zmCDkkW1XuRUNPRUmHq z3iWsW-OLAV0aGR(f}1dp_g>&vEDAqV!OHH|(;?sf+Kv|&>ez%=?!k$7`G4oy4F3uy zq3ozhqC;hGrw`d~Swy$VplviF5i(>h`@mnvNk>`7J*gjWM`(P?KVXfHVqgks44*;C z+b?T#SEM=`sfd$~vA6_}Mx>KI=8k>a?<&Un%Q-<^EKEOm#Pf~&PrsO8f;dtrlOkbl zv;>7L5kaoQS(L8rSsS%iknIK7aF@2SPQG-OH)5`N z1mRXt7o8kR5WMc71LfCf;&NQHeKkcnPE<=f1_c$KxG*@-c$b#Ov z^1a+B+3T?2*IbvdE@-Gn*m+ zPHb)X?PTMRrQ@z{4hmg|#S~qA9gu+Fv@G?FbYB{%K@>SHY9p5|xy$?m#y!L7c{`2* zIZB)G%CT3|xne48F^|>As$Bon>I@hs3N76O9Ia%8|5XA!4M>Hiz4f1=O*iG!!;m(r zH@ttw`i~szdTZi}i|a*io(26W37vDg?!L1UC^BLaasQwQH`k|fX_#Oym1HzA63{ZA zi~2zMgm^(}W!3o*gl)(>^Q*EVic$D&dAQ9v|{b0F&+ z!&=epS3?8hPSBS-@Qkf$`oUo2l==O<4cJ?ii|Ym#KI;aHAfeqT2n_GB#ZdKG=dr*O zr5vkaFyg*F<1Lw}8>A!C1bT254uRJnuO4;3;zvMiPekJX0i!DQk>332Esvv2(l?|B z@`EIPiM%eqxT`O6%bgBfpnW&N+js|)JU|MF-44D{==Z}+2dFr(ko8b{#u-mcy)1a& z4%!AXv#wzAgG8*f5CG!#k9~TN(e*=5r6}=Nc3)^W&$-I^`fM~l)7k!4<*VWQviYFi_q+WWn;K<~13uPvmn-7^p%318b#I>z zcO`yXO@WRqnRhAutypupFa4Xmj6XPlBGad7_M)~rF{#)5=`-3@=d@D0xYiT5qNIWH zi*NitB2RaO+%{Q3x#`8UQ82qVXYs+b3otQ~(k4>iWy|arFXjIFl0A9(;d3KD+u-rL zPzCc^bhGB)Ef|1v&-=`3uj!RfKx5JQ?5XnmVYzJG04$s#B*#17t`9caFDG_u;Nitb z!6_m6ve?n&5r4+rL#x2l`k$yVYXU&df+zfB#vvEvw$;O3SH9KFob{^-qa46@dYdBI zdCan8cSdz;J04)5E&)B`j3kpK78-7^(uwAcyEKwcv}1B&*>6poIJ`8T>gu4-U{F4@ z`?sN#@YA#3N~d$C+c!c#n%C0n%F;_#aR@+b1s=&S&rhX?2ZhlycAhFk24cnmv5lmY zw>zr`jD{S7OLC}p34%%2e}hP;hM7PuD}TZrY;h0DdXI@--4T1BwI=W9vVi^d>G15) z-E99;>-5oO#zQ%8)DdC|#Lk27^Sic~%ns`!c`+f#MF`2tu1Gu+^zk%Q4=&Fk6lH}w zx0d)vp?xKlhT^eEc&ovemyVx*+(zDgQz!Ma zldl(9@N%D6s1Wy1uRbK`-18<~8U58VggcFe7OH2{$Ap2YU9xt;g{wgYRj7jBAQZSPn_W4!Z zwKx+ByZA!-HHy-W(D9I%=it|a_LPyPz{x{%;OSI{vI^559^-~jnV|2Q?J(|DY8Oc+ z=n2Hs!HDx>VYScSsIR75*>24rK2mv4En)x->&=XdJ;&Rc9Vo%lP!U3Im~7^bR=`<) zZP!BZRoxpD8)$~k1zPi2h{yi}fS{t4Fe3FQS7_L4T+qO`cus~SVJ~?yB3}Akoq1iq=rW4Z&&|LCksnT9 zV2fevQo>aL(NB%JU<*TsHGMXg&AkHz4W$E5qrTHygOU1H=yMc149d1)QzC(CbMUYb zUx&wx{j?Ngzje@f3-kN1)zOpO-~v1FnVl(gSzu;5io=#5z0h`?vU-QQxSDhFLcHGn`QOQnHk_?&|Y8Y5_n@v+)HHazb+`brd+503kvpP4?U z-usC6FM-iE;hZ*)+%^89papW8#ayXQn*Ih3 zh2c@c2Ho{*n{;&c9~$V%$u$2BZxcW%BQHUyq!a7GH(_5po2>sHc%Il;nk3vO)KhNe zf>I+Kl9ZRJ<74)7?hnD?=+V90{5JmQSC8SHWiQG#<&7xdZu1uG)llplFK9LWYJE;n zN_lc7taryWZx(5j09OYQPY9B*R`j(($!LTT1cOr-q<2|;Nk^v5OX>DeN=p7%S6=Sg zs&oeR9{a%fTvA=(8LQ)mAdzUouGw_rCZdDCefJKxJ1yQF$C(bqhHv_cYCn(A8oI@> zo_o8m{YnBjL`tsp+UNoqnGm>=muHKOjUk6gF<$p5yUMh+ zcQ^I*FKp!oDkT5PWb%7DGM)qqica~s$Zw3~cNugNHNxr0y6JBHO-KNnl2-(iT0;)- zlhWntA&%0=Go-Z-)Mf&%I|jZs#>{cr-C&qaCUQxgz5bJzd*o$-&<(ozuz#ccCdg6u zH7kkYvc^PX-Or5sLCCblAc-#?fseR6<*m)(kbd*Sv!BeRn2<*NefTX=qrO@PYEC=2i2*l?KR)wk;#(2{Pm_!)g~_I zPphyo_)YBSX{;ys0NhcU$JUOvxXH8oUwCD4EmixEy@A5Zm`Mdzm7=~BP)EQYvT!X& zsimqvWDV=Mq6VPU#+da#?2PBCDtP%ErJZjfXxwtv#_M3{W(PS72#aLVp0e{WN)tM< z1qzd{l$dq@@6FNwYm9*NCx4b@i{Cw2(-NDh!Wt%dVw-=`@Y2aXWMd>SU2=PD8jfB1JKBh_ZEMk7>6qqt*AWw=%2BJCnlt(|0S zZn^WNP8!P81cEb!K*&8<=Ckb{Q9?UEX92r}^drVtz4($}0=AT8h-P|&U}f+uaH97g z-G3^1i^(~Gbf6Qtbe;xM4-aE%J5E`ZrH2+qQJt7=xoUo-O;e<`yX)e)#^*-d zdi{gV9$hyHBqGi9z1GAg{81-feu0-{X9e8r*LEEQ-_Ct22P%$xMO(;Gq1a+1$ zMy29EHuwL+WnfXa;_{=t@Q1lvER40Eery!y(_o0R=-`8#ZG~H%MNU7p!CS6KvS;;^ z$eJvE9!62#e%0XoZ}07sP0HA?kZGaf>t!|yH{mLxAV|(v=fA-l3m@nac+$>l=hPOh zgYW8ttX~xNd)&7@sg>GPSd6QFekL~Gz0I-rSqKv$XAE}@)SE+h(jk00 zT|P+*k#vP2ZrrLJPZ}D9sl3P>54b;CtCkx@2W?UPAut&E89*=kYI!0XboH@veadVG z=l?N8*nZ;`lUcrB=jR8B`KXM}#SX8+!^Dy}b6u{;_G zd{)<7_h}X0*jO>G@oN2Jd*Lv5pqL%rhz716%b0(5ONYF`wSB1r!+KG&n$qw7n8skc z<us= zo>9W@rjDy$x)v|(WZx7ZB2W6gv|Rw8;Iwxq@H9m6nDE@LwRotHl?a4 zhrj-H#Udqs)Y$jF)ZZ#wa4R2hEKucw=y2VM`TTClH|qOke2fgQ0lHXo+>G?2@;*6I zgy3+UfllHV)+Hy$Y_{}y(h;;pvD3#Gi)1H{6zS%fAsiJ1Pa)mE4AE5q|5Ezn19C8F zvr+L2+G}f(@6iF{gb>+`XQ6J1{^L29+GDtU&vY9|)&=3VeD|RIKcF zFZWiDefOI58t!+AHOKL(L`|U5>-R2>9Dn7(1$>kpg&9E}-4*bkmr!)6hv4EWnsjmV z3|LLZxcN_E`@XwcQ8gkeTwGCVmvR17UzS4=Fy zRTe!r&HcDuLaz;vTc}4TI0ifU(zeCoxLKK6jrP%-9^~cinSImH6KI`xVu3@EK@8J| zjAp=s>rU8bJ`J;YW*`y;u1b*s!zAw4j^ryTWusZ_aEYB07>Y8}R+|s7TK@9w<6eo+ zNg>3EuhQKLW*1bLLKpfccNv!_Y+Q^tdR`|Bfgnet=;K-;ID5>(`F$=^g?DO#8SX)> zs}j**W1x#nU6TZ0;9^RFvepk`0)G=z`kJ!mI98aP$l zA(o*1euZGcG|-ym?*36D==$AQ|5bh|&+AlME(D9cigdXrUUGT%A*dF1W2-6(DugiT zby_BY5n>_12C@D0%B|Q94$6+Lr#3|l;b^l$ z`hdw`vT(HTZgQ$Re|2-1T-6E_6cwb$lqvItEV8BmPH5E&R&}i8xFX$X*gM4E+C_1{ zA=9)u4NEAK2s?7P(IUOvA|Q1(dxcy~`;X4QHpxsFUF4@>ck#n}o_B9lyF@h{t7wg@ zQMoeR^0l|^ioyAUn(M;Wj_+sCe;B+B6|~H%0|p!Wt@elSP=!rn~zsy6JGhhLcL!MXjuBuw5f8Rm9pbQ#^WV%oJERSZHt&X8 zA!-89^+09*$a}1_SJZxe&jQbyX#l+ zjy0nK=xR${R^Xo3e1r7YWG)63ueE_A5zKvHBj$&$j;SbkdDFpz26@bC#RM0xzT6hm z_SIe7wu_mS`^FTpd-kBB4CT%C)vyciW9;tGA}7BKV>gUmNNOdj-<{WcZ31E9c<{l0 zORN{6#Boh6bJ#t{&F`Dnc=ek%;au)f3nP7`F$`*N!0hERiE-{dB5$hh6cd_H3Ys>g zn)b=G`iF$8{aU@wt`tj4;!XOQ>&5pt?^1G?A*K=%;h$cJ6{}Oe{HkSv{k39GxSRK8 zVTM$X%G;f3`h9t1oYC)@4bnqbSY_jM=st>?PEsN23KEfMI`Wt*hB*i!#)4v>y#0sk z9uJw@uEzl&iZcpKp_zhTn;dZUoQc-;HVJzEAGvaFAul21p4yu7mycQ%eoe@uPu!Z& z&rI~laXV$zgCE;YAKv=C?9Qi6ktBu9M`a|iRwMvO zKv+VaVVx>A%}lk&Y8pC5){A0e8Vm50o(;G2+s$<2Biai30(iF4y5GYPi2uq4fS@ zxD;-$;4i~<_D7v+Pv4lQ@Ld%L>5B>K4RY6Ig)p+~*ou>5TBWEdM$pB_b$S_eG!D}6+f>Cs?Rt; zS^NV0c*!AnW6Dsv3Dhukpt2CnxZ-L2#WQ@+>MO$btcozN56aEH_)2CwY=$v}^YRz3 zGezYR2(?wKOs0^ZvoWYL+_m?lp*o=DJ>V_%@Xvdq>*T*ysej^}FUo0nBWAXb@yfU- zF$C+uR~224s`~|C>`^7aQL&41O4J3pqSB%|iV6k8nAx?>?RubIs~j+0?L+E#Imw7_ zr=e}W-G1f#1IwiI_@xK!GTuO8PVC|)obsE>4)zN@Wyk%DzspVE9w#^$myRVc@&O#z z4tFg}y>hQ544zfFU>1(T_@!C6&&!&I>d%J}Tq1U7*C|~nn4zD$*eKQJHJfH+Ib&%l z)#}vmnN-*+J1~3_@sjucASSG7Pfer$0?J0-e24u3tXHXGf{!|)Zp`(&?=^*TDS03?McdB3sV6huoa zvf9^uzjSL89(Z1Uh6&+)p3mmGLbLMhCbIRioe0V)Kb3d8qjJa7@lq{zxVB@My2L1% zst!^bKc`jh7)6r+w{}GEW;ee=bROju{i&UeP>r4Y^`6Md=4ln#mJs8QK#;}m8apJk z*O11wDNCs{_OIb17e$1Jn+o%NmgJr)rQAv~`RhX-u_;Rk3u#QVP)~sWjC5mW$GZXI znw>oF-EN85s8BRt-1-LvP)PN#BnGigBc7fXI3jJ@o>ku!j zU(c<{LY&#-Ek>;?8ibob|7w@8A`zC_$T&1gM8f~Y)-Kn~5S;&*nY%Uz;=Rxg{%6@7 z=Q_p+n#RvM6uPz5etxg|H^EQ8?X*10RqlB)$k0rmR6{BuPPe=FG~6RaFR$io!Xx3y z%ygEt7%a#~wZU9@tNHiGTQC<7??I2@5?v~-Jf}^RrX7%OZGtVLht)e)5 zKk2pI0m#K{s;2A^ylTO3o-2F3G<5YKH`LSs2DRxp-R_>6m!ZgM_AqRxTAhDM)N_r} z<@U3e*h`C$N@C&}RTUK#E)RDkOEi}yXN8+_iKm-p7{8hm;%d(>@qpCw>f&?AS=ST4 zlVyCm-WNK7Z3K2_!=TIK!B-y*)C{s|2}L})V$XE3dQ8$qZ@@ypE6=TL|D6_)wo+{| z*tkO4bwDF`mppKpRd#N}`nvty;Nh_I#~OiDkJOR*lItgI?-a%Hs!Na5lJ=+5q-O1K z?o@}nA2@iTObt*GFCM{l3(wq)^SB_m0F$*ko6pZ1Y80Ib?^CJG_Y#Z9Ei^*BmfEs}l2;I_#N+?M|kBoJ4;CwO+e5=aU(p zS|!6%{7!>r4`_%hg6>J|>R$`96Cx!>?RbDs4ag@3<*^*@syI4p2hPOwtmchb^nbiH zK1It=x_!FHdPB1OB*4ugX&k!#{NkT{Rb7mkeU1JXLR*wo;WdJ^K^MAzoQonS0nQo{ z#KZ&*2E!Mv!o$;d^nh#8dbwN^3-$A3=ywrh{NYTgo~3C#`i&nkH54v=7pcVB!%n>U zvL7?wMQ?Bzm2A6rO!R1FW6HYL{8gDvqhBK!8@{#a^X)V+sxq0j%)>VGhcP#)A0Zfn zxar=Tw6tO&c=${v{P_5AXIBa2EyE*9Ip1bk=P#0V{^<218>Tg@^Wb0&>KmLAy;tk+ z$KK~6-cze`hTx5AIN~SsJj7!>gz>u6bz{yQH^ySD3Sm&{)bDX%akbwOCtaa0o8wA< z3dpcHEW^o<)VS|qMCiz#@SSmNAW@Cc$^-gzKzv_T6& zcL^~Cd53;`!7F|q()ayzn|}Kh1PA;n2^OLvex|*Q-i=O_qO-Vn1z!ND)>`iBFFDxj z6|F8D3&%AGB!{M9cr5iJDOIKd4BdgZ($Dx+pc#0%D zoh;=z7BK&Nd4LRp#LH!T+YX0SzPb!j0)viI1%r1~zwTqqcXR$MJLVmg{rmezrEu$_bgqeB;vS`qhikRoT$J>GAoH<^Z1<*a&7`zQ;V)qG`>0PEM7^ zagRpJzIOMT9z3UslZIu4r!DK+HNCRQEv>8Nnzm#jeBq(gR)~IGC1^<#*%^y?bi6Gv#Z9&&7miMJ%p>V3Kl?`bLUkUAU&JBF@FxoX^jheGQ2a`|?LwszQg+?za2s zQo?aS+QR8Anl1(icFJkcj)d5rHBvAl;h{uWLON#@q_pnqNuu@5)%(W0T$&r~%;d9F zX)Y4=qV#A5V^?h=!pEk;NF%m;^tz2W98vdC9u)wmNp=a2Z7i8L1QuEnj>r1Red%2p zd|wL7G`YX4_Pq?d`=_$V8M+G&AaS%)mI>4>r4y5v8g%%TeP(8HxSFM8g zZcEL1ppQoKtl-F8*3{ryNNt{}a^D8a#-m-)^y3Lc zLVZBm%xPY;2fV_MJ4-coFsHN=olMJUp{OXtTbD-q`*L(JDZ`@=p;)Sxui6r+K{|I$ zUG=M~ggyiv@=gBM_EPa`Ezv2-T73DN8B|=<<}{ZkGoWklBD0vF$)t^cFh3=FujIdf zLj-~?`k-tb1)JEPR*R?I99TT_KRH!~;MmhWt=p*Nvs1(`0^SzI4Aetug0U2-UnjHP z{^%nYzjGH^h?`>}UUI9kl_jFRG30PiIz}ToPn%nw6+-aew88zldEyQGf}_&0tV30y zE#|m`!0T zH%vd4&Q!!{esO+#-X%>=ZF?11D1N94);Ab6_oHO{*PEy z6y)F2mP36M%V$jr!b;KQ;`#b>N^m1kZI;JeIXgyhO&R z2e04ghuhpFd_ko~$+s=G_)Gt-X#>~iBH2;?sKy_8Zk-#IBy?z7*MoOGxNw^0rpJaX z+}ATql69pkOynrxk5c`#jbbDM>@iAe=sHAj{}lqp`{FuH#dcdw@qScdV6pQq1P2lY zN(qhh!C`bp%=X^>esFEyEn5WJg3NO<|K2b*+@>jLB|vW<8X|{9F;RBF2il@v(TGJx z_z#6k$=k=WYTncug2(i)MW7q&8BDW@I9!dAMI~~Rzf5i@JW7P;xSf1^nU1CTy)3e( zw&QRBi*==QB4vh-^?HDX2#Unv8GjkR*1Kx!tIync;{C}FPVG+EA{pFbQ!*`m-U2cV1tEFklvc!sm34NHQ@F!ON};@6|R0+g_Hphw2#hIcgn zDF-pdvGVVp=aA$_DVkc8X3qJGBid`RXcSFz5a<_AK`uT3!8gVxBC8jZS8r`NBr}gt zQ*3?LI)E+Y)eL8eYRMEvDc|S4_vE@5U6dPg-`*DXJot6!m@I?izGJ|`l(gC=!>xiK z+GsaD@6yOGTZf-DeO|{d%PN4X;l6?4iAa#vZ=syXEIQRYpuy0$|EpER0v;A6S(LMP zlL`7Dr#$sr!8fUc;jLWejC}DhT}}SOYGpJSrOJ`alxyhP=wkRHGn?NEETzO0T01gA z!(uN7>l4;4;fb!a1KviHV5*#+GDvpl=_Znl-}{C=yYqCLu-C@$0~0h#-EstMba;on zk=HEtaQMm}7oQ@SIg@|y+6T)|i6km-I8b3@vc#)=l|@?6J_)T7 zU>?5J+({pAL0M<+?1X1Xn`U_g?{tvL{*L$~(eJsn<;aqnEWvLz$4c z&v&=mV#MLqmZlo8Q({#v@69`JO`VE^H%v!{iL0aoUdUQn#Jz2pO5q}e1sw}!3fD~m z>c=5iA;1(Y#`EO#K|CLu=eN6u=!|jtm0e%n!Z!mOg4al2f^DlC$%(t%$9Z+;Q*$ZF z`)14u@ZAB)N;hXCuMrJV*0kAD&C=jLN0%+e_&L(AG{D|Gpo7x~IF~ldF*PS3GuS z4`R8LNVrSRS?+Dg3vKewMycqhkKN~|VOqi>&9?%gahiXZ&O|IY51GiTX)M*T?8$5G z%FDjAgZ+}_+s;O=Bi}^N`(|T_X5viSY&NE+UQ9i3eM8rm{$$@T`5BkQLb{`S%WeOP zDkawm2|VY5OgpJ7FCfV?DVn-Na5K5q%ztg=g`TJAx5M^g-0t~_POQ@*h@U+U$cq{@ zFBbq~5#d}_OZz8c;~^iEot8zNo7v;87-oDIt{ZO8VPCq4VxOnhMAXw8C{Yc%%I%V5 zyVOd=b#W~mm)jZNVfH>~_(YFMFzOb2Hv{^b?imxA;~{XKeMb?azKikdq%VWIy;qHmE-SjM1{xgov1 zdC$nPNNrM;e*tdJf{zeFaU}K+yiSix4wwlzAULNwF>@B(m`d$SU_6!v*vIGTJSwgV zGl_8f<&R5zJwmrx$(@-F=pg6TVE;(6Ntnb5asDGv{Fz&EIFTsKOa7aF`xA?gdT*bT zmY+_A|D41t*%j%cgl7nlg54p(Dk0E(q%-_gDwRP_EDuIAqEC>2hU@2A1(DLs!2%(; zxEId-a#jo&C+OeaFVvX#34F2N!HF)Ni2SW{y-)r%*e(*wN?qM-`VG$TIt0x-wtflmqX9`hC7tCa~ zJz2n0VkFc=py}^PvkkiW{v~``4CmB%EY~9|mO)lH1eG&MtBSU{$9tt5<5AN3DgWeL zvx($$A0^bO2#1H0@vEv_v<~TWi7jVI=X>lrp#+TT|?5rph|m1 zSidjF-xzOeK4g!=-H)}qt}xwHAP*+5^}JX@ALUd3py}z9bJ8N$7r!{!TiJiD2eJZn z>L3_Uaicn{W?62w#VI|>+xNv9BCz6f1J5wm$)Cu;Lh_#Uj}IuqeZdYgCFEQ*I^?yT z+cv$RR~Ws?mo+z`;V~kw$tw|_%7WCbgeALD4X|LLWJvzOSE@R9Cg=q%j^4mPr8)Es z5JVg{Jdz5{8~2EIm6{XpvecH(t*`)l^g%UWGeM=Z@&+BHFSbmy*4@0#wUSl#gqIZN zIW~>I$`p35`GISPWU#XK1FYUJ?5-^VI-I_ zqqvA$J25=$fUH*N4Xfn927WdVKDphnm1XOI7t8=G(oC-{e%&&NR_d;-_QTi90po&c zMhs2g=Sd)Ik33G^X%K@!TH;w;RARd!Z(;ucP$_6$dbRFnwuGqpI-nD0b%ed9_hlK{ z)g5pz1Fa&&gNLI35aSM+C1Wht4IC;q`D@W;feU}9XP|7Me5=flYI-Ya>#M1K2JG-o za-$MANLOrc)bb>j<+uLoo?cOqXVXYvPaOeLMer#S3_*GG|$KClw6r_1ft)OvXhs5zHJ!G|Mt(5C!C% z*AU^p4E@o~p#<|*RCQS5UIZvohjg|CnCbsHYlf+Q71XDj&x2Vs!JjadVcZlLe|2tk zmioMJ<`CE1V^~1PdzARht@=>@jVZ-DbBjEh(Qlu9c0NBI+AYGJGuN{h>P)fEKbD*Z zs>2|d5bzO`re(9cv{C68J=k`JLG=M4Z3Kk0N(pJh_7AE~OeHm#nqs%P$T>(4f>8Lf zFoh)RWR0)^2Mfi`YH3%}3qB8{&qNEV5Zh3vhzT@q-81P|)v?X+r+&CZWkLnd_@3Xl z%wdPWaZa(gpp@!&PoNx(kv;+1qFey$FR=-Id+|K25$U@QxT7=6*CD}aR0yKhbxDt_ z*&~I$2NFa>@YL0xfmfgYjHH)^uIedDsSpK{rG@d&Q#bl8sSlH$-2MrI4{eNmzFuk`C(2u%t=`|fbd=w zr}#O2!canR1B~+nAOi>hgw`^m@$(*O!3<@t^wNK40mipIMIgA4-azGaW~fhAR)wPs zh@EXlychabce+yF8P4y!elNiGZo-34nM2zGppq89-?R1!>y!u~5!N_?Ohlw@=|N7Y zqw5@+L+Zr(bT?j|ypqtu3*dTUt3-F-@dm`Nz=7CK}s>Sg$n2d$s} zZGp6rTM?hCL~AxcuqgT2?Kvg$?Kjf0;Iup-lm9KpbO{M`tUO8&fKnIks0@Qzy1}5C zDVJ!{1~7T=`2R7{_ft2T-!DDZ@{MW$h|n2dx}$MX z=JUj!fYJWk*Z8oW(<>q`K*VH~j$J?Wl%;;BCG#J`_D^c2qw_b)Q*Wo5D9nIdSld4m zCEx~~-gt>#oBh4Ah-H)j@H(!=$g)GK7fb;zR7}ArBf&}1#qX~>r&%2*W6l>Xj3kY98ZHeRKJyHV%JrOo@T*(CGwZ=)P${8m8g7uZg4;>&D|}$$r`$ex>on?1tjTF znx@$he4!r(6(B39vQ9()ufXvpMcU|pDLexLk3<>U8!q9r=TCK+Mr4bP0D@&x;-U7U z;$$SrqxbxZ+o5)gpPTIn$mK-q+8z=jC>`A1nVxnor{m&7REU!Wn?vFVwI#=XVyGO-&{M8Wpz*~#fGQ&(y|h5MnYacVhk?6^8Z3%GRW zXXaNbfC7*$z;Ivg+?TyLR|Bc{UhuRRcnu_wauopDA#{ zdNH;kc)9Q}k5Q@c@ony}`({!f`ChK)8s&q?sX^?qUVx>~qtP2(v&B#GUzfGL4i33O z-b`6K8GioYP3ay{@8UD7cF(sXpwMQe=GzEGy#VolHn7zw1ChD7RN0goJmrvn?ilg{UMV6}*MpfGZp7Gg zYy%4Re|_w-ZXiM0aDdCO*e+DbNu%o`w|e6pHxp|5_VWJpCzfm)u?a;#CCNjI}vvhbY69st;2caY@ah z;Eb7V6}GtG!Jjw6uY5Pk<|$+U#>1axE~oq6qd_}sgj9@9Z=84YwO>FPbpo(U{+Wb< zRDpnOlqJCz*RcoG@!1Ub@^0w0?IkC(8=RHMQ3u>%+mgiFT?n~`due3R-PZYJ22)K5 zy1c@3G>i2#_ZtP;-J-3jBy-uEBKA>|g_6xL*u{eAYvp>O;oDm`>jFy+*mlAUY&eO` z)mCn%Y=TA>H&w^cA(7PGdrxkd@I*CSGJpZV0Jyx+6Tp_ZG-K!gQQFfK+6FfLwRk7bKj&k~7p*8(eW%;$thQdH>6PVczv*;SD{6Mq#7FHzJd zIS zBx$ca`oN<13hc=WoEr?u>Y-pe&?&w9;Sp8k_LN{B4+Q_x}_^1_UC^#jRVw^X4T$} zcVuwYE2G2@(8L)}{33QUh+BPZUME zmBB!Yx*NCubF4r9Vf9rQw7xkdxe9H@o4{u(h0BeBX7>$p1oR&mof7s0u4cH47`2l2 zjN5ck>5pCr_2d#rY=OLnE`CPlZ)Daq#OJ*`eX;)q!kNDbpQN5BE|Xmjo)zdS;{EQ% z!eLvMcySLHL~GjV_a+6Ek3yGQ)sK(G`S{vkkYRc+w{MCbH71el3-VCUFWb{99tcsV zW$AnCi9$E?;ZN-)qpjv{cnnsdK4bKQJyIa}gZ&>(467!ICx;xdTWE9sW1}vwoYPMJ zk@Q^o$O`@K>VEI3u5!O5#{zLb6|UdlqMJMxC$F54CS!20#DPvojvS z3HOvABnF4WWNY_Gk=Cbr*%hch6|gQ8`SZTsRw0M0BH5y+H5i;9{Xv$JcyS1(?2?mN zOS45qC;pOF`>54MKf_!M1tyZWmA8gYD>l3e4LVXgvTpwza(k8&N>JTw7XNsC)YZ11C9)=VGiaD z+r22WXsR|bm8U;P!|;e-YYn@Bx2Zc7hS?#w!s6?;4T%?Hz&L%&PS%BHF)OtOPp3XN z#4XGB$zKn!@y9QE6!aF=mg(QxUDRbdVWi+Z1b2+X$kKfMD>xJdqc=u_) zQTn)5{6hIYSh=oCw*Fb=A1|vo;FatHP4caZ8k!TR15%888NNB{>j%M>@Y_tiA3+j8 zR(dS1HlZF8Nv>G_uY~rmO{lW^;P*LE7B^CdF?pXgt0u*9xlsz~?Zc~&*te|TJU6`Y z<>S%aDAC*#hBCKv^FxQ)use&k2gl)b69f^}im&**UN=g?NbIUUq?dG1t^GiHVubZ@_u5~1 zqLRR`b+J}t<8zaHTZkd7KLYR116|secfBDAkJ8m_hRhZ~2G$fUVnHHw9U&J^s%mtf zR4%hJ-eI-q;3DD*S!R_osA7=F7t+USVndZDT?$zl?Qi;tOcuYJ27|gcVv6OhBiLn- z(FOyKBo!oUj#XLJ(&_PchnH_2eOL2{wQLeyHe_9^pQePYL|+I(aId^-o`QQWG@u1P zs_c;Zdy@W>LYPl#SFyJ-BWVZ*6(T1u`UH4Y#d;Fj_r}6`Yz4i}q3Eplr%sQ=_XBc; zvo4|!QIs9Ix5-LG%vri&H-(ORf+neuHtwqj6%IJ89O0wOc_O*H+$38EYO!cv{2d(t zh%X&2Yw2D%|9wz{9+Z^c14ot{Py8p9+4YgNKhXQF6QGa4=uSdg@;tKhn3 zFcBHCs;ndgrN((QY!5kKjJgcQhl}VD2X2 zdPn|$@a#~szmUi#;2E?!Ik2ev z&f*FTgOZ&+CSNjsO)5O`ob2o?3(9G{*5>7Oi85i02m9}*6zld(wY}C3lq!#d`aKa2 z+(U5BOS!L_cxZ^)(d&&U!oQ9|N_(CH1N@A?04N*_daqWhRb$65D;e3R2&{gw{a=K5 z)qIqONQNs@UP8OBvO$hS9KZAXBzh=WKRLo*5whDAxRJ;U_JG7U$`geHV;|Fj(^6fz zqmC7e0+Yf~ol$nxNoR)@;r~U0nW*SEAHsj>ycZkMOwaNF`6YYh_k*eX3cf>dRGei^ z!%^0c080N~ZKAH#-B`y#fwTn+YgxS7)2na9a$nmGu>>ZHV_t@#%{ZEaw!r=jZ5D-O z37LHe07eR&ZpY_Tp8+JYmO2?Offx6`b?05Sq2PjhX{{Cu2=R9lQQw3Cm~pABHj`hv zTdU+@17?K0BBLuPo9CxpzE5K!0haq4mBY3tk5y08wb1edB>nssbC?S8Jf90M@B6?q zaY*^)`zlk>qnDnBq-$eYQ zn<8$z#qP9VY`)s#O(ojg2wpa3?lt{9&D3qk2!kG{4wh%3Q7e=nPE@(6KdB-*F}J|! zq7Rsk1Rsap{Ydq^ku_9VoK2e92NZLou9ZeVw@dUFv?+p*qf+gAX}q|Vdb|o7ugIX? z=7pAeM)U!rt#Rt+b#tP&>v&Fx%t#fVjOy&5P@9_6$Z^31( zfOaN*17Aj4&=%ep@?l4d?xUM z_wy+o8h*JYESFOZ!Ot%HwkQ(jA^4+|lt{N9zQ2dy>EhLdNSpgv;BS1H65zMx`fD@x z8}AjUyr`_Zt0A1`#H6YT5OC;!aEyOZ`HDV7UfUw6k*{yb^8fMl-houV@Bg?hAuBs1 zJA3av%c@lNmOZj%ooqsgvS%cPL&$dQkv(#d94kBGn8$I>@Ai6sKfizc;jia??(4el zYdjv0i}Z&jC0U0J&K2zqM}*~npPzsI`L?KAG08Aex`;42K!dqywi|7D^{|>eA3e>B z9#dngVpLdTS1uX(^K6XN)KdE|S`^#y5$3r{x^RQU=#9!N@<(qyXy<*#K8&Y>XP%>8 zK?)exl8U(kPhFPeshoY=4jveT`hdp8Rm5YVa)&|nd&J;25+t!XiPAJ+rcSo*`?t{j z_M4na6g!fN+)eI%GVGaaX#dLxiSfpqqm-ZAbe)IsCvSaN`!GuhYz0|X}kSZ z0fEI_oRvv6?h6pO}=K1^XlP1!?R+I}K{d`l-EynQb zMqIq?GHaB<6X=0pssK0-R>WPaCO2zZ|qdSmHgF35U?bj~7*EeH1#dxV~Nny!`dE zA0+VF3BMLK5`c1F^L$z>(aenCf-v{FHlHK) z!)FzSq{hv+;q@c^-`Dz=KuH_=TJbjoOJb_HVoG&yDy^_ z&M0m{Pw%sclu2m0PGW*L5YvpEXj0+38|lJaYD>D{#=zBagLHY&6+=tvMB?S6=Yg(z z1UIxfSNx=tV@@T88oMCDH6gMjBkMrj^%7(q$5-VIz0b=NTKk!COVk86>;-TYXU+nN zAMj^No%G+lcC35c@~@ct_(6$qQLgC- zom;*r$`9m~Ae@0b(uRBe7ANP5*)iuVTAp!Du9V%J9Jmf+Yi=clPhYpGn&g^SOiuW! z4+&|)Gv1$n;u*s>v8DQRgcby39ZGk7J#QIYb*|+S?A)ko_>-(s*yX;(C;s6|>H&kw zD&NP@us`^rx~KYANIp9>ITO0U3^nE=!L%D~ef6Z8oCc)M@-VwrQ3$dP}68J@j4m zTQJcvKBeRH8xH?#$&g2nTKB|9*Jj-BN8D^sSbH-6CjKes=!KDaLc>&j zAVLfw))*51v&dlF@$V`uC>~MiH@epD>Z{u&n(cy-p`^JNAu`qeZ^&z@@&7mMzbZ9h zrUOqW6MG$8(kC1_o@IYy zxa&N(Folc%o&~XH+ays_J_hZT;K#Ai@J?xFMLBarIUhN zfWb-03Ip$_k{@VO*R_NUTfqYJK75Yn z1qbQ(XrCqZG{l$6&^1GPZ-VV#+5>$x=!3h5oReSZ zD=Gz!?L;0nQnWVMGDGOtkDL3Cn}_SAmx+K3KImp@8iBWs1Jobk zBev#)!3&ke4-0lHzI~`JGL%orGc)>|@aoQ=INWm%E%H5@FVeu}|83vm7ehYi=2&|dEQefEylmjlV&<>9M)!<1rwrE6DQoTe z5KW_WNpZ84R&^re0bj(5>)1^NQzN#&!X?M+3|1|#mUeA$l=?QibH{i;y{Q_@`!)v( z8H#nEFCLgMc`(0RA?yu(ta5p|Cz&_gq7dNZjn~8nzfc}PhmefGSjiZ{MKy0ZRR5-W zuMZoV&i#=Jj$~a!YI4Wma1{T=1bgS=B{kkv5q^URkvcFpNT&#CZd^wO=lW1_nD89W zKed?A%d>L}-x&R3FVR<;|5!jU+p`o#?{c?GMgQ|sRm~y4uM^xtf={!10_+4t(Ln1}8jmAg1ppr(;6ZENEXgr>+%jt}xIWrVUqo z2XqgRBVQ+HyHljL!lun*^|L-%ko*%YIS;l!y$_vROn1wCvv)7=?islt3x z1qI$!OFqnx$gN270CqStY*+Jb&QKNk3Yapj94&gVFk>0Zh|OD#w2wnH4bvNZ%~s?! zxRD1b7JfYhBJ69FFGjX+Tqz(dLqu?3Mb;xc+j@3C=3JA9zK~`E^`D-M6Wr!J5iILi zjJJ}o!yqU$t97d?qDTEdHEgh4rjyAkWTy^avPE2+0dPb^a~Av%o82W;Sm`gn>LE*= zm@3oYVljK;;{p5k2-1ilINLg0b#VC-$mVqw!9=fh_xK`bs6t+kTboF94`A)HMv+T0iUKan|e~u00K5+m(1g zc9tW)1cJK2z!n^oPNdyN!;KE>5v4BrEAOOs3F?KD!|=KmXH)Q^BaY1!Ixrl>T8O(7 zmShGE1o&HQTii`9Tc+}#lxPJkv5P~-^G%2pa0lo~EH6@GRI#-c2z$r<*my}EF7({l zH@~NulqKyBa^CDjsm*v`VS(ji1xYz(>~8*rF}Fgt%KC(b;qwXXi-2;eR;8~$%vvHt zB#*43L~tN0Mml9l}I3XsVg5%fjfUf zDRuEZb~2FPS&(4dyz>T%M2LNcSFKn@xv>!M3D#?dGAj9#wgvQRHhI1~<-!S&88T0H zH4Acnih5XpmZ0`Uj%@a1Dv85Q$;-oVa<`p;x1YFoHyeJO#RIMvtk~sL00#%X;ojbl zvuKvyv4!dW&FL6bH3r<~|IUMWC(7f*xzly>fXAU)vP$w`&K#M7mDWYt+W!Nb!ku?N z|HEzy4Hf7_YgFj{c|@Po!S>+&h*qq>`oF(-o4LWnZ!lsq5Z_s#J5ueDxe3V?VcZSr z*q6=|hG*%@JJ<+0yl3+@h`7{4&BLu)7wCxazLRcSp`-X=(D=QT^wiFl3@H3 z(+-GA*Q&?6I`){a89FZihXr^~wkyfoo}H86KxK22wc&3r^e``UBS=8I4E=`rwIb2M zgNNx^_rA;7SMO}7y}c}`vLBSw6yh0y8Cp4VD)2Zypr|&CW2X;$Wlr3qm2CI!>3}i_ zl>Z%W5*+TiAs7Lrmx{ip*WY-P@#HAufgllRH4Rp#oV#>X*&bWs<-DmqX2D& zphJi_G>r`m7|cLY&AOk>S3>eTP=<&-zVjQ(Kma5MNC&99hzH#PIz#7DH|5~l7QpcO z!t?5({yz+d;ywt4Y(8_!H`Bd|JW$m!YbO<&kS@|W=@4+op=(<%NbTZujHnu8SZewI z?}xg8rtVnngF@1z*#8-u+;8#?ges_;r_$1s!3&k&Vbph?dpD*6WRx$KQbsivdg-RB z81D%aCn$=@j5bOpbr`9rKjyw2yU=a0)fmkw;M$$BtmwriK1rPZncw04C<;CY@K7NZ zP`rL?{n={Ti=Ag-YZtAAw=4~081VDm{5lvts?3z_(3S}wgcu;kwjLPTn|~DPRJ(oZ zVVnnM2mDo469eU}0{>i#{;ON#O;*n)Y zwQ;Ry`=GI~AdLwD14P(&3d0273PoO&KL3BGxpaDNU$qcbb#bP~U=~I;L7}LiRp@!o zZQ)73&(mF)9gz*Rf5eWmuJg(6!ly6nr66BB;P3%NBSkJFt85>V82^1rD;ypt+mDXf z5j^QfB(hggITq!)U7tS#wN%gZ*z54=V zjvpR2G~L>N5s(6FxFZ`{E)FtoRU33w7s2N9V8&@4ne5?U_PyJwlOQfE6~*!4$9$Zv z!AA+CuCCG>vTgi>&2E)ZQeMgbl;*|Sw(($SUX2tahcNqPA3g((e}ljJ8wd3L3oYof zkH00WCoeXT@{+;SYX`1=en20O^ec@Rv65AJIj&jy{4YAa2LI>yDVNLqZUI#IHQHST z4r1{S>?_3kC)ojdnLRVzLd7h4II8xLFhPMc^2VCSX(%MQr=9Efnssl0>Edn;CuX#y z3BD|yJp!9|MRK+t!X@@x7X4nnPlal{OYhukWi3T+04(jd3~AK!ab?2kj+Z!#ahRJW zssCc0#F&U&Xhoen)kGZILGCCZUl^g~`Ws#>8P_^i4Vpq1+`ubI?^*w9Pf~6(G@J)w zI96pF-rhek$ra%EHLScw1pCRP--uIG>xZ01O6(W`$5N28 zgh+k(&Ka`=5Ez#%wU-q+ zSHn3@!}+8sLe30kvc@EDL?1Sgqp;_{#HCqNoEB!j4rX;!67mD*$j{mBxrj8=N>A`e zJ`7ZBz62&DwAwJ41%HF!uZ9=2Kju#;RDG!eHGD&U-+j#$$|H#rLQdCTlRW2=?BaK0 z1Qz~ZkYbT5$J)7v{`b0f2j#ZERwjMkT~W8~4aGlnO9Sa+l~8sv%yGrQc4Fn3+862v z2Fp)*G};KnF6>>8JOpberQNJ101lpRiTjV(2Ir@Y^iQ@1j2zuph`DeU3mX*k8U z$DJ|4errV$j8*vt>e1qPYf-)^rkcmgdJJl9Rkcq8O&)9eaA9>wE{i-UNl7?B&SnI& zpiHKf-Ag>HHd>ey2e$haIVEsHECs$X_BhneFivk#vK=i#E?+;G1d=RlLpk)$wzE#b zD?V2)RaC9i)#cb0xa|Wpv!*v3E1d-@y# zy+`pn?$TQniem*$PWB6ik%7l$93)~N*p-WKAlTQzKnc(v zOov>aQZ$o~UHMH4jR{ zv1-1nt>Io^`%V=_A-#v2KHe|dwS(Zw5TqawUI85z9v=k16tx}Zr&~mFs6j!)S0+?B zZw%%gPOAE=_+(KQ}5_nE(6h zN9Amk1lz6M9oDr$|9+4s)lz5n6W#iAg69e5yg^mt29Az8y5&<$Gw$5(y|kaVx#RN3 z7_{PKhkjya5QNGGH!BtahVY)R=a|k6p?!c^-mdDNToYIZH9~DF<&s}j3TD9!?;a_5 z18Cud%eo%_gN0sh(U%tZj0{OP(CO9hN`L0B?)>c2Y2H5> zR8-T?Ak#!zAxb0D>1p>HmH^}nP^wlRmlje7&-rI_E@Au$BsI8+9ea@>1;1_3VP!|Y z1%eyazo+oYdi)((O+eZac}=k6{GXq4Ose6m!(gwqjxb zi$BZ9h#vw|In*67pp6fN)O+he2X%=%_rh4Fp091)c;Y-)sCdXko|HaHBA8S1T&b2- zdvk7u8GJtdj1*%x;rkG6*_3C8#!D~d5+|0ZS+xx*>pAJ;WDbIxs}D}3^HEWU#$eY0 z`0b^#m?3??ybn%HEs`_`Pd6xm0Rco&RvSW43E9l!(_tQO%~MTsn{89}%t^cLanhp$ zTFBNU1IwDGJ|;CO}fzLcy$X|F~3rL zBgbl;?4Jm}g^*T9KF!EHsp*l(Mm@p)hIL@78nFRZzmq#({Jrm&3+aDC zBkkNhQzYC%3{w(cm>|=fKA8ZEz9Q`WEfYu%mExrfR}$I_-%$xmw|PF8{&EfBkK<=2 z6<%=H$5cb;<}0bKgKRFTuzlP$DBT%60e$kNLFxuGB)uLeot>=bm?puf_I?i78z4iW z4CTMhcONed*Ld=#RW`rrBzv*CM7F;llQu3cf^#VtT|sVp-^8WuuE|%l7a&fzE)P6l z&t%@Pz6M39c}%G(DgoX43h(MDw>_}%QdAP~RC+*mQC@N=tw|l&^)KXRPG#93Uq=;} z$i?>$%?h7v_F`y0*NJ}WYo+`iUr4&l_G#?{ey?HjMdSfY6><<-OBKl0XrLDb1kSJY zsv3$9x*Iif9Ry>qa|%bgH7`&?q#R;By$jFUAFo~cp%>D?%FP{dNto6K#Y^sQ9~)6S znL)OCZ)<>eSBOM;bQ;(vl{Cr>N@JeC&au)Gk_JAJCUZp}warf5JX1|xj=dRmTka*w z3vc2T@xXn13=4PSg|R@M%bkrArTN=pr8;&QOu|p&RMRB^jV+a0uR|myLhVtj*&{EG zkwi(#aCEC0Z^VW3pV(EMPP@hAGp*Gt-_06X1=37Cni@iY*sf@hif4eNH~uWx_4T1r zPIdAW#b^QW9mBx^9a3g5<+kutH5Dv;W|HZPI#iny*6(r;)Nsu2jvYk^DKA}++*oB|9w<`(vF{`DQ_@uT+L z&izF#Wy2Aiy}(0#F9IX*yX%!SrYf8?O71K~{Ac(a>DGT~92+VunGLYCM0|cGW~4XU z%A;hVt6axkyyq#=w)5K+@0@ir(9y%sp zy%5_dv<{H}A&l7<_Di?Y24faVV{<~m7Qn#nZ5WHpKtY7+RSK37WFKN#kQlY>ZWkpe zws3aaoLCvJ9Nj^v*dG*n#iMwtWqo#DwMCiR(n%A{{#v8N%RqCpolSs!(pg3LHkOo5 z?mTgTC@g=zkDxBaxXK?@L=7N6MoyMDL@=|?#ULT7<{4PDLni}xkSHsHpYG_Z#o{og zYZN`aU`)&UZo32)a0+Ec$&RY^;_UGR1#_54JV)7~+kyV_#$E65%8S-cn_!(!7G`y$ zanq0()tfBbGpkoAMH3;*$JQcXs!0cOi4?2`T z$Zq{O`~QA?VDq)w%rM5ER|d7I>0;h&mlV=S;ZEMx;49>2(6Qnf)7e}VB7dAz3MYiD zH&7%(u;0L%tfVnb*8f;~<~!*SdV}DZ-S5nN^@-x{ySHPH!od|7tyvIn&WVE%R11R6 zial$B!Bqo!8z72zpBn2Lm{XAmqwZ#?`6c^z3_nlO*4bXso>WXPH^ejq?v3F13OBSx?_j=t0ty= z9eIY*rXdtV8M&J$vz*=V|9DI?>L!f^C2FP6eN$J zU;-P>QB zu-Z7b-oyaHRae;^AZIAvCAMYdn!gZylL@^FHoLi-FoxyZHEcvp%;3H)66Ut!{Pg&< z@nndXaYl4IVfzGumu)c~yPed|WfjF??$6!BLfb+Id-t%<&l=HgJ@?kUs-(7o%?G15 zLG-^3qW=RAbo=95NigLEYx90rDz-DBt!FRQVAg?97EiaIj`%gK!^(KfEfBavvla*s@+f=oaPrKFrm0zt^DQcECm{>s1rng`eh1re!rS;H@ zbxTkMyRfXh*}i@-4Sw!mk16o?%~)74=iz44vbp zVXoK$U9!G*@CA}|>u!mmN-KPN#N-+sPeht7|z2fdS#r}%?FexNZi z{Z5r3cJ!%ywgop}m6E)b% zPX9#g#LQ89{`7e=zhpzw{!1!XSiFsG#jbgfLo+UF{KlIGLONF7-o<3pD>$!I@WHAz zMe!>E5GT`HwGV!ig}E3(1wHHfRkYa)g06pb9YB#DSU7Ke3ihIC%j81xo0K#C>+vkB zq4aB4EpGZdmwA`S&A_Wyl@cKKJ98yjKQ?hm1lvd<$l0)ixQiOnA;6dnV1LhnB%UCK z)!ZZ8!bFM4=It)uX_cRDfM0#!)FjGY+?1-jfOAhU56W@S8wveoinX2(07np%M6n2| zRMFG$iZrxq#6lmwn}9^z?YJ!$Zh`GV+(i_Tadc8qx$c8^g5Q>E&~_b;bON z`f`R2u=Eu>>Oh|PuAwDp{Bzl1VB$JNDLOm2?>Aak|EkClCnQVMEs?C#O4>X$+baJ3 z_r%DCDI4ndNifpzJkEErc9{I3rB{9EOS#5 zI2sKReFQcPWZ{LjAOE>pUEUnEx3xUi+h=X}wm)fP@!72d-no1DSN}hSval4;5BfTS zR?9VP0yh9kDq1w;bj+=__Ks=Eqbdy6kaaBT4j(Hib6WG6y5U(n7Zsz+TlNylZ7$9W zLVY>r*H<@Lrr~$@{DAVMr^1Xdpb~mx=L?IcdQtHaeqJijwq>v?`|e(Hm}mFYOPCo zNt(|vEy@WZBBIWxr_%W1(lFZ|4DWY0vUWJAQDFHD$^(ehf<%hSrRqhu9vej-UdUt4TlkJd%&C$IFnlx|x zf~BH!i<#Po2ec*VgUaS`8jMN0hq~_K)T{*ha@YA$!1UkUx&vp>yRTbUaL|QGXOGQ&6JyMio`6MDIb)xgJiB6Z#Vq$B`3vg z!M?uzo{Z|PyG6<4PiJhK#|WcE>0UWkjJ^gEdb}!^3LYT2-lkaVkq$;#s$7e6mFnKC z49cUW=u7(%zt4>iDLv&Rq*d^&oW8Dq3S%$v>dzZ)*pJSg79|xM+C_$lLr|5?avgITv6t{1kBqhN76~?9A6zqtlmgAx(~ZRL9)?j+71l zjot!&(6Y~Q-@fJ4o{G?jAYXXWlG^~QSY~!F!iMm}BLFmDV{OG!#TD6VieK5CkE&GW z=;O*#5l2DAP>4Xm=$st_wE{H`JQW%b-++t$Fz-BR&Fal?kCHRF>e0x>Gk?)tlZmls%$C-Ti3=rxS?$!zYG58eyr5<40cAi#o_$q{LfN-i{)sXO?xZR~*Sa?mEJEZs+ zuJkwwR(Af!bX)OtZot4l9~0)Q#2+W&6DeiNP*H2}D3HAGUza462l_q04a%~5-ySwH z&6@zL;r7X!v`bGYpH_2NWyC4RRy+Mb5r@XN?wddDz5SR-MXTVj4}ri_d;`fV zqQ8>K8@nEVsNyfNA=Lh6eZ*q^g$jg3ue!T@8@C3 zc5RplR?dFD5{EL020YP45AFZuM3jACfP}2tqXh{+KE?l5dwmDVGJiq(@IiewjZ=pK z=gHzOf6L2TQU2V?kD`zpcJQ15^seetq*u|SaM>FV6_)fy2!EnkqAj@LL5yCsNVzQ4W*6kLpQpDq}77A{!ZU{cCfge@o?w6jux_pL9t ze^C-&SMd4@HlMgtDfc5>OYQs6AqNk-kzFRw~6@MZ;`e6wpJNXc1ftc2h(eOX43xw5A!xd3Ovc?C0> z4R!IrkkQMx@`3!F=vMuA$I_jS7dm_65fk`WI`$nTPd)?WeW#x|UExCS`Byb-#nlt% zMyEK+DGSm_)?YmD4&k&*#5gm>lE1QD%G{Y=w?{v)-@E?#@##G(w3)5?5l=*PB=54g z750_2C=K?#0a8ubS#p9J+^jgFTjT~Ai(u^Id59hjA?Y9PHj@{pNo5#q%{dXKC?DKMn} zVxK9Y>@BbvfOR^6riWL4nEpR3fVPyC!By3&W98aea(wuFrCNPfNgt9PeER3uDWexJ z9q(~2DH5HXAnrY@35(wlO}8|`pB#a03?nwY&kOGhNM5~h{q|N%b;4I@OR#s<;Sp(B z#xkphkATj*(r8bC*AJqZ>AUcDXbsAL*DydDZR@=G#6u|B;h^}s^A)9__bZFpgFlR* zqV?8vq46ZtFbM_{SjA7MW_GYs%HYxQyr|ppim)U~_g6?ns{Rs{Re-v@_~ws2#@W+X zzmS{C16>(E<|J>LgPmBXz2oQRH~T+pIjr@e%{3j6!ep@)SA?1x+3&J&*{ExaJbO85 zJ7(-WSK9)DA~W;jntrU!6*j`rpD$}o2Zbu%jRqw}Nm!wjQ2mG(pR82{H>Ony{PIYH zg&l422CtZ_8`pDFtySM~aXnSX)#ILNx9oF!^l1^n-1k8^t3#GlTb1COPs|H1j;HOzJhflCS@mTs14wXtyfa!brcIp)bxH-{ zvo!3sjuu8DF4!j7-&eTZ{?25F{yQ}MRX7(wiKWv-8~bHj9T;;PCPpw3tk4j{<_KLfc&r^zPeZeae3wl}>FNu}&YXYDp{R$dcu8pN ze`(;5l1ScHBcv(#P5wdBg{;0u_7N|=38Jp~_*&9K_FaSN`+G^SH`ni6Kv?y7*>|OD zuG~o3D_Zem@_oXGP?o3*V^ZLnB*G&n#jzZAwm1eawwPk7fY2?lw7^AZhL)Vw2<+L@ zURQsVSFeRuBA=N8bxkq)+B3FBmRCzpSA^O~3kIq%y=eLOyc^a%T!qLvv@xN`)!XPz zeDjG{A`Bt8!0dg2V2Zds!}pSVN_r za~S37S1<-n3w=xxg+sfJH!b~kjd(I!m`2M}=;WIJj;>U`VLl}~iz*v`o8XET?2|tG zvSDqkh`Y?{(cYmPRZ8AjF=Fwt<|pNvm++ERm}y@M;}^#5EK%%p0LP@L$dVJ#x?iAL zGf%qwJ~2#KnsuGd4}Y_vRZPQIh}XXJwNK(3$>CVO)|!X+09)=u2ze3=#wK%t{3OQP zG?A0=x<7xV;|JqKIk}Gj&VzH+4qF`VbUTI88`K3`p6K?TpFX*5!_rHi?EZGVEpH@d zfQ*}(<^G-mSS&^$hcj9EIN!o`rw$14Znlknom<&|L@&`EFcKQJK?`-;e>MukQS|;h zetEn-#2fs8>9rAKvzAR2c+0K89iHt9q^2}a_n9b-jp_6Q;ay^ar8UiLuH3Gs{dOw$ zScjSNBnN!IuB!KQp^9<8{0}Dtx#nY@ffWK71H;(QBBSU0bb)L^aCdSh>2EqJN3$$L z=1xa#H=+?5-yYy_rv`AAlHa*y;)-eS;rv*Gjn#rGoxy*l!#mEtWSinHZ0? zg_BH7r6yFV!Kb2pTyCLZ;>X_`;TzA;k0^l7N915R=EFNlYz1*2IokRM3@+V_9Zq6Q z^&QLewn%(JwCtxyy}0ZR30vP&`lgdi{jsZsDG> zWHwP6_13I)iNo3VcMS>4XOh)rR94EKt$1Q2&362$!Gy-nleh=Uxk&q8L?gYsKhJYY4WDaDaQ#Q9x7i6}7BdyE^u03Pg)%P>tDg2a$5lt61Z2c^M zE_8Bi3TkU#OdrJ|-pRcQuS*S(ldk4tYYuMWcy?*NEWPj5MWFH(n?;T%kz(As^cx%It?GRj?fp} z5m=Nc6 zpZoo436{TVQPyfx(dg6A%HW;R8dToB%kwxwR3iY7u1$O~Y*%pIuKOS*cb9M~^yQLBQ!k>V|6(6+v6?ks5JOrk+8p7`UvYz&z~fUlEggcaBe?vCG|A*IS2j zt1}j3+~Pjc@q%(pmLgBOQyw{gAnUe&%V?uhLfO@C@tX_~?X;nD^M@O9H)Mq4x-yAzoRSL4jL18;ldeDAb9uGOzjdVyEYNr8)kQX7a2g7KdpZx`ske_16B_cy-BR*lA^_|J}F%9QgkA=z)HAzW0J z&y|z#B+PdBQVJnDA|vNtY3%UPFCKg=`ong<&%rT$a9RY_S2Gh@adL_hzUF-~ zkB*dh{1h@OetEs=v#^{!s|sP68IOFm(CT(4_e60nllM>~;iIq-xRxaI_L|vb*zXR| z+uy`IWL~%5oI$t(3=#*ec^tSE8gi+6D1NPws0H^C&IF+u2~(N?`;eyOKf06$uepcY zfIJ~h(7|0|xo}aP8^;YcIf3tjWpKQ$Iwwd!7XL|Ne?^(z#*9L2*O>-Q)ioZDIj)uc z0$Gz>o%dea`V1BY~6m{ek)NG)*Z69NCtaWMkl3md)SHd zUvz+YbSZAeyH`e7dAKzHn-L0i-T-}iz-{Il@So~&@U zkD798UVTSMB@PhrM-?pnP*Q4wO<52QXGPL_Jeg0ez-dkYpVO)e0O!v0oMTKpzZ4Mr z)1Wbn{*^ZP>iwJK(P`AnFfz@1SAuE{ChNDi_(;~bTZnM*sXZvBpJQvmVSY{JF#%Q-E+)ZamvNZpPX|jwAV1>L zx;}$_C;eR|jS8=E8OM=XPom`v$12vj-Tv64=R%g$fBly0qpRn7--1{QUh8z=&de7r zJ@!MsF4W#HRI$45gEPjmM>u#Iyz1o)cMyc~+vX3GrXhrxPe&aEh;W$%4yh+cVY@x9 zrR+GDbM&cZ;z=E*j6S;$Fjz_p%7IP#c=dm$Q(#f`)4}FitZ)itZtd4B=UWC}52=-C zbRpK8WlA2NM!>a?7ILKsdBzvyevWY{qII3uyaxVkw8nwgElM`W`P3si_@x*Ywaaov zN;9ey<8A@%am0W5@Z)oeO8=hYUr|B*2-U=fsUmTy+B0+K7Pp7xK?A?7?70=W?A)pB z7w-M=b;$^A?q6xy&*dbc!MRI2ayrkz>sixl1lj_kAefs!C9+{Vb9k~7Gbzn%X}z6# zz!FJ9^GES+5KU#(Y(y$f8W5m@KngCrZn0|c_==#$R;6v5gImeR6^+1t+iOKffB!Fq z>cQukFTuCyj`&lE3XLBx@dKPzS?_0J9wbzZ$`!X?HEipN2hM5eN)1EEC@A`TF5YLp zrvoTm8ye+u%ySM8%-^ikq-IMk;@Tm&&0Izs9l_VGhmv3WFkRk%-?|a0)6wRbhk?CI zbY8U#1Ww=p_i`bBkw#Rn!$#6|%4x=DOt(%u((ka@2;GXcdeqxi)gK{JL-*&Ph;6U* zl6}7)6GEu-K;mWBoum%&AbpL+rTyM?i|`ZKv*Hm$HjnTSqjRkxAW3mK(F3!9t0_RE zGBbBs!RSGtf0uo!kt;;MawrA15z2_qzZE26+lVMdnl_Sm{tzB~Q41$q^Wr}=xD*89 zLwDU*K`i1H!S<`%SE}gS0uD`=0i{bBg%IivE(`UPuHe;?d>icYV~GFQ^wtfd`xFTc z^YjFla6mBSEOB>2Vqv?xqMcvl_8TYSM}0NI2i8->BEqUNVv29b z6UrXSvqX4$u#3AlQ*6y>hxXsBQ>IyT)(6ljrQ?76@MFr6-CnLgE!V~bU?#P$C7uRb zn>UImW?Fd8jsk{o@>c$!C@cMQYl7Uu#u8pFc!BUjY)cF7Lkg^TBYJY^ZxjmzgtV`f#W~u9>eQb+13&5 zjtmgW;zp3>8owb)1NNG@bk2Rm;u6fb2H%y!tun)thsG}>_<{9F3j3Vw4 zRZSbbxm(P^2aAdky7SY((D&cs=v59mRbbRc@F(ZoeumH`W!VuqLy5Pyq10VqgqQ@o z%C;_Nl`Vx>r-@_Ue0YowNs#THhQN}h)#?*&#XqNiyMb_)#UY-BhdJ(qV8WL`KOvO; zQAC3y4V_ojxGV#tA-sV+fa&Fq7Y*PEF&^>L+s6?O_1&h@SR!=cWXz>|r$kX-Kq0?s ziz{uOKO{oq-O!gA2wJ47LPS*eX0_B@YEHeLt&F)*7rO>XuG&pKEs6~Kddvkjrp47G zvLm^iPJ(~lU37|q1tM#3gUF~`Sl@r@#e=@yZp@hSADJud$oO_tJfX`&&nk=Z2l7FU z#o#O=7^VyZ^hNYxAh18{gy+m}H>@G&-JgjMp@Ark+&Bb!Ad{4K&h67-WMPJC9Os|2 z+%g1LRI;b6jJ#q{>n$Hi;~Da}ueFoUj%Joa6d8O9DDJ3BHJCmGw*yMYcF+$ezq(t>tpQnmu~BcoF)kdY~#iIzegZ(kegPuP`)IX zAi$Dd{(L^SeSIo0nv1bWTHlv~Fu7Q5P7#g zvs&Ow19tWb*x7;5cW+^nbGY`=vm+Jv-N#fkqAt8yF%NW;INEXEm0lTqd&iiWbTA$d zo0R8(Gwmbh*?i|{f2sWY_kr@^v`aY=-1@Hi$U(vxvC>KNY1gDS5041u6lk|e9UsVF z=G0j4<<22ptn9X6)?l$bFO4!ttd2t5(f3%fQ(*KN16f7x+w37z_aLL_qeU(sYpnF+)ki?yfq_RgI{uJ5KvdZ5 zUzGOo{@l-k`;KZ;Iup!wbPN=cBiw%j-=sfkaGBRv=P$NFmYQcV*zz{Qq*0w-a!1XL853g`)6)%7;fsUsgTBUDbo||=r0@) z^u28Mvms!Ou%Ze0wbw$QbM9$&_-8(%fccsS{r=&kfMeaQVU}R#Dub)sTUuK z{YA-j0W?!e^zOcB<5ZTm7dt)A#aFv|Ul*xjuSkUnn$2Jzt5%N3$8V|Q?m3eNdVgUo zZ%_gaqNIFqiU6uy6L1PUBkTKFq*`^Iv?IfzN;hU7E*xAW#rs^GTPJkzwGkd@<$Zf> zbUb4tRdGtFi1o3TvbgwYji)9({T+lH;*BP*p=!9TO|v&IUQL?j69 z-X4M3af0c5Z~O}UW@3(+K2DnRtsrid2T)=vHxT*rWf_Gyn)Nylb00ez{Vp+zda+8O z;wiW}@&TojP5Kb^LwUhMfSzK53@zc@Q zXE-OtIg6JVf8P7<7mhoGrE}3#*L~WHZ>C?vy`dBRD|)m7R%XN6o?wyZLmFu$w<%yo zA~UeocFKYmOMr7<;`gFhe(;gXxai$o6OCgqIv&-cWM7q2Rq7`sMWb|*|CSOB!YA%W z-caXQ=h7kBeO(mz;IiF9q$w$M)eG+vyRPVbedGHtw@4e~e@82rRp&AuN(4v>*b`+%b1v9%JoB-xy51g)2*@fEWDZ;BdN0@uEcgnAYD74U47SQ?(i-`1sD z@Bw{ick9h8dA9@)^dHWxiaCJVZp?Py008+9i4AL!>vqf|-!`Y*)%ewg#%>fpioY8i z#fuz5iQUGrqRNMr49hwAjw129(3kpZNT^?EI{n$P_u^sRT}x?kl6wS%g>iSez7luO zrlLX`U%%vQe*1|eE4D52U}IL8$$<2Gie+?`oa-n>`^8RFK$z=q7iYIWH~JBe0Wvz4 zHGK2KA)NpB?|9ivfX*sSp{r#QQxCJqY+?Fk>4D#bt;?!i+z|V-E*M%FdWMf&Nfnub(Cd7Xdeq|du6gd>Cs~=r zxar$2A;CT#5{;jYB})ZswjE&p;#s~?ArSrP8N;dAT!@~bD$dFh?|(V^c&pS6?1+`w0O%rG{dM{wM{+XO&k=f9fg@ zu;S7KTY)Lo$9T)-RosA|o6}9ni4~EesF;lIbm)vyN)<>e7RlGX+zj>4*H;5K2%M4| z1f2!smP($UH`}W4(g}~*Vh{F8Sk)FBP$d)_-rM&A;O;(r4WD_#;V8LLf(c+?Frq z6O?rJKrjQGS~xM51Y9VROuKCMoIuwuxbt--HtY`_jjQzGm8u_4CUY|uGS0VhW8)AN z8y52yuE4kGxf3`P_E2Ka6Wh3!)%{2}s%(?y%R)2~QkY9NhDLV#skKlWtdaF6g1p>2Cvy;qJ?jKVgU5O1z;L^e=vK#$gSDKv{Pblv&?*s zK&5_YUY4M^X=Fq!8TefFEGL~;KmwkxK?Gd9_ah-Jzox+Ua6=li(4W+|#Cbll0HmS3 zhsx`si$;pb&@|*HA2s%Fv;-)OQbO7=N-{XAUJtfHQ3dXldwGnVNdk(_&&P)qw*s*m z(ON%ztq(CXe7`0|il!Nuz=T;qW9Z!k*T8aNUN+A<{SbcB`JrBxG?d10fM3c6fhGkI z%){K8Q zpbdFg+FC#u?(Eo8L#@0}_A{U2;32=h3(5LwDmQu_NlUgvPZ#e}nL-KRs(*ER76TT7 zCH;F@IkQSTFMUa88P|9-u5!7TfFwa&U)ac_+UQ8Setx*pc|u*gR!ZJOB;qnmGe z?uJ>uT)h#9a6d%ytIb+^E-+mb#dVNgg_exHMrg-izwAOI+5QOU8F# zEECNa140E1F+UET9ZQ(OUH@i|sFd7sswaG_op@l0d!B=Jv2j51trlrUu*Aq|&XJ=! zu9b+yI=}b%-?MEJsp~ir-Jw=87$*e~Ix(jPT1JdLYQlVFnjfScDd zP{Cu}0|Gln{Xrlix+*mLwDL^vIpvQyV%xn5*g;J00U$Zup9_l`4OEc`3@uCtKc8Kx zO$3qvF|6|D{q^GL7A`RwdCD^mQEk+?FQ2Wv+8G^Zkc{R@j*K%xkGN_s@UK7WXP9lWWPjIapScO&ot&M><2vT4Ypx8s=237A~f1bof2xceg^$0tsr0S?XZM0 zUr6&>%j_MMK#kvhx|P|7O^zl)JauqxJzqcHj36x7Bp=qrNpHIFR_NnbvdvHyp{MJg6{*qCZZhl za$uhHoYz4;?#wc1d;Mjyl(+X^L~o5oxMLz3q>Ut!?4YXWN!aK$7=L^8RRk^?ZErT> zoMB~T|7Kq&KabXk)h*2-;-u9b54<2E%}P?o@qiHIC;g7|BfGfr?rJ(R4o>L23(M-_ zp0)a3EMR{y?2!*X#8I6O>wvG~_3dF}=b3Y43K)X3^iYB?ak`xb8ys6-(2V?GHjHOF z@zr~Mw?#raNN-m4TvDy%P+#8>Qkw@O4YUQjlrCNphm8VvK|x^t_?#C2(FQu#`hb-H z{FJaDN=lM(UV&n%r)cOVQGl*2o*uYWHM4Y`_kUb~&F1*C4ITP4!kGF9_wUK3+J;+U z59LEnp&N|y7TH>%akR^dLTL3La=ybA>nGIN%vZdRXU3FOq;%7@%-T=&@HiGg9R${v zH)=#l9Aw{*DZA2T_gpDI--!V66Ui<^?Qva7wD7@G=$31&ivO=Nt?2wrgG;Qn9)Em& zlQ^Uq2_qups%fjN;x}f*ne6a+p&vvtM6s=lq@N65p&{B z;hh7zfG%%OX*UW!#>vUc-(7Kj>v^JRppCFg>r zYPpYL!ky`CZ)njS=7;&D%MrR9O1<-CDX@W7#@_El*wJ*eJ_X4;m;P0mWoAHE`2_2c z;g?{?To0?{_S!!M=RETiCuoT2oub-cBU8_%UYy-uU>;EgZ%CO4beC2X z@9SrleMfdVU@#%CR8 z^#ipi=?6JP^ilao23V8aetsoi2ejLfvA5hbmY}IvRnZArsFg3vwN{7n5XI#Fn;$g? zBM%wNh0=fNj`-Ds3dD@v$NTdFc-D^dq(y{lw_E!crk}IqHGkp^h<1Q;6v2L+JPXKk z{4(7ab(*{Fn@^^aeoUrt;l75`M$i8mujKYVapuyzlg0!hTn|9e)%*Q*!sKsK995^4 z;8Tj~JpJ_(UV_#4_?;vxVDyh4DF7xL?XSK(w*8eExNqAo5oBa8TdJcIsbg3BjdLi= zZj6+Po1kOEC4oEmS?2}IXx2f&e2e@(3ItQ74(A&(#bw2K?Ib14PDeyeFz~zss$DRY ztr>j_q5iT+{4x;7SYn|du)OD2z`*$leFhIAcTFL8*M^ChW_qCnu zfsLm1!+!z!N>r$qz7f0}j=)-+Ydrd4ybkLmh#IZSC6w3r7orY3-AHXx#dfFq4wwN3 zkSx7~qzQ$EN7?VpZj`S}M7KigUd)q@dsGf)|GQX>KDzR+V_V-G=g9JQzgEtlI?mV=9!lyBPj1Yf~R;FpC~a_7N+ zH%IgwdzRaQz03^zyU~s*{IRgiG*D>pbgL;J_0% zKSw_>D;WaOq6?;ug+?N-l5X>7wUql86N52(r{AX2N2GZ#>! zqylCOdA#QXcjvB2T9mF+&~%J+8*7io>F z&!$bOdNB&_Z!noHAI+vr`I1gD@v#j}OFl8gVQdjjQHo(;mSiBf38mqs2xKB6#GWN{ zio}=x+u=$2sbeGQe?OiGXkF$r42T5wtMQz&Ui`wYC>YI}m9x?y!&`uc?e6cKHjG$U zEEH%A_4vtWE{%NWMR3NFdB$&HkF!hc?t_~7XuvUEd}|n&rD*RBiWrMD@?VVy6|EMz zL(m&^Vkj|KDIM_d1;Yzc<1-4IrH#Iywp{{BeSvJ~?_5L{e@Um*=z!|S_f1mj zU;H3JM5HM(bVzFez*p|Kg@06ej$fvbdbY~70{53w8;F=&eiWtBkW%)lUk*tMf9||R zEmMOkF8j6bE%OJNG~6u7hF%H{1CEo#W`*}l)aX6X$2HS-3zj9Uw{~=Z)zWx5L^mW; zxU|%MiPehAhgf=|+bS{>=;87n5TM=3^0ML$$xA*T_VI&6e`^LWN1LeJQkccRPbi(3 zKZFU_9QntO@!n>;4FW)6um8hL-xyhY$1z@?`)wHoWSQu!;d4uiK@SI5kBsLOC+D(A zLh{FZUvu8%2U%cI7haILQJzV|w%!*%uKaNahG_y*qCXIIev;BLPjeD0H;Si392SWg^aM;@m2+-t`!C z+T!jIGn~~9@f*0o=8*Z1hin6yEryA3-tE4@64PklF3vL@UT3~PpS2l?odHXF0I--2XAY&?d!Yaj) zP?NCf8m@KQKBwb!`nZmYqra*oXkjSKeMPRW^#*mI5VY`hmYa3mIS#H*F?5ywr4@H-@A6 zf-3Rk^lK!{lD)($d+K2Xwgi*TipaGCq_))ooDEaU&i{pb$t`YCGVxw3*abZw)`Xt^ zym7qLWS)t!vQCGX!W-Eu965JnFFXc2h*+Dk-dOvayoz`?4{<*~i@+V{NN*vUVwC;h ziHNX_kMpALSu+a9Gd$h${kKC7?U0?S`6!?0>)B+BC8QAjjT-1NbmPqi`C|WyO>3ihY9$UC#0#brPcgkxkfP=e4p5x zZRk_4JgK7*n&Lvt%cA*4C{<_f6cdhE$8oLc0cnKycTM&IAnF#0knXlig-T2*% z2b%CF!5%RQTnGV#A`)AJ>kI`#kbb2c-*AQDD$SUdHwkYPBOxNL(l^&io$le&jLG=@ z{*cTnDwqKDP54O5aQMeX&OEC&= z9)=;b#;O6`{b!fpZ7TRTc+N9p9{^1eNxmuo9O3rQ4Kc7k8|=)0p*#sb*ntrw7J%Tn z)uJP;V0AYTlyci1a{jareDE}+@^H(*+)j=@wLNCkyL!8QJTvi0UlGtTG0W7x==TSFj?ss?1(UQz60*|kOt-C?@{f>k z|M@L|VJ=~JsW#0@6k@UHerlPdkfiB)m~Fe7G*A8|QnM@;$g;-1ab9|$BM3b$R7THo zMlbbmJrN3%ZKrxFu#GnPG$pK`V`lVp&%mRc?=~v4HwENqL?ysq{gTx-!5v$*v z-9DlC%MX4(aLBX2u6EMd4!Wun&B>})`#l)_1+`x+$_-fC4B;5HHcCO9$mXb)6HQ9) ze{3`B$8-kyg~}CuyvKE?5157m zxCfi}wuc$=O#i!TA8!{p^8}IKZE4Y5w6q^bW6@%!VYdU|vL1v()#-07t zlS^P^h&g)6x#p;!MqxAvbi~7@@+*wOxKRzBR72kDuc{{J!SwJ4y%qd1n_wP!v?F5U z6iWQL>oHS2S8YeeWOfL;v1%*Fy3qd>DoS^>z|x4+p*KI#_;Qm+P`|@ax5U2*Wm4=K^Cs}&BAMoW)=P+1 zll>8j_u?Q&(dhRM+Gxb76n(s4DW^lkj|9hs^^N-A9}z{)@6-8ztp7^A6*hL-YIH)` zCZ3$59KFJYRcvI+i{2CVe;g%N%7M-{dP((!&Cuo`$6pP8;)`J;4g59qZK&N{?#QMY zDjs8!Fsz%5`zp|(fGP{%!qYIbzg5$qH7*(b6uC6bkJJ8wq*ceNy|h)f&loY3xQ5Lm zZ>*I2B;Ftq9a0RF@RAU?tAw!S)Axq41hr&J~tc}rJ$0aRE6LD$T0C~ z5Kb(`n$->lMGLR}Qc8^bcRC$T#JeWw>~4msh)hm6YR)0|#T>OyF7~n^2L-f*|LF5e zuLr{@=7>dETV`)!ZvG2(fH<&b?5zmZX<5X*^!A=q%60ThImxdfj_T=2q&$_ds=mKe zSpP27>#$M4o^S$ZG>{O{DTAdRMirrL2INl`*0G=`uEOhXLe|DZ?MKCIADsxyAc7@L zz|Eyy_R7t@DXBvzC3C}8q-w*JVfiy?&hR(kc_Xg9 z3{?%!2s7g8?xDWy1)LyfkKM!HI(X`ht}8>fNAWYK=3-Zg1;3OJPuyZ#8AdZya>G@J zKp`*4u+=~%V2eHQyFh(6FJFAs_uX(NPRwJM@g4tB`hO>J0y@WsJ<#wO+mId4hxz{~ zDUK}cHGlyU8$4vd!m$ap`J55RK(v2qbOFF`8VE#e*$2h)1w*Q;zfo1b z`_>~^%O6cq%f%Ww4zCndXeA(d+b%w@vpB!YnPuz2Ii3B-lekZQYc#%TndMN8(l30_ zxf7J~%I^p085u6XO;FS?JnP#b4 z?2r=q(IMT-)fhqr%iMPjW9vjXZRr8F?WcP;|BLX4AAPnREWTn#{qpLT$5XZKOys@$ zu*FQD8OXPe^Xc)l#L6oaNDy@>#uhjcdmdsrhn)xNcLvn5k!ag3R+MAN$iykBOoBa^Ld6J3bsqg2xli^E(5p&d99b+RUS%j`a za7Lw$P`V+~q&mMRmhw0pf%^BA@pZZBA5las(_3X8E|$ISPAWzIHndHF_dU#4!V61b z7B-jyx)zcxC#U)Y2~6}>OW_u~$4gBqNjqXr$Vv&L4bc|GlSxaLzJ#xH5v{pUvCLDm zeZP|fgWdfcPqijjzev9`C-J&JuFOtX+tVsHuD=3e=LdB!npZvk5PonuqP9vzA_cHL z2#)`E9{*+a{jiV3>C%xQSAx_88h3HOc^mpBI2DP~qdn`?-3xsuXfR5AAnB+jcj&U5 zc^Ft9^lZ@v%-Z0-SgNgc8Mh9STEYlpEeQdv@Z3a?AS^3>WnvzUX4K3X$q&*)An-a5#?GupRCbEvF%;dAnLnBbF4*Q zObcak>)6(hbnEG8*-?U_{H{->4vB3JxGH_R`i`kiCOexK3^RGIeix;DHstfqJ^X1V zW&xi|CT`(a|0YO<-9~C>)9((LTIpRRrj-CBQZJAp+OI4C$V0m_)`3a{Z|TZmKgjrC z=}vPLSZllPC%pVslIg*VFR%N+X&jh5ja~STl80#Yy9E^&s3?BNdR~z!@8d+DBYAR=CFBKsNs>w2+e;%}hlkst4=t7CCdx>kq^E32%8)Ey!u zV_aSbllaDWTqdw$fE*k02qjx88P4>pTERkg#h9;3HJeDdVlke=Urn`r z%(sC>b4SJWAuj2-TGN4KI?H|-4+8hCX?zCYGZ4F4rbk?buq~-%brBih_<}dkX`>T#uF~fLcq}}- zxBjP^bLKV=yrwArN{JwOd=mB{SX^dkRQgdsrX$c33@55D(B?r?I9$oqIa9{hs#^IV zy6l_KA-2=$y@)m47gn^9j&%_}n6DBD=AF{b%_rX!vMHfV9%>6Cdn0!JdW0obQ-kRj zsF~G`wb*O*yJj4gbE{R(gqv&8P)hvh1Q|6H$g>r{>%$W)$R-qE6bSCsX8-l^ z*>}ow%{EvMSy5)fdUVvx3le^BR;p-c2A7*Q4IVER_zVs6qJ7)@^!$qi4>wv2hb1@9 zfmu4sZ51Cv-4IZ*g09{Pz&6u#4h5u|n?sHTebg2P_d;(zf7|{uRPUI7YWj-d5RQ5| z5RXKvrG}LrATHVQ0sq%29`eK?ZhmZQoKmrTK=nk3?eHVs%)lQT{@zVMHcrG}`^DKE zBY%mMw*R~`rTGamq|jt;r!`d!_l~Fn|HZSd#2O>TDLyflYo*?!c_i%hD_V|a)oD7a zFJy!VN3oROZ#M_AEQ~8jZ?LJiGH-oH7ELidrc8(pZ^w|3w4D5gP!?g2Hv2Hy0T7ke z7CXb-!nu~t*Nb{x%P=|5mgm#;``BQ0sw=KZ;`Zf1LPh=?L9^Dl@t6zhwP_M93MN|s;?io!k3kf(f*cZ&L%mR-3i!%b1^~8gnKNV?5w31)= z-1^2Lk~Q0Q^(vE2{b|n7?5iFczN72Q&7~{3@;{9ws0x4bS@wKoV;>YR>tyz}u$V@~ z%1&LfX^vNKb^#WQC4lH9z-N&LGE8@cH#xuw4w5VKUkR>3Rjj)8BEMge&_2C0`C`S8 zcT9pZ#ry9YCIE}TL6RC*RJ{H`ReI{u_f7-KtcOVJ1w&IoGg%GxzpoOX01ge9Ffi;L zKx&}fKS7g{!dqJN?9iC!_VxHH!J#=!4BpVEvgj;mTr!rn?Ua^cf%B_%6y<9unqS_TeHkE z=Hr(cx&`$9WG{Z_#EE1#*H$;GoL?C*30amUpUI(Cf@ez|EEN~QeIFi3PLDoMZBrSJUtNsjKbihX+YZ5vZ8!AUYECot7?$k-)%mU=-x?>W!D}#O z1n0s_0)t7>CxmoOwDa<;l3Zk^B99QMDX#Ese&v@$AK$`f(*G9dMzPx+^JacXXnmJ5>ZLKJdYU^Tv7^R2L zk)XD^9JpqO8n2V8(HTv_-;Gv{g!w6ugbF1BSxSHVu$pvtugW}=Y)Mu_a<_@9@q%al(IB(jq9>ka_6$XOVqo>!4IbqEjn)NToVs^O?QD2UV9q`9$vZ z9bU)G0M?6FmgafM-)6Zi&vjD>{a>5?<2L!eaBKy3W=!e^z(Q<`b3tX%%zm-#M*gWx zt5ABNfAk~YLY>nud=QKgr3tILsfaZ6i3bH(#ZcgZwtv31QZ)gJP;FuyRP|efsON(V zMm{o2ZnPu}Ngt$ac$QJZQL4RPta7KgqfOl&`*~MtvrF9-ZSWUcw~FTR<aI zndc=uRpm#JOGI=zn8mh!Bjdxsq1Z>BoEOBa@uH6)PS~v7$lV2`nr3I7JNYpRZQa0D z&qYX6KzS#aCFB{|YmnM=Bh)uO3s6&(+zVaqqXSq=XAwo$H;j~Rn);cUM{zo^B=%El zV(MN#nG}Vzy(3M3Y>dD;mCgbKXQWO?$wZ8lzMHx*6zwtlg1wJRSvB8k@0g{_Mf0p9 zM!Oq1_#8V7nVakBbnJxbcD^}B-hBOGl=S5Z@5u94wF8wfSlIEJ(!zPyA+}CgSkzoRBY)p6}E&yZAn#Ro=YX>cF3H z{M1VlEI^LgWAqr9b%wsZ0gb*)kbQUB!r#|kfh;1jKk z6<-wh+A#N$nN%LK;{@xeU`pg&Zxnw?*WmvR2WW z=n%}nMR%K~yuUM^6v7xBX7g4__)O zpc4wC4!L0Caibbs*9!YFEcRw;0y?_o!|*v{h7WzM66owIrOQ8_Wb2(?cFV*p*4iDu zIcVO^cq8fqmC`*OlI!W=ZOfay6&$ADyzM4VSj}dkLc|#IffD!FRu*3w93Qy)^ZUKB zrX_$+!DKFoP=}KW7XlL99uQy;Jb%wbcQL-@e1RivG6jJQM$Y;shXE^OM02>@Z=PF2 z7Vpc^U^?004%GDUi{j~hq|@rNyA#|~jF>pLIE!W4(qD0M4z>-tMAJ?}u5Sdh|M6=o*55LxwT% zin!kZJ^3+1<$nM>W|7)f8bN*ySsR-FGe@mD0J1*@(csMqaH}AEt-1f>0vu!}MpMD8 z_#X3EBr*w-?rN>166Hlcf6+;W|WFQu-J0bRldNaaQmpWJnbO#^4*G_sponO3?|IGeH;Fg)( zz*&WCtrBd-9LXOB-1o+~LgF+%0+2H{C*uzUH9j;?1QlFO3u25N2!8G^P$EU)E(R|W zMaYY}`)m!sjl0MBRg-2NpE=yg23Mt>vkAfZBu3M~9Qg*!7$ei7AH}fY2-EsQAoy4n zc2yrJ&bDBmU1@-tBvJKhUx#RTCXB9=sFNZM8O7=-C>|jjg2VcgzV$+|9!^M&u|h_~Mer{6rF}12P7>;IJ_Z$Vv@Ba{tQ^bk&mp zvmyj9)ZG)|LepNMxxo|C{(NT4X^KZ^kfYW1Wptqk>I@9v{H@pwt$5G#(v|5UKb01F z5;Ahs@UNlDwFsTGp&-);V<=8M$>py}I2)7Kr%JELxkJRVb|lIVA$Z6$5$tAteQWXe z`D|&btzx`r9F0hkf8Fllgh2<1?fx1(F8--|FBg5ljpD2IC~UExGxt8kHr7{NtEeV` zLEc*}vdobM@!XnT=cqsN=e|{EO8Ixea;hgolMT{9DR!-(ME_W_XUrls&s-VTk$@@p ziSq)jNgudEK3|Ly|4g&UeVzzJ$qekI2qbYJ{=gy~l}|Qj{s;pC=e30GEr>?uQy}HZ zX4Jb1b#C^M2ot4?pLJvg2EHgqDnYqR6mk<@A7o4q%eqS0N=Ot_wkQ0N!j1R}%0ANF zzx;LE$G>^SGxczR^Zj?A=!h29pd4yl`h?ZwvNdOJ0_i!8+3^%vIR$U(MDo4;}M(8(EJhq3jvowshb{P(H)jVSqH zQU$(yYHYME-2F8N&0soMWNXt$4o)C-Ts-~795!vXM0!98=qn5Y#TZjFjZgK!z;uU( zDJBJdFpLwQfilEPy!yq2X%gsRxtAfUN$aOZz`{^B*8;GMP_g?nD~6<9@=*@nJ#)Ra z5$$DuQ73GFWza@9Fd@{2-6U2VtgUh?PBGZkAMkZ}(hW_NYR2y>U$M1XG(^{nB?2#5 z_iLEV`@QzdZ@A#EOk7`Uh0 zsxuc#+=g_V`pO6aYCCD5sM)vP>_- z`;&C;HEH1EZ6nEm!>rH4L~j5lbs!w=D~Sx#aR9eS4-^z=VG~gRD0lgs0Oj}^M!`y4 z>tp;-54q%)^G=aQyM7JTz{o%qe?#HQ&geh%JJAN&YJP$~y6AOc_2p+QZ>d|su1WLRY zIt~?3@df=v0HQ(g+wD*W$npnUfhH75CUMP$fI&iAW~YtM@@&+9dhRMQruM;<%Nn%3 zv@P{m-`r=P8X++cyd<5iyzGG3y zVtgc^#de!yYp)flRO?k?V&lA!7|klk^qKuL74SH|{=sYSHR!t*&6}6XgN%=psv^k6 zcrwG^-yG^6Q0hM^k4;Kf8I7JUF6zA|QqTfY@_S~bV~z>DS>`A8z}u2T4A+D=cs)=J z`jJPLYmV5XSl2v*kcDTzI{(ynRosb%{lNri8TT#j4ai`B0R1(M&K7Qv_-uEbNa_9n z6EaiuaPS>nb<@2SH)K*)?ck&}i!0IYh+l?RGAAj_TL+uWm zupQ5*801$=nJ#mVo_6=s$altYgX^U4ebxYT63sCyzi|hOf+!C#ii~$CgNkc|KR(ES z(!ovN=#%=`6kYI*s+v9XTIH-u8cZt+6XWp<0q*R6K^b5ETT4Oxe;;zQ-viTEk5HO4 zIx&M8sj$|)XTSdx+l8W(0gL5H^5{>Jk;W9NhTo#|VNH>(q(0XFeMt}h%0nuIL_t4r z#Qbc;)es~FERB_uT^9rP|7rB4Xq(Uj#V#Q3cpt^X6g-IpK18JDkQ{~RFY`F!CJ1}eDES@d zRv;!C2@l7|*@4$k#-hk$gLy6IW;+S27pO=wmn*N?f4V)=2>`p=PO=Eys7df)TK^+aL(0xbYrJgLm}!0I4u49H zQSEM!C~+`zD)S+y}(KvcPVTu;4~P3rTwF-1eqXC=(~j4=#9j zJ)?G7z;Rp0r}ajq*#%7B<1S-4>{PFeVx2Gzw1YazYSzq!V z=e#c}9D?tWSpL--sC5`WNO1ZJlf!K1K7I8gF74K>gfwi?g#fUMq$OgzAAj|HglJ+w zAPwA&Cm9?h2tuLYV3|%hTkPdYYS4-x3(`0>ZJ6e7M@n3ZFH6UF@}AG?1UrB__=Phj zM^W^Fb5!<2IO6yv^9Gk>!wtpTlvTLwXw@$#U5ddr*|zQKkQTlikI@cM8ruWGCjJRP z@{+jPz5fn)6B2L_+n!KC9Ik&KObKwVpc2zPLHlZD_wQ8M zaoR*cqgf?jTQdENknujSa>f%A#jN?_+r4sykrUYbG09;2K99$tWq-yAVGlVr8@yaM zK|Gf8vYu!^qDZ4H#UbpmpP~qEZY_FMuqUqrFv>!;09i9K3si~RSTX^_yiJbuem*Ho zS*s}~ot#0&&g_hVCQ(CW1Cql9rxSftZp1f^lvk50v@+Ygq_M3klA6>?_dGUW z^ess+)EX_NR39r_EmTGTp(Pw#ln`ohV!9xI{_O5Or|nbHfZGQt9a8z&1qlQ*#}>4> zS^}Nwyl4t@T>|{6Tf}~>Q7u~BojrSBn=*27?Y;Z3McMJ}Q_CS3RW5o4mj72@p)+sjI+DbT=-Ff%e2o{B# zA*$LsfmumV47E1Crb4jEm{ekb+$=qH>U*o<9`564H{63RBKE>SZ!^fpZmo6^tx z1V8;#CySy^dY~M>-teP<_l#yo9i%0lUOV#oSqGKO#xLYu`0O@V+h5vLaKs}eSA`Pj zd>vX#Ua1Z{xi_DspX0^=1z}hEL7D}FVKqBd$FnMc`x?x z6!~5Z-3$E6HaQ^h;TMo6#iu}lJRsmX|DF6WSs7Cg3JG|n+E9CzQuG27@Vnt`H7Tr3 zVp!%_hNyhAL#ejE(<9wf+vaBMBgBOs@GIv~_0nR*NY1<#y`nYJnsB>oNPfO%vQF+9w z9pq%UNZ{Y83@)BGjgPyF&9442g+eF=xYGBElVnQHY0Cxo1{rHWA7n8B`R{{3;s`7h z`=0rN2DGEzZDO5<~@%^i-<=hze-lbJ6YGo%D_#)}{JX(54uXPlI zpQhvI-LB&c+fp&*!LpMxxZfMdjW1K;+~1P+K#p~vP|PR#7bZC;Y%&D$3B#Z@eMkHM`-XH<*p-3_!rnsHE=djz0=Zl*aO&4X z%0$6z-)YSP>}X>cm32fL3q5nmj0@p142Ol;n2O#$!v9-obV>e_WuS~Q$BzgW2B*U7 zxsIoAaBhtsZ%K9R(wd_m2=diq?W@gPN0Nxa$|eqTudRV^MBe3D>fq&kX{^5+DYR}Z zPfh`V;Y4|cyRy$fA>JaqehSq*>HgLm$m2T7`XzDBjXCbV9(4Ysl|4VwWBMs|=|KU2 zXG)E)KVIorn}fA)qBx)o4u9~O`FEE4m#G+#H-g@-Hcf|p!7hIZ7?Ev+5rB*(Nq-W} z&Oks_QYv*)oE2o?8Gyt1J7Q*_G{?rJ5o(^Kd}_p6!h$SHME`~*Vi}*ugEj|u5wRKu zBO`Ts7Di{V$kNLPMaJXP@Urta`l9MkY=bC1)YRQDA_ybtq^AFk@Ld;~#IpTV1cw*T;Ux(RX#5eB|Ik!q_}lECfKP4eO=i`t|=U<#lO@UqMKxOY4**Nz&5;SXm&)gwXL z;&iy2wfNXSg4Gv5Z-h~~6{01KL&RuxtP7T-y4r7lBhl-e)vR8NMCwwp;8^+hY*I6C%{J14W02lr=+DNa zd`vsjUVi67%LW1lVDG@=?UI&-gxNKbzu784*JmE5hb4R8XRsEIV}jBOWbxa_`Iz@s z5v7V0fwMf!p=HdJG~ZEKB_%eY_tF4bO?Ew@UXs0F4#;pfm=)tcR=@Law{H$~HoBv3 zyf}M_;$Z%r-Q0xnG2Tzcbu?X~qsPN8tb{s+Lshp-{&tAHFALEr&q==S{cgjgWYzH1 zk3T-lPA1uc)3ecphy+>`IkA<5lVd>1NBv)%{L#+3wT*HBA7eQ5XG_~KMrq?|r7SDZ zl?wdtTa4lE?XsRxF~LanTFIlfTZQ9aICL6^1lW|!{&yzI$??EK?j2;j80s7Noo#YR z^gGaW8H8xts_UypWGe{VF&DIcKF(DH&lD}`f@X(t!~%if^!{o`!i*;X>sDUH@}&D( zn%E;tm{w9Vqf@+-waYSp94Fj{OW@A7}^8G&b(nyBQQ{9@emt(+inYDqRR zR~Z5G@5XpC(80OLNM9`CHPi6q3{QfsVMOWq2;ZON3vh6ru06{KJkAVb=ci?4ut zAVo=nXi`WsW~KgfD=%UN{RbVn$bONyJpWN44BW8Xbk@Ec` z)N5<=+X_f1R;Nwzg|_n#CPPH~&_^z(L)*j`(BSSW zWsd6Fb7{q>HmJzbEYD*z*}t7;vNORAL#DSRI&U>lG|=KdZpnVHjUhNtHyl>whi^ z(hA}_DLKEJjjmm6@-Xp(Jsysu-N%}}FXKMuTXabc3V zx#8D1rd@i(z~5fxfa9{i$$br!!ETb044${-pq*MqK6d2_7@DOGP@g&p01Gmb#=NFK z; zMaO--XIyrDi3w{}%zrfhP8OxX<>2Zll}*7GFoxqDsm=#BoN!`)t5;IHbz!+0iAMSU zB$|#pjy04VqWcBjEw6@K%Urzr7|Rw>&{D~$F%(IhN&gToMh1}*@Jx*ECxA>?`|{2K zbHX!p&RgL%k^0R?>E|&_n?^}9CDmd}53qEo*C4=9emPm%UFHgOB!g|R_w#2JGsmY! zBQ>`!!odf@#Hy{0#wTbmw$4G767jWRXtycp@MJE0$Zm?_n_z64>B;LVXdt56V3`dL zOds0_rfz*7Cr<>+rJ+&vXPMna);Bd|fy8F(HTAjvc)EVFW>;FF@6kma4%oS;@GWiA znYvEhXqu3xEJ|->1gsaE|CG=6fkr8itAkS?; za6d`S%A;lbUBNCuDt7Sbxd=}TQP1Q>BHj_YAp**`omG8$GXcLDiG%9jBaU!V1ud~#h<|-F@l^MQ8w{@VV(uSrJ zgJNt=ml}w+ZT@L$A&FECH>3?{NSA8>;<_P?azLovMJ--syb{$3O2ig6u>GF#+gnR_ z`X?7JvckOfEi<&Iw9Smvm%!~HS@gM(oG;_p^-s}cbqsZF7gpLlXqRs~L!B!a!o(Y? zosYcxiH8g1u7Ix8}Mj} zfLMp?h{)`AS+{mpgU11pcYyvA7GK7Uj76jq@<;~goO6Pn4-&>4F~(e_5niE$goUOc zLm=3phtlZF71ri3$G3p~x1~L_3_*r1xlIVX#}Sxqa9F4Kb)eMKqnL%m)$cZdS>~GW zx}PNate12Ko3d0RZM0M%HX(xRbk4-Q}>#L(H1i{}=XsZ2flT$B=o!>yGr zBR_#oN*m!i{sb!Q5S7t1w+1s>XWE$Nmp>#}F*Byn1OQlVs@dvy?ybV_!I}z7c=r+3 zClv!Tjzz|)Yp)bw0iTc>FE76Ra76q_G(F&AY`f&j{2qVfZ_N{SNq6Tt zi+qh(tLc1DIEmhQ=mtLGrrIs+&x477k#JqWl=Mf|*aTT6QC2;O`6 zXCo+(%>O}eIvT*Y{pp(HTIff0T1Z5!J#B`XDGtk15l4ExU+1{R@)_3+g8`E6{o$Vo zW*Q_bs=CA^Z$l3mv_l%a>{24U%FQEB#X4mv&Z>ZJXZomgjHdw}ou|oKR91np&*;Pj zzn{wZS=buYu1y{6ldo=018!`**BLzCGxm=Ew#M_XnNlfEF?8o1B4H@~|CoBKfGFE8 zTzKeirBe_@>F$y)MHG=7Qo0-I5@85IIz(EeLFqw(p}Rv;Ns;bh*f+laxBu;l2OjvW zS#{kju7y`dg;-hv#{Wm9|6XZy&nLwcmWV7+Stw>9lLTMRgRo+13xKf7-GMX=cdKxc zAaJND&RV(T!0EtQcnj{M&KJvC`DPkeEZ_I1yjo=$+DqODxJ0wmC9ShuM`c;Wyi!11usk2g7FBjEvWPtp{M#F1}a7)MV{+ z^H!EKVbg&Y!PO~mwjrYSU#_{yx6=~Z+qz(U(;@jMGC0iu^z=0V=P* zkHip)|BQC^)}0x?VT}`;%Is(x+c#^98Md1Z8i@7u%%2tQKUCgsbo$>c0N)6%!wbW^ z`dy;u&!IasPJMNk8n5vy;L71CSdnsr4-S?MyvTB!%Cj~&WY;Nf=m8$?F!KG~U@{|> zGr+W_Au&d*t04F~G5ja)q%J@=ymBC!vy;o;gi3czWgTXZ#Z{7M^wbD58M< zUJUuGNP0I=1j>$6L{d<(knJ%$by{xibCIx{?YE}KSj}1 zEMB_m7_3$MV)$f?NBjsbe(Po7b1~^+m{~N>%92@s#rS%n=ZHVmYFjsm)gwn# z8oG5x%;>qW#XCCJ&WdUrm{vS9F(X*-=e?>YU%?8He6>MC~myB zcIIwDsqz4&!I%FxNgF)cLFw7>^LCs;8EcCZbx>63!OK&N!o&$hOPzcD35x2OXI;>e zjBrilEsepSz4KQt7!;iG#=m3O2q9mV|2f6hJ%)ELn?M=boaRI-{*}th`omS0 z7qcGBalk!2DKwtUh&)Y!yA+JA@>~kH9&wGX92m)--sYXii$emi^H?*KI^58D*_6^C z&Ip#4bjW{mKMnCdT6>!~aihm87fRjOf))wN@t53Lhmwi=b7q$e_(i4{@hOUWB#9Bx zT#v~)9lug_l)@yJA%06ge-{;f`V_P7zA-ZUr=n}! z5ya`~6XG|-*|@{Zf}@qYbnF@U$7{Jj0{1ljTp$kno`Y|}J8A1LFobD!HBWB7bn7oF z#+VjtXmun50gzx}g!`16?Y2@eTFx>eL@NyHGyjj0l+*!q&`2DEj+qyjGb(}&3i7L! zI}m1w5frVRCg+=1;~OR(S|gj=Y01Kmp7P-Y$PXoM9f?;(Gdx#c*fV$5-)P=2+Ev^| zqp;`<@MWUX#`Iz{ulQS)t{uYYRs?tWzV`w3SlE)WN#KPX1MCfsa;_mw27-kk;!x zq1^=?QLwL#{QuKWOtQ>v7p@Sk80A%X4A{v9iPZsM@U>!F@a0p9=X`>GXm|4Y~_E#SRKgK@S~n-?5Wz_ zt9g)U)pM_S7!?}H`$9VgtH%~RB_H*hcOnTQJ-)E?krkXjxN{#Or$}$z+(Db$ctXue zz3}nAt>R@eJq+t2$wVax%|R5#Kppy16hS=P3kkEkt~8i_+_BR+aUiwyI$g-W zPRiIyR{AauiRInu0%GIH!PZnZY%m*f50Ix~^)mYWL8*ANt(g)6iP8lB+1Z9e?`uG} zZP0?_ez9}YMcC3`Ry4l-d);&aZ@yCi;=kzqA{0b9QO}rw`5sR2)Gq{U_<8!-r-nDW zgHQh-*$Rgb%)$JUf;JAIpec>5Hl_uCZ$4Zz54pFF!_3dbR4BD+&v)-s(u|sD>1Vr0 zXaw0567Z;|Pc#)0FGh8b7x9g2DUYZA{I2i4t5WZ0bGiO~2wQplaIuh+aYZ*I|M%8m zv{b&VOiq@0px;5V{~(P0@QrRi)#k;DGvu^&qX{o^$qHzV3WNff$G=cee61ezMar!Sms{0_ z^S$a8IPQ%Oh9UqZh(;D9RMT1Zl0lBZj~v34#`k4mJ@1H0{gy$TYW1-}`5_jg?b2X> zQPswCTFk~b(RUF|yRx5uKJFJK7NMn1omP9@gkUwtJnhk0lJOLssAN~A{z^ES3mdX! zE~jY+G~mBm-TZb0Q8d<#*ybPtMETaf;27fld6i^e!6h;JJY4@k2FxD6#dUWH{M%XS z|5zK3GX8=+2YXpxT{Iao>QmG+hZLF&EAjR_4tSh>U@XQ&b#URUtUi(ZFEF*b!RHP_ zL85)dFA;#7+19&T(+B9kbnVZHf+0It6xvMH)OP!Rb2$F)>f%GUzCEEayO%UR2CYt^ zTQ4syekYDA*~o)#nxcB{Q5V1jZwn~Xf}%jW@dC#Jd(9Jj$ZkJhrU57GvE|X;rP5}i za*|Mp9+{QwV7Zo=xix>tefs?wp;Eib3x*4=Fb-v?XzQ6idH2!IZ}|v54j!0&x<7BZ zoDHXK;xJm#av`%Y@^CTsa9Y~6==9}eIXPl!*0RaDBBBu_n^-A#tLD_B&YNh@7QnF8 zs9EqzOf*XVa{VjI%+(w`q5@4UXNs;4D|+i2n)bytddJ@LvF)fW?*}nB$*_Y|zd7Y+ zRC!8x+)Ct}0iasRQVK};%(!9zWu9o0I?am$G>^*~nl3tdImo8w!dXuOV@3M4i}W@4 z_cuRwNM+jp&N!lGKl(nNQK(IeLs9u}9MoH9N93A+Gutm^gjvccv8Tipqo2Xlt}d;n zRSNm$DJYbKG`|lrQyGQn2CDEC-efrC0*V>n6ygK9PfYA1oYw$#|I1KnYP#weZ$ZaK zK=f{t7W6n_KOD+{;j-LxiPfuLDwybr`d4;O? ziouhP(-IJqO2#65c7o`EJgYM2=#T~0?JUq{*#rz`Y2h$w2dHjz)sv!~qN-kNeo$ZF z-MK4ecEmeGhb^mKJ#tRCRVYdwve*6FchK!`9u@Z4dyi}m=4@12Xl(?+*XxPNbURefoXwJ7PiRWb*7xZ>c|WdMxKF5Gn}=`J2eKN^@terv5=|n zk^}chQuvZAR}|c2WYm419z!6;=Pw(|Od{8|;5viw_;BMYqvOSJ0#)oYY5vEe;jc2f z5GQ>repp(chcdB5t?o>m6XqA1h@kIv-`SA(y&##oIiaCcQUfd)X zkU$+s*S>#+8M#ziFjdKNKGF2EbL@EjG>Mq$bwq*4KM>93c4=fdGGf(lTSNUyx&fQ0 zP`AYsZaoUqnV|1}!;DR>I3W+5hZMpy4v1QIhTW?D$sba`S~zRhoWC+|Zye(JcZ z`~*MkdA2Bl$@^W`6OsyfAKPi4HplaaMe&%^Y#VK*>xh<`N_+PaI2xHQpLqBMk}{~z ze!;ToU!tw04*Hgsse7|y{xUR+SZWbM-{!=J z!ERx9k| zG!UpbQ^YI*+Q+vVoPoFF)+bhtJ*~JDZ;6VojMX^_L?b-;zBOet8Zd05vsUd`e}5Q_ z89Nn3X3(b;=l?f9xxW~_nOx}0l|vTs+RI^Axhp&mA*>|c5lHRc!wl>8heg%b6EN=yjZIbU{}eBN(<`Z6UICfg+x_;_zK~_7HQ{% z7aCx0SHO-zIL;1juljLLhbbPQNXb@1X!}bDtouaOF&f20)(Tk&|c={a(9dy8G#h(*y%6p(Gl=NwsDM_sh%a z-RYFUG<2E}jBvj2+!lh29oDb`1qX+4cG-`;udCgp4f}U5_^uC_*7hFWqBG>J?}!|{ z?(=2po?gzj;unRzh=so{0rVFqQ~pv6#Isq<&$ND?@k6>B;^)vnBpAy*jM;Ld**eKT zEn?yO!gq}=ug#Q)bsN#d1293CPo|yFR=R;vE6-x#Ea)znn!;TO1MeHfa1AcVEydJM z{yPVhF^?1XR|1l#9c!juEwlK_CK=L6tv$0H2I%LcFVO^qqdqmZuE_3zR%@fUjf>MC zB@kGO1Z+IZ0+SKl&CWF~KCT!OW8!F;mK_0u-`J3WL1oYzreB}s$gL+oZ*{zX@LFBQ zef4e;V!<&P98M3-xS--W6NFRH={T&Ba#%)ZLV z!zTQ+e8C)rsLHHwHoN0K?lI9;c8M$LytMsOzk#x68$bHX zFiTpGL5w0Ob*F5Sf7HMNiU6aC^)j`a4J>MiFQnca=2ayc#LgW3G9c-mf@a$8MRf+6 zrTCWEpkPa{DcUxT9;|v|xWxJwGi---?9a>Pdo6wognifbcKm3Xht0vtR|S-#pw0T9 za@20q%{?&ug3>m-C~_WvU%q{NzlIP(J>1>B7h(WJ62WbuGwD6l@K!w9bJMvMisAG9 zZ`JvIp84SZvl+(D(UlyOwK|o%{>Sr;1|65^w!z4*X-58s8yX(*Dqv5t3X`U3gNAjV zrKcvP@RGps9kwSpuL>LVO7WlQK5u^KYS44{mGD5zKe~7S9H^?4x$44W6%NFbVMu-NNX1JtH-IsAs0r3FB&(^5E&Itj$U`zE?-W zuV4a-vg7SYI*P=r@#B4cuv!d(G;_7B?H~{O_e}HCf$JEA{r+Sc{Y*J%bw;=VfA4EE zT-+hx`npGa|IU<257%C3>5yywvR?p`R%F-7&R&1APtL~Q&QG3y;>pCa&Hrkzj-;CB zOBQ2tY}7&;M0}49HCcO+5&VcifG>&GmpQ0|mZGJffI7jbuv31Lr@-Lj7e~%hIdntr z_}DQ>J4l@8@G%I}_dP}i_q-}~t3e+9xO9s(84~j%wnRzaOGN)eW~$q)=Ex5d*8GQ{ z5u4q22*|aF^P0ch3ytQoz$VXA=laAtx(bR^)L7G+B~ag4aA#G8%YxsquE$$aP)s`d zRDGNB54qnGeUY(6RIx?$ZVkEN5HDS35xpp0+~~J)#$bY&r1E(D6ode%<#aD@4jvlZ z%|4LEqt6gx@!UvWh9cRMcXXH;iOZt_4buBz@lZZ0_yyDTQPhkdR8i`a_?)XS~i^dzLxlupsK@kfARzq0;TL%*?Ig6EAUZ&L`&GRd04VM zZ&P~ES;NV-=pZ`nzGI%pEw^NGSiGcC2j4=U60<99=9 zyizQ@{6S`rJD+k=h3~G5L{&9fnl326{n&4Qvmxma;)T^w2~p_i|8cHSZmja`QHT;~ zr!lI*_)vZ3dEK9MiEC<&Fb3d{$(o{e-`S&#ripIVMWOFgJ9Chqx^$?_cf&(1?GRI$c`hm)it=N>|FPXV$V!Fb4oxh(hGy2|?;|;2*J$QKp$jo1kn?|Kg%dT&V z=8}jW5A(W$omT&d@dhj9dx#}Qum)RunkRL)7=w-`So}BG?jVAP5rq1cakP46W2siY zzHi<^Fz(F9R!{yaxksQNaU6HNQiu}xnQ>@mIY6g*9;u=+E(RYZZiQ>8LN0n;L={#ETuW@i|YIS*Zn(?(F5)3n`!(loc%w9IJ2B1V2; z&XEwuO(Ri9TzKD>AVF-qS-nvo>IAKos_IuVG!y5mD7mS@s(US$^!nX@ROhY4M<-|U zk*JIN6=1HlvWn*0FX}(dB?Ct;CgmEGV=OlAVK=qj*7MbC5`-_TPHut@O9NFOmVOUo zOS&g#E_>{1yU^pgN%S7Os9rGD) z@JEP3FwQepnjo{hQ480PLQPx{^JwOy%17ygaJf7mj1Lc=^M!^P>aO9kgu7r}i(s5q z_)>W=_&0t-uwD}1sn@4w^A*o;bU)G9lV`R zUapF-uCvH_%ZkbLDbjSrPc%qA22T<&^97SGhfJsRE}Qi z0TmVxt-xt(zO*!`i`ARJeDi6Kz*9a-8!igQW^pJ|Q5X3e7`ZD%^# zm#>6={$M*@9uH1Gku~=rBppapu`JKWteW`X_HAZiyt@^r};pF39* z#8k>OD~n%SwuEy8qF+H4kIULJG4w=(+yAph<~7~|neR_+$Vu5EcnCrcjQf%OcnQH^ zURaP?(*3i7k9)KH6;(K?%|eFL7X>b6kF@G|*Yk52Iwn#%DVl1Hchub1y_Wi8FSiHl zQt-ulvyK&`R~-JApIkr44|6Z9nmAxuPu}1r*%GSuA8$GahS;W%t)v)bdLCE_ufKr^q>7{>fWL|CkIWCOQGQstE!kvhoJBqvUrmY(gp+5?M;+s8ulc4RS#uZ6YtFLF z8oLlnxr81kT!>Pq2aP}FGG+-URd|~f+*WofSA3(5&UDoUA%KO{BPSy~ zF^2c8tC?B(3fi0_`Fg0A&bbVie|ejiSd1KHSEUgRM#nbgR=?5x^Ul|8&Evulu__Ms zDq`DpRe26#`zIQ{W$7IKW;>tF{#Nc{;wp?;56*gKg3BMvP7I{`jdt_23JZCCr4Stc zyWP6O{C0uxO&JMz%D_^kKd=vP9szCT)QMQ-LMr9_dnSF=< z+;{mRyHi9nK4`A348?XdH767eb3A+4k7zfvhtS5M(X9u^Rf%hc&hDMTeaBQ?(gV+4 z@es|nSZR&c=?06N@+hxE{mEM>dUXB1nEx6*kq|(|>FfpGU)!VfJ<4I4uFIg-v^sC> zKW`2d4oK)nHb>g+e1N|JhvH8^^&I;L6T*{IwH_N>TdLfh@ zf3)Mrg#W-8xYE0r1*mywgkXgBO_!yr!wY2~4k%=CEh)dpq?EF|+;2;H_^$E9U4mF?;tTg5cT-_fL2?v6bfzOmq8LrOMn zZY-{|09wCdpY;&5Yx+MV?pvqdAK7VVZ={W*R~D6(c$!KECBF3J`aReTR`GoBJBE!B zOE37cFXw5s_iDBfhz&S^xJrnA;Ug&d7bWN&2ViXCO6vCeE!E;Y!Uwj@b8H~^DcIDF z+rszT?Jzy&_QnXv&?=*+j9ehL6yWT|n3=fKdyHuOJAL;hj(Xl#kTNY~&>BJVtnVl= z=Zo7Be~Kq44@rFmuD2oRApW(p{QaV_T7X!-V(Skgmd4yUQMCY%kSkoI$Nrk)n{Oh0N;8h$Tv1ly`s7bg$V*qL z-vbwy=aJ)9E6G@?R|J0D-^lgWc-2X2x1$E_hi;6oT?LSTm%sF9IG4@sKhcmNnv5xB zo~6In;jFOvPcXUdg7LtWyb(ovUa|H%V9IolK~K6}q5L-V;Uj$aA-LTsP^iczCgQQ*ZLv zImdB6bIal0H*0)C5b}1t9Orz8escRmp!B|db13bZI!#b~Pr5t$n)C9VyE#`pZJ#F6 zNV*Spao`!Nr`5s+!*wEN01}=-{KhLqE_L5)%bu7?ycG%WInE@N*!7s>m8zocJtrV( zVZSWINNBe`;^koz!wWGG(mN}7eh~_z8!`B>ffT%3}JZ`&Y6)vwEPOAG^O%*>$|S0^Wl*#tQ|3QJVPggMIx?Q1N;-X!y_RX( zOVsZI!BkC7f`2~4;uUOk-jB5JeiJe(vJo5FX8T9UluZHi;|ji zbEahdV&YavyqLyTI4Wk@%tUwzGfEK6ysjavy!pNrzv<~nBnN-3tvwe0u0B%|**n3? zcYOSy|LWnNJ10-Xy6-UZN-UnCNL;ZJSXdRsGW7J`uPQyU*9tg_i-o)YYNj&v7k_DM z^t(@Z<~-Bp-S2!9EFF)ZFo-4qgV}6eK{F$5Djv-jCBy zicImL^<%aG71-yC<5KDem{5gkbc9b@@(bL!jr;cW9tX9MSGf#O_dP1Z{U;B&6jw?i zmS>4-1^;`Ghb_|F`cVt#&K9QLano1qk|n_>2IigOi_>|obh+3ABg6UOXD>!<+gE%! zpsF2MMaWpoEcftDrE#S@F1)ln`6hGLrm1hFp-OF6HQ>Tj)T5^A2c*+J46`#)r=ZbTl|-e)L19^Y!?RI7@%s8F&zk6;7yguE*u zlj_CS&miS7+E)?Sdbz_`D>YBegz?%Pjfo!$*yxX2_N)AJ6kMUY^|s&v_%r}_=_|U4 zlo_)LJ2zGiEyob47E>oDg!mF2Q*0ZRKUqLr23nEGFjtx+%Mtr`O-Y&%?_RNK-0G+z z$Q?I0rcSP7ZMnu@lLqw)|Kk%Xw+{%tIHTR}vpgQGB8rwa{YQQk;-isVz!gcat}<0& zI>HAYwtLlBbM{qTh1WEga{Bu6PyZdkrd9PEjD^dvW zDKDv!&do0C+8({{-+2Jie&p_fjPjimvy2x6EB2&=Z^Csb%F$m!5MD+@uO$Vm^TPl9 zgLPJ!h}u8v@|3ppIBA8L(Iy*eU9UvNjIBqPeM&&|Mdpg2^FB+*HhK5}Tzs=927$~> zXDNL_MZuPTE60G^>1YQ-de8>YhV%H0z1Dz-hzJ_%^bMa@!gw&6f|!*o;%aHBog9r| zBMswvf4y+$>EwDg9xI<`8(RA&)@A=at{$<6_cj$E1klz#~N5wX}4@|i74?E?XO$VOyJw-0RnF1(sQd zcBI5E6{Af#)LPUf8xlOJ0(1gB5jWx5P9@|*1nd$&5QD0+8wuRty9U#$;HtM7^u6=| z;wX8cEEiyD%xY(+#PIRI{u^ck3 zfw=Yh#4RdDeV8RO;?pOf)R`(C_gN&t145|kKQ~vf$(9JyzF~NbSUSl>AcVXpFGKOD z>v4+4UfKNpG3E%T;_ae=enyOW##K&j!Xo$B)GTs~$AiZ=>>#bm!@BG?0!DNzCm)Y+ zY#wVRa3rbQaGA(U%Oc85wp&da{_Yv}oJ(Rjw?$f9?W!Eund3xayB>+&ys^;$tj_ii zTH7)LckQ>2h~m-2pkS)ft=C2EvBa+Ba}A|c7}ZLo=}9?}t>=UhK1qwo8d_5!X5|aM zs>`19TRRJgQMvvU($#}}WCFQ^&BrDf>DJHn-;>4#%bF990vB)1&uY%7#(I3_%@dw+ zzY)yXISlp_51|Ug7G<5ULn4rqNoD5G&yPu^+{{G&X{l1VvF)pw#{m%NlqV>B}K*WsWd+Uxne5>CKlvP<@ z@~I+hm#@z>b?V*M06LoRw|!7mZ4M8h6iV@%j+-#J4Q3H061%C``T@5nGl3Sy%`Uvh zRRGqxfY}W+IH0iZ;PSDtEH;)siMWjg;WVBAQ}{a2)*63_+HSQldc2EvMifjnm`a#= zm@+xl-t%rQidFN3tDQ679};Of^gOQj2}Z@!Gh0H$j_LfS6*C1b)o_V776)zjS72v2 zXNNk7rAIEmCB=(yP=Y+t$Py={BP_tAuH!2epItN7}YmZB3rfZ2jr~R}pr;fDYT8h}kC+yI)v_<`<3+EpVep;e8uaBylv@?QruBxbN z1F^)3sF^WeY97T%5zXw2_WrD)`WZH)8&aRnKvmyLDn2@My79y!z@0wA+n9N6?{32( z1O0SZP?iRP>1thjdb96_q9k=-^~bxkHx|F9c3PfH(*>7m!Ub@260}86jPc(&W;8G% z=Rd`~D=V1Rg=>bO15q^L6|!Pv3A9^vrneO-zt0g9I1rj3_axAVp-mxGs5+eNYo)xS zfICXt-XtLfA;0wK`x^4=GLnA@6*_TcYA@QJ?PbQ|nX@UT*MD+EsaV-)6CGt(iJcxi zyW<*ZAGlYHMn~%|oiIBca`oh*&{6DR2&wRhemp4W`a+mmB@++M9@2}G#BTMj4Ci&w zS|YC_y-n)!!0kd3{qybYHb)kYap9`MAff2EXteqPAf^@90OQ&m(No~Wuo}Ur%0Us_d3S4Cn8Zr5oj%XB z$BrUI`mHm`)efi`kkfKFBNspEwcoySte2pH*;uv+x%nQ~iAm(~&WOjvgOd}d8 zUl08Da+SKtY^!=CfSjw9r1HqY=UPwvqVP*)jh+OAfDqpyh94*^gDzKCuKR{ho7kTN zPkohGN}nT1rQJrRKeRs&Ebo6pID2>AW)> z-=-va@hi&$Cg4PyKF{~HB9&BlDVB2vld$n%ue;%0+bBbIx6Jv-`=pViQdpNoWfxgx zBNl94X?<7P^0fZ<*bK>EEIqbVQs2?@b&P9YT$-MZ1zk&IJw$dR?7%^60?5iXaqx>j?OsOyl)6tED{Jfg5y+wqw$ zZD&%&W;y(Lkd>O*7Nmu7L_Z3Ph3hS^w+iMkM2c5n^M9Gd@LpWcq}l~&gXv1Ya`K&; zh`gu6HI19`E?h1`;;Q&h;=f+jd{?F1>11fkG zt&qmyvGAqfsMqQ$72QFYw_<40^i_v4E4=;irv67IEr@Ac%J#DsUr%})bTEIO&(jwD z{mIWQfY$ANNhdUbk^WNthnUsN?w>alQRk=yvri=73j_0mDvJ908}_VD>sdUqs01)L zo;-Q`+@|H-YY>`oPG6Z*(FB#Z4_>uh#4|42k%oa!*dL4$c`ke{1I-{A8Gv7GO&2dg zxH_CS3&#@F1!)3pIh!%|0{5N!c^-Xva4XRB5nC~)Dnf60IlDqoxd<8Wv6lbrYeS}y z%M?t2MxR0OY7o9kG+8S25Kj7u*~%0~z=E&fLB5IwzQE!ky9&kroK}#lZv5_(B68Bsrwt| zwaU9`zDudC~M8H7|W@K?q=EN+>d26laa}@Z;8g zkR2G3JU@9nDGoD(tPc!LiA@G|24I=S(_tDU)j0PhEySG&|65CSJIOJ zxS`LW84wrfM#Y*jo^fU1vaB}LOC6PwGTZ3qeSG-m=(E<;Aj?{2mnE{5J}C@u=Joi} zs@97bn8DlD`mX0$5O(M`ti<`UOLa?jx+XTn$&YYh>%9raiH{R({W)}bB>bbIg*w#b zC9g@aJ<)0{e}UUg`>(*8a~yA|8;%8x=X|fPab20t!7ko(o^@s&3vBuXB82>eZ^J-B ze*wz}6N#Uxl<5H^sOkHulzPeIFVDOl+IUXb!ae@4hP*=T-ZN$?%k`XJ;rsaT^dS2O zpT^zABvZg$iT{$IfE&`alr`|Rv4{$6f!h1bWg;vr(c4a0k#>G+k6s@=G%($D6(3@z za7lrch>BjXP9eEkgVKxVdiN!@Q}|m5+DpOo3(NY*44F~Sxj$CL$=g`?RQP(^MFabq zvycEPutQjM4&)zE2X~Cm7pYn*&ZsrMYaYV)K^6Kc56dmj3k#BGz2Rn-r&@Aq0RZBJ z>Gj)(?1T?Op!M$$s2Ifn-Yf(~gO}|c?vK}(6jVuB!g)>0XUa4HsEHZ%^U8EKu5rRm zJn*Lf=EIW~e03u@2K!9Bu2I)E_d^Py#JXh9&-|s@0T$#1YHVUIXY=*Nj@?9F0pFs27EBxQB#Sojz&Ax+RX7Ti&y^q?ci<$Tc2z3l&Rr0h3C z``sMpUGZ-^n(IpmJ|>#&mBMlh`&6HFibL*}=YGYFaUH{S7!Nye{}TNdT8xGfu^MR` z*Q<@8os7?ZR*Wj+n^EMP7*jA>@i#7W^&rae1dmFSH0fM3WCG8_=_^80$JHg3*dKx_ zw>o*Lzk%m*#9LNzJz(oK3;CiOsHRq!NCct8{!-_i`kp-_6@T zlgEnKVpUmiXA?%Fh}7&h+mn70aTohjumU#+CVG%4I;_`z|BJ09^2Ge1_fhxQ+#Wmu zxY6Al@k5ED`i(Msl7XXe<3Hl|JHstbkFl2z3KO+2B3M4iY(ILaDoS$fx^!L)nJC_Q zP*x98CkG7iz4*Fl)Rn)gsTaWiWaYLP1Dc@h1i+{G>FFR%k1^mDSH1JkQCRdFTlZAe zEKwg0ycuuOE`^mB{@}ccM?FauHmKau3atG9hU$M$%`m!P%J+vM&Ypj3Efs(QZFaaNJ~I<5tjsw%67DF8K_ z7ff1Q2r|qa?a{}JS$YiG6p@|QOOopD!QncQ@BMZ>mV^pM#rNx$glMrL<=Ft;w{KzC zAtT1|-X^>z{}f6Zv8{0T$oYPgMqWm==mfa}ZZ&B(MJCM)@B75+6j|sd_$D ztYAc4`^rgG!{LL26tAtT!Bsg>aTWJt#u)RsZ!F?~$y+ zeTp(O5eJ}(2a2f7$vp6|xr|sn(K5F`RGEPu4V?Hmcs`#06Qx%<#cpokVEGe%XOZ50 z&Uu*~U=kEHA5!O+plU`I4-y@_&Nn;zj`W9L&!MX$;0KC^tGznPAUU_s^Q3#+cRYj0 zcXs%@liSrl;YUsrWcodq1K{Jcc!wj*ImuJ$nk`f`EKU*|nte#8{m>ZHTf3LV@pJ=& zOCSmlRMZBAhl}nPt^<&dUI~t;?6=!u+5oq~CComZ$FZF$BDAZz>5lGX!#@%D*+~8t zrg#wb?LB^1 zt)wCyyBOB!*!WhlL=3j>;w<(i(nrpPu=$*V-8^o&Cs^17ptu`*p5r0hU5*xH%(hmE z#}MD{deMI#6A9d9c{s@nKqnQ1@2Y{eul?XaJb3XhxjftYq|33g^+sm({i~wf_sJ8+ z)=PB-lM6i6dAZ4Y!(C4|ON1dpE|=#)4-yWh(P)B(fsR17aZl<+J_;ut>FG-)x~PwU zvM;@n0-X`5>uIN?H0Qr>Gc(rB4@dEAYnjZ;4FqHR2YUK^)n^J#2t?2Xx8C$fZ}1kW zrj5zON99ze!lTvHPljl$!OBMY%R`%74uB(wf@;y11Oq9nrd8~hpvBD^M8uD1g1Ru6 z0va}a|1^$)y3spxUYBcvR+`3(}`OC zXz|4TcNL!JAuEZYRM784_I>(F)~NcQ%zFLEn7XY$&lq4&(3H!@F;W|vU|+iHRVM#1 zj9-{n33FJ^_A#$SMU5|ASwIVj3FVi;pSFYKYJivT-&6=>2 zF7s$c1I(dCHS&G2MBXIIIOlbLhegp(FHZr?;o%YC9D_c3GwXXKoqlmc`%zmbep{Veg>cDDCe zG5PeYVxr{fzbEE|SbA{rljm##H*?OUNBs=8kG1ThW8sL8lUpJFM!eVqD1-d%lQ{c$ z@k}rq^>>AjN`Zp!RReog-2L=m*^*HXd4DIb&hk88wv-dSdPN3gQ})J1D|thIUYcpT zy5u|^A@8lOu-)hFTsGAGfl%y6Qr|5>dhq6MsS<>2Fm9|BjCF{oKQ}1f$oYGYn;y`w zqkYzempV=rF3`j)a-A~jN%q{Y4^%a?Wb7$>1W>fBYtBpsX3aXcJ;Ti(#yHV@Y-SbV zJ@dDj^ex5=$@i`>!$I3MUNRZF&Ntg}`f=510KrqiUfa|k#&4i5DzmAS#_i&*GSy&% zWn7o1e8~hMc+^r-x|fJyg!JmcVBULu+2iu>dUzeJIlC*?;0D0k&d*OKG0o{vLp`#o zuhHjw*w^+r5gpv@-swH0Aox=Jxfr9Q34-^^JgG_#vWHggf;+o**D4RWEzgyHEgDQ5 z#S6+4<;le6W&K41vQY;=%b4eQG`?qEa-6(HMXP#S6ud8hIt4~Zm*nSg^V)LteT2P& z_t4!gG4e88{|D(U~Jf-p+2o8mjTSz+-yKTDHz$wp;LNKLrMR zhMr;g$&}L3!?3TdMtxW#n1qztIPOQ^E@sfa6yBYlGM=&LR@DCeSM097rOMjpRQku^ z;shsl$_Y7+rqT1q#IouPQRer-+X=ItSP`)Gx@>4LUHSz#7rlO-#=7nnTP|r}tgsY8 z!e#)*v@jRme^Ka zwZjWwI|ECh8}bMV<+;w_1jMZ+>UW0Y%^cU6LXRrmymQ{TiGud}2D+9h&KK*EK&vA(VuUabw-TVFje@>d}_Sk+lM5UNKXVQAUaLG1{s0uDAJ7h(wGwD~g@?|-uZZLtGz zEB)=gr$maRR3y50R>`-e$>bx$T#ETMWc0reWxl-o_}$GqU$Y-;3iweSN9=?dheLh0 zQO32B8T!u5CzHH*+B$!~OUHL1bl@6hUj`Jq@k8($`kL?~?z{Ela`ikd!~c%)OAy#{ z5SK|{|M?@vp7Um+^{g#`fjrl7d%PPNCQ9OSr{=Mtv2%zdWt?usF`GJKnm}J(4g;M* zt5a@y+rjJiOUT~BdarQ3m!PK~GVyxwo&mzt!VS1vN zmjmv}qCwv_L$c4S*06*{$1P6y*gTG%vDGE$dNR=jalX1FR5TzRt4f91AzRNe@|g)| z!z)_wx>yJsb0>Pu?)8EXB4v{1m zzvUp$1yNs%u2vbrj}#{AeCf7;gFKPSA43Ko4h2NgdLB+AWviMhIFwKV$WI@~11@;( z8<+u*${liyGFt(XERfha0!eW6SZ^ZgHQ~gd8bNG3qtW1(QF1~O8!GgtzXxfEU)AyR zwz0FK$jSjutj>@uF!hs=~CFzAl==mbhosKgmfb* zEg;?99q-L^&iP;O7yaht?3v%(GqcvLxnJdAGe0+wLoKy{6v-9hNxB8pk95xAx0z!i z>UaKMuq`g^M1oVu+oMEPm;H6$BWlNKT}5|HlX)$&e-d zg0Xj?u*(4?jpUe(QRxC18VpYq#JL5m$7s~mG4}W=fPmf|8T|)Mb-zx|7(IcO$Esir zWG?Ih6Y%gHx-wS_9QkX*=Ue2Xhs&=EjNa2gBv6EgXU^ zL~up~$_w38z<}qlWXD=fl182P*w5w%>a63hKe5#K`6;mzb^= zFR&1`q8sXmV7ky-eWQ=VKRDF0u4R`r?Bn2aJ4sOULGPF0D>dLCstYc9_!1Oi#sdFF zD=DQ6;eBH=EG_3Kv{Y~J_+~YF5dr~SAxUHt%*8Y`yTs<5mY{u#{HV4(UJ~D{_H?m_ zcyJSW%iU~-qQ$mM?Wr!M){)e&=B@#c#0RGzdi~`uKY@kI*T40UaSwQ4VZ5wSDwupu z%LB#$E!edRqG9imr%Lt3qdsG2ByvRKd_sk7*H*gyri)A?#Jsb@pxES@53ix>*=>uS zj)&!vj~;PDWKp|xD|7%2pXHu*`OXKMf3AU*JdVf#duQNtg0Y)5O8lD#Q`w!A=&yA| zPyq$Z5HdP$2)1MaoZY|Rn~T*`k+5ruchA^>p3^5V77=wjD`Dq)oDKkkV!gt-iV7J@ zcn%+|Z0as{IM<;M#PEbX0UkCO|7S%YZ(jfLuedk2aP;s1Ed+E`65o|NIGT0$@Nxn3 zl@Ktjd)1w5^rH5p9{pP^_*f(m{2cJ8A#l^oJT0(YO>vPvQp)#5)hEIl`~#pg{+%Xt zu@gGWo#oPG4dN}Aa!9RNZ-He#c}<_7`8;~fYO>6j6luCS>2T3H(ggV?uD!DZxg5Y= z(kwcI7z-F@T34?|`XaI77CFl$_Y&1WQbU4L8b}qnzHE7uMHJ(-Rq|Tu;ghMp5tc1H zhuqWQvt5E1Z9@O}5iBmIP!cTSrpfyE)4w_kK`TR$^zwPp>`8p1|5&wcVTUx6OGO`& zJxQauUnhgP6$922cJG8Q_l#6V&MF!WVg6dH8uJG@MCDm?Gk9Y|PvcLhWO!&UfkR#Z zppWTV;%4HVgA@GuL4Qxk0&eqYkYwbx=a$FXPUm(htrAyc`sA$)sb9&4)0he5oys#| zw7d}EGIH?nj%46ZOlM$VHOq>Fi}p_|ogkH=>o%CAkon>vXHy3&J07|}0*P{$dm6r%)A8%JZ9Q2%fv;NMye2cX=L^2r3TqPF)YJdTD_gpk`$9`% zWG85ry9_!BZI#~1ofSfh@OOZf1yA+ zk+GRAo&#Za!})w`hf1FXjPvqyGo7e4??TYwtN{k01U7LZTG62^8rVR2tFTN*rKh+1 zy~4*|e>k6-bo-tugm8`5?US)$T}7Shr+d4IO7s^k)lXvXCr>h_xi)MtHXLGkA$;pj zeO=}}@!0DZYA;EB-%pHhP=H*}k)}0s@)ytD`Zi`WP#BafgwqqI;Z9Zo;T2d#uqod^ zSX^Ulec;%NSGF{=R@_BR;E^ZZi60>=$Fn$7{5C+Uxd+B~R(>8+HtRzMA|SzzBEJmD)f-1c{m_7vXoTV6qR2>E=ow1pzZXr=kVq)w~5 zWl>6Rr1Z3kNeNk|`cNB_%fa*-&oZ=Pg(Va?grgQeewDnyl?+o;)Flq)D4s-i zRORzJ8=~{;LFoC1|CvSFt>trd_^a5PnMzfz$I9iwZRz>F{TVXaW>+ESz$niEf|g&u zAyGn@tp3}tK^GNdD}yp+C~FM%ijZ6t+RbiluA1s!lK2J#fr#aiS|3oT#(v^G`o{W4 z(<0fIu}+W2zlX$++4F74k~&x~B(jW`;z0jxg_6Xf&QuDVb{(O)LCy10ahoE=9K}1@ ze@40ZVI1UhPU+l`=fA==Q;Psdsqr#hzn}g5KL*7N^Tr6ihI74ch>vqWtnHaHP@^}F z4{M=`8oHmckE*O#nf$DiINT24y^cs#CFS-t7n!mRB(kQCz6Ay8C65$8jlOJ#Y7wN5 za3NFQV2ky5bL|sr*R70u9iG3_C3k#yY`h~-VB;oGd zhg48ch^e^fDv`9f{AQ=XPXoBUqWP^z2-BqfP+imA{VdZsy`w+ij8Bgjo^^nna{Dy# z(I&6TPUWZ9bA!kjfEimDY`PYurE$U^WWyMx$35RrNkCTklc|`R?gCxWCQEQ~>pRM< z<*MX26ZR-hJO8m-!WYIt!os<`_0)JAUt|Gi5csVIJLzufn?SoahAD26s3>Cd-Dk@D zZ;KK4r@g+OdUcye&*fU*0u+!V>iTt#-b0TE6I}I&+vJ+}oE=ur_+hjzO3~X)gn9Ye z^ttZGH6-QQ>0zZ5BY!-u=!aQomcHOj8aF7uAD75Y2hj+^@HrZLWEe?&wP?@mG?9nf ztm5KQudSVzI-mEpijmffL=YO-nSV!fAIUC<2h*Nea!jVt*hos39x}{Ovf+ByBx(#h?79de+p$G*P7ZLd=0>PpM1<$r|if`Vh+5!kTVg*tc;(EN>qr znt9o(%(?Ey-(xT8|*2%woGycP{!S`P3$u}YgOA`I-e{4)?bm@_~F7@zJfpu!E>1h0|g(p4^ z^5(AP1@ub;<@Grl8(Eo>n$#2icpUUxw$Ui7+CPyamhTGYF2*R>t5Jw6;Ztipg_JeETS09ocStU-nL3%7kg7q7CZ6j)-8Y_;E1;l%JQE83Puq~lg{ zao7@Jr42d!cBOuFNSGDqg-}qNiSP*R{xH%5D;u2jCX&lub5-*U?|?I+Mdm z_;Ehvb!!mpum|Z#e8n@CAxf8BmKL%9^>1R`aY!}6NR6z+@3Q6c^j~%g!uh`p?yuax zEycJ&PMlE4{gftII>0?YXB@?z)O2Bt3(e6bsNw%Gn-n_v8R)A^3GH{#x)+(BGQqT4UDyBGGH!t!)Jdm}-#M8Spupw9B;WT-= z0HYiqs(NEE(o5gYkc{32kewK6oB-?z&Rjve)OI=~tSa=4J?bty)RG?nW&iP9nJJ`T z_g~M;MbM*{T7yxYw?~`4z=O6?QvgkxOB)SjwoM% z$P?D`RcagQD#3`a8D{p)jBFxw(HCwWabwT=(q zK)e{Q_WS4dAZL*%nezC?h2tyy=t8p%Oh~Lz@jYAU+%Xw8bF6?)0a(jJN#K}J@7-3y z=9LI5WHQ1c@tF`WWE`_k?E@eK6knLfPvG+sI7jSo#%GbU3XCy_#+MN6drEF1w6=cFw5X zC!zW_2%8e7JQctJWbr@ZlC^We?g|1W&2+t2qt zr+yh@Tn^xREB*8h%h04$O4!dkT3CSHT&K7X4B<51U^+v$eWJ+6yM zOk|G>eA}4xVdMNYyzWz2GKsG0YaWa|BWS&{N$xACwsYxZvaxmnEG@Rf^vj#;acN>z{z( zIjiauz5yplb$j4&_7=28|E3}zGbF4e!|4sn!!e?8Q&a(oHz61D+FcCLKIi z0=%t0>>%VGz=D`Bd?!wJ4fo6qdX;DiJ2rBXeI6Db8Cb?L@%U!uW=i0_R{ zR{Y5RAdUqz`sHLoQWcgT3=B<@pXLYbHTJ^K9bnTD6C@xOo`)s_TZA9}?BYPk3bpX| zx6Z2lrqK_#Z*XssN{m4%=XPrO)%$78&RtHYi6meW@cU5qSxSnpxVOm+O;_jbq?0@b z@9&1^Jjm75kv*CNi6>s8bK3fI5e@e}nhzU~Cs=R+cY{kobmKb6G>YOa@&4VA=C)LS>g#E}yWRc7r7OX`vxvR51APs? zhrhe0U(2G}?9MMl0w|A~yCEO-;m|$+pi+I)@73(C&q?r;xzYIfhz!#iBo%6Y8qL_{ zb>puJPuLm$=R*27$qQ_lT03ZE6&a6>9RO1dHl4OAZ_s%U1+ra+MMb}Fxhne&keQeM z(W{)x-b#Ru7#cq>G?6@87eo27B`g43SS2VOYQ4sJl*G5TQk+3~UYJ#sC~H)1n+$5} zr(q(O2vdJ9e=Wu$|4x;pxb=+NR2XnQ?f%zwtol_U9^bpdg_k-b|IQGCM;u}8+N{bQ zX3Iw*8$zf_cMv7RD%`wmic0sz;ZwYs$@e{#7+WLx;r7!w>?E~n+E_Wd_B@obI%RM2 ztIi|a_pPnqsMeaC^4PC*bk*1${T#wrW09{(e7eAo%;wbSG~@Y|)HUW{&XS7m@7er^ z+!LaYjVILa{{h9aET`f`Se>FJhA|Q!_`EJc2o`CJJRAcGH-pts>+GKvaeQm{-_xi} z4ms+-B`QSxPLlQ7j6oS72+Dx!S&&B+?3e-#!GzKmUl}ZBK9{So|GK+jVl&aHZ4yn+ zW)ieSErV{|V}lw|4?dC}uBE9`vv0DgH>&kIZB<>d?AJaC z-qj6@%6{LfAI_V|lt`w)`abn2kllP%pZlM2%_``#j^K#^40L>n@u1WgiGL1*L1cfC zq;n(QH5iJA!v|~PdOQGP#EbhvOobCru!1p7mK2FI4B%R6aBNKLv7Ol|9pr>K}hw&dVsl@EMd!ul_n?i9({3jCYex#^XGEt|8bn%;?(*X_# zNTs0b@j0yuwz#hdu02UMXHKZOyc6shU0OWbmVvKUZaV~4xhm)}{m4U3croN$ATUM5 z{~aq#lAz*a3rr#+dMW+6OWaN}CXc33 zvKs2h3$H@VQ=U*z8vH~Cm+C`-;@csmDGpMJ&VS`-OD?*QpGqcbq&BZhs;|P>&U3|0 znDCcLDSo~OhUynN`PtC-lSq?9CHW{M1kv(`&MRZKru!E&{BGE{fVQO;XX=h5_|w(U z6KZddMD`}td2x*gi3^WIqhzqL?$ThCCGr(5y*r2b88K}F7Ex+Q4;t6KBv+MD)*rpb z&|9Zbts@f0s$?j5n9AbU_*EHShaMqiGC~jP&pK24w1-MF5sg!Q48UsFZo-dtC;}z5 zo14|nBt^Y&L%g>*{_G{cN0XYCwoMo}E-MrL%gzW&m|47ste!CYJCc=~;P zhoZ@HwA}sK>xt)}tf!ZaJbKGG_9^qzjgI}dfwr&Sq29y^1Svtqu#Ac_ES5i9SF^wM zuwnN6SuhO+t@~Xm`;~BA7Q@l)P4iEJUb$fMHcr0B7dP}@>K?P*r!oe?dOp`f(D?mDH}$sJ=@k1d~aEnz}Oi((mQ0 zu`}Ilk=w1+a9fFk!RAONnbSUC=BMtz_`822ayARgnPOL@V$@2e|A`dE0dE9~)s2zD zJ4e11stzDKBZ-I&l3xw?hQjRWOVJqLN_dZY7#;!l-IJo+{*Od4Og62%;|XUBZWb~N z1eFV&%#1p&sEK!ICj$z3a|jTSyZ&Fjhh;XwoC#ub@N0J0k7{CEGf%wy!&_pA%LtNh zrf#Vmcfnf*SAl15-=15z4%p+;*fJ{5seUqoMdQ2uU|cI3*FzEYeGirfXSgH=!}brO zdL>T@f=?VxB%ibZv*q66af8~%bT#zYq7YlV)I1OW#&6%K&rc}2y*0gc8g-<)5rMOJ zloCjPJd=okNgevi&}@hf|2gfnXAr~5>vX@rP~#3w40E{3EKvemGx+r&Cz_Ys+>jN+ zDjn{WoT3^X^ZU10lv~+l)3xjRu2(ZZJBbG}^E>Vq)~R-!W}XDa_65B+^zX8N5zp%V zvJcH<3W(6CMhfwtLgwSx9^-O&dO&+Et$-b@mxk*?tDL~G&XrUeeH7>?Y#52`n??7E zNwkBiwIHQK2l^NvOp+m zy9h4745=EYeXS;`!uo`ys?{O~HozIT^z?g|KAdj48E$ngbX|E@(%3ybU60`Ssv3zb zJ#L+9ow)GHgcwB)YQmP`d^FB6;jCr0Ld_gVphl}FXV{g>pm*5bVb&%~_0fVkQI>o6 z=DWQVGS8#tm(b@B)Dn>861Iv12lMn!Zx<7{kfNN4au)0={zcuLmH7)_>I8n;RemMJ z+5fOQFsd3?CEZy2$yOrD$(LJkQ!BmRNvcHc2Vj|@Q|NVtuXTJD7U2Kf8{Pbomoix7 zaoTa6L$N1AyGww|f=(tIOg*JNv{-J${*Mcg6XKe8MK=ZTfKMz4pvDsvoY?|GGKt)y z0~0h;u{3sFaf9X38~lmS*^{V zL}vwYW+~gyxh3}j&F*ACTq82zL?2D_&O44b>jq0e$6d0dcx|@?rXSD`|!mu zU7O1gi&jW6Okij->F=!8h^Tf+WOmdRwBP-+HZ&hcnuKmB#2{>E-raDm3AUlV<%~h51O*^MI@G)Y=%{=wJVh3HGszsVopBS1O)mx# zl)kD8DbC0h-xt9>+tlzMQfDXjrUNmbteZ1oB^`Cs==_>3cf!}Z9hboLh8ge>V(sy& zpL($Py;!;7<~zQxz;lkY4*NpWOj<;<-DxJ7=I$eNB%lHg!VR!hbE$kMc~dUqM4>;m5?tFE^tAx*+w{j|WuhEZI3xOO%Gr^xU6t zf^P?6rzZuSHEHDRfN2>C(YOzL!JyQa9D=!zkvg9cyVzoFu=NE9b-Z2l=uH+B!QGL9 z<3V!&teaZxVafdf>8CK=)-or&{p#I|q8)AEt>trnv~9AnYFdsj0eafw%L-kp3cvLV zly_s-cM8RMZ#y1gbCmRUj*z;!4WQ04FVOe_IP_m6K7@oh(RWcHg0bI=Gdls@)4_z$ zel^M3B_<<`ZB7MbNWu_WGCyewslN@x;_tpc>6VV#H6|S7%+5K}ix2+9CL$_!#f|`< zYEYDg%q^Z*I8g9%`g%=_&eJEWdWecdV@XKra*!bi8y+IDXkg~>Q?4gYY9K`3OEsp2<*$d+R#-lZ3; zbo(Q198s0RgLHg~+CXw1Um=ln>LYwQk{^xLTO^~->>WyM!ZeQcLP)xgfzQQp7u86)9z-6kGBa${y_1vQ@1^*+Y3tU2mM0#Q`Tdm3Rb=ov;PF6 z>UIPOWqYU9;yZ8zLsU5?72>i>A3nlAg$R3DYg%Q$Om&JVR0_9tZeLh^`d;uYoN8s% z=_rmMon-+#favKBLmn!jpFs<~IaGz~lg7q>WOUxN<^|QKl5JETGq)tgyD3HnQBdw*;>+jgFb(S1rb>^`P&d#Vt`fdAVwTP zH3AvBLgUG~o|)4wP~T>oL15>zt1q&2*)YZMjc$L5`%>e}pRz^Cl3A;`ohz(=Q{d+g z*m#hj0`c3Cy{8(zWcc@FYe!1d;IxHKG9^(AqaEcaJ)Jq&79R^=(8OECZye!eikNuU zDP%d0oti1|G4R>!kJ+^0f~du+f!5BQTY0|W=HDXOxgHEdfoEZak=4J1JwF(rt4mnH z1N|@<;hDzu-=jrB2qnV?v9lvyW4Mi&q@$7#w=0tg$C=5@+MiMz7JIs(w_YrBJXN-d z#_rVfmUI3J4gVaeQd)9xxZ!yJ!ef4M`!Do6T>p*V>c)!8I)zI6gO5X=2HuaaO2K7~ zlPM2j8vf&BV(*~%A``-1!D1BFlPyI3Tft!eKqOFXrkIp!e{X$sBGjviJl1{M3uklV zy(b?G<1f44=aCLpIypT4sGC@0)x!2FUsUCq{KORE;26%ECK&CbS9i3;_44aXkk~F2 z_M{Lp!2hnPGcouVd8$ueE}8%~$aC@N^I%~&7F969h&s7CPuNJMr4b)x1R({5*o3va6x_>AIK|(Z=Tx$Y&>LzLQ)KP zRU&h*ZCYnhH!ndceWAsVhyN-0p!Fs`Mj5bKs6~w7+!4TmB$&$!cnOkos`V8u$qGT2 zYff+EG!?RtOy9B*-aQ`Pc2rxWI9b(E19a2aRJz=W zea1|zafOX1nro&5?d*gN&z_&_26gbn@zIQhig2oVDC$ksYS|Yhc@7Wr>wj|GPgF~K zlY9PjV@otqK$H;c%}r}_!r*zN_*#Fy+M|znYBm+1#a|bPwR1j#m2lW7LJt3CIMT03 zY^CEnazw|BD4IC|@9gH<590B!St@Z{mHPMJBkD{5+HSNsp)GO;7OFEt-v7Dqju=4w zi8n-%p7Fx@@%^CTLr3O-&HqH5vg*Cn`*8gvyM@@4Recb@CrCRpOcIWyMnBKR2LY}Q*PJmBC+;t83Q4nlBamWeE zN1f^Z{drQ8_Nus0HKfADB#Ap3!DEL?jY>io2j5Lx0qsh9!*3r}UNL*;K*>Q+s%Y70MsNg4YI)Pxt;|=}4PyzYi`?`O{9q zn{g0I)zqCM_?{|D2YhV*xa9CX3i

E}=|Wcg97$o5%T{VcMe)uhiM+(xC;$xEruP z-yrmpv78gtwpn69U$hIsFxR+8~`Uylke`H-OUdhuTh3Vvhh)fo%!|>kvkIjk@T^dUpc1MM+@A-YuLo4CLHk zaE12d#H^L~uSZJFX{u)-vaF`Mt4Bk>XT1s(@o0mi$Y@yn`?A_rVsxRfkIX$wtTOsS z(YuC6d%{k`Mb-TxuNCTv6bi8gfAPSOR24bJ}K*OVfKLXx-D*}$C$ znbXd&ceH}XoaGvaj)8~P!>mGVIS0omx`F>|UMMgRvo0a7f_Gpnum+UVslF%j){ny} zctYd)$T$iYcwebr6R=tPHS4xV9I8-Ihb$ksai;yNH*(|O_v)?rX}H&W^4ai@OBml{ zW#kI^x*&y2KKJTsv#6c=M=w*jqW%up^_pL3J61(pH@(zb~e^vs3qx6F+f zzl@Tz{Zsx+BiK7s=6)c4BtsBxFtCZK zFrbNf2x&$^s4!ChAsI$DeovO^E3|eLOclZ>OC^2P&n$+>@=IWbO>z0+fLaPOKPP5} zrGNPsrGjWUDDl*z%1x$u4-zJV%G$J0JF6n!jJZ0eyUX@2xt1S&>DPSf!>pfQ_qpZ#6+0Dv&^Wra;HxZwV0lzNh1Q`rd7Ypkne&tWf=$;@4rs z<7{2sB0;@0*X|+}+Qr z$^>+II5OC~8F5-&drOXYxy44@ogN_$hl}Gx(=htKuitw|vveIXw&&`aCcOCa?oEe} z6fqYszK0fMC)Rw~r23tp652^odq@Vts(;g$u(VLXAOS^yK#~N~b7vKY?)`=zu*9ph zOCq?%$A6UP8gijI^jg4wTro3uS$CwQG@4)1BXKbEBcdS_x@4Qq~(m4 z_jeO&k}q#9?Nd@p6{mJ&>JyL_M*S(*JuCrZHK@{Sr4(s8_P>U-f%dgIkBgNW+=lAOi!5fq@`- zQzhia-t~#iK71@9<>;}7ed~ber&h)-ek~lN6DeG3n$k&mh-F*hO)vrHDAniBNzAp# zh|Qmr^YJrf=+W|fBQkK)L~reA8B2~VdprH<*DAcQI}S?*O_LcCsAGOO5RXW+S{wrd zUj(?>;;)j96r;L6UN2^6U3@_sIZu3RVr0KdgfZfYj_)Ya27>js?MOA%GMFj^snJD) z!|GedHWg1R#D0UszOSm%r5uq6$pv^`?GpP~!99eq=zB1o7a@;lA@zu%(unH^FXS&J7>O)4aRj~Cu-XtWxr8?0WNNxWFP zkUyp01|>QsF%Rl%5wrK`YO!P2MHoX@e4mb|{soR2Cb0d@vZx#-n(|nsGrIOpHsh^) zH>z=c{)c!e0806kWloLWel=}=Km7Z&**_Q&b2vhYd3;+6kLhg*bIw>gt^9k`qKs!$ z2p8tb`A99xbd%=odt6>(jS>#< zi7r=MsZ?%R?N}TF* z7mxq2;QO?Cww7w$fnUb(MuwDL%euU=x|j9iwY35z5ea&!Rrh0uzLT;;2p=rHAWn({ zcc|{r2eFUef1ac(*sEFnpI6sQ+XfxQ8r1J+@AHjfFZffpMJfE5r(ILb#NezlXcFrl zx8+^`=p~}e;y`r=sOp?J-Ueko$p=x{evG2MMssUBPwEa## zrw`;--^cvXhII_aEBS<^?ZkH)mlIjS$Q0E14ye!doxPoRkKjJD;Tzn2h^Y%p|6pLfZeA^! zI%BCrct`6*Ha;uaT>yDX3!)5ikHJQBUvNa@MK}BQm9tN5IAMh?MY+?r zE|JM%Xi)Z-x^JFd{q0)Wt1nm?tV9-l!acTi#(ic7#X(&5#Zh`g;%gAML&V3TbV};8 z0$+g4N${M61l3N@iAmT{-eS~=+~I%oAY`<8jmJx)QDWaEl)fuiSW;G7iMs+erI=3@#0`!=eJ~UhpF*Jg=y5{EvXNli? zpeP14FLD%c=*AY5KBGqmW7A`2L7MLa#r$w)ZSnf%=!yBV8!oiePG4_`k7Lk$-BuBe zCk4bp*_rzeBY6RS#UM_1M5(Cv)x8hszh@<=r9}S5ZO$frQv;%kv`9&oCMn{1@z?|< zA}v=JZZgrQ!bm$jV+KN^yQk~IMjx`sXFBu2-U?my&_T=Q(zGx}yV{JJ#bd?y*5n<2 z5qI>qYJYEdO2d~WKZ;O4XVY78n7$Norf{+=C~c+sCi>!dnVgC_KyQW;IbvIa%D9h>S7KB~PuUEqGL)eusW zHFuZ2t+KV?62aqJNpS`-lGfc-7S^<0ja{g3)o4eza% z-_E&e$T`(>k$`aiGkN|S?uW*gL9gqIodCa^+VEW)pe`Z7FPXSGem$8X#WdI_`b6$- z6lmc?#rgDe6KLI@B&YxGHLA83CRW7J#Olv^gu!Abc%!F<@Jl5CpO`b5;%AJmt1v12 zdofO#(w~ghhI#7DaXYTyiWs3|$(JB63CHu=u?2-4I*X{kQJyFFI2}y#r4}vN=-4T0 zN-%mz{a6p+sKZdYz?fO+e(7c9y!W2(eRnAmjy16X7#a|rI{o?0y995-Lg`PrL>R>> zh9{y*Yf?plHtsGmzCZ#H0vHZ{)HN3EVEf`rd^WK1=bjY_AX<~-HCD9|&~J6+0@u}6 z51rJ9Q!xHST*iKu9#1Z{zC}Ro!8;7~=+9||#bhOL7Meh~M|Hn0@85pq<6n{4Al*34 zXlyK{kvKhQfW+-qu@fV-k0&4^(+|sr@1IXL!AU( zbrm)~)eXgeHW8c3?UyMv2@(e#>A)-f6Dr*1I?lxvqG>M#E60Z2Jm{Z+2vTQiS8i-Jfv_ zTDLjiL_wYgo^!Mbaxt?;hkY6S0Fk{-K`!4a(2XGTjTSX_SZ4)#F4t+-6|Kik_5L5S z+Ac*O(qP@pXbbtDEPWkI-R9WkiL;J@3RS=jL|E8^>7o!ljc*@4MIOsQ%m(QnLX&N0 zl4F-&dE-E5p~Z<++qp%dn(_bS9HH==x=m+F&7W=}Ij`nqO2&JTe=g+vVUI%6g|sv} z99kNT+(ZwvkMB3yq{J?V$sA6u_!+J3Iwl`4PwTbWhGEy99GolitZ`@1YQWKJk3RM& zjX8qj>@hW;zrS!7OYU0s3~{MImY%R`4?x(u zla5K%JEe-7y! zOi`FhqQhH9dO>1}kg{y#LDGQD{cuB}ifscvo&4#QHl*+xOG?iC5(g zE1Vw0RWn6y#iFIU1rRPXn;DH3;f&IJ5!9%;9w`G!X9&SV%FVabbG3_JUZ*?akK)i6 zGPPJLqS3YfE1|6AM+r3-ESfo?%D@MyoWo2Bw_K|$5-?U2_oN7I93>LEWrkRE z?9$H=jl-K#L;}ph;Jk?CUoV!S17}{d{L5C_?X2gb8XxFzt$lNMT$w5J|E>P1izrtR zJhMA4ZA0!g`XRUsYps7&-QCz@bR;Frk=Ci7{ITGlkol>F>F2BrrqeaeT`YgNSuP1g z6VAY*NxDrr6<&khGzcKvsQ0}YrX4ApX0OoKxkGy_tQ^4Qy9^d zPu}k}z^yTjp6m3+5V7T>zz}3ps^jDBoasasw`a58z(shxomCNlkr@tpRTu)X>PigB z3}Luk0-KW9AQ^X^kyUcUk$XeZ1a|K8Kb?3;Y74_}Yf>W5a@K1;@3fgjuPC&WQ(aQ1 zeRNx75O-GVoAdh4PHydMvQtl+7CuIAX4p+&!SL1~I`(XuG05Z&g` zCWc9#?yn~b<@9*w9MgC3*Q(f2yE)a{GB3jP+1uPh?-EJ(Y zJA0n$eR_NvSXaOa71Bg%uON>SZdo){I{)xZ8~zoG4M z?TuY2O%Hwh5ls0u2?c^VXsoASR=T*>2|0+WG2Hbyz$^(I-z`>dUN=_4z7ORs!~cZw zX(e^fh*5fvl!DB!YY6N^V?MjM&PQxH&Bs3&2{Rf~k97c!5sm*f)kaPkR=XBAs&gIQ zW)dkT3aO|BYU%S+ySohE;l14><>+khd-Gl%qU>TC;X?2RfhUN|CMqXc#L>9mRS~D~ zDi5}Ym~{--`sTFWuPYalQ6z8A5Pk%hG=E*b?3_!IG#{oDXB#-NYbovF4sRiWEI7(` z$Fn1~?_Y-7nAQ$p^@NYgV@HeF)sMt#bFLKV$1O#;ZX&QL>qB!N;oaR{oA}80V8~)x zFv_RTlG9PV(-rzhm+4H$tN?oUKl_j$?rq!74Or}pC4dGKJVI1 zfAK_EvzwlKs7}v9Z<~h+m4&YhG4DtWPR|50hH9AGNpe_&gCN1e5UIQnwIoH-fNVOe z_W^vz&#((|LVn=vb18Ke&DGO{`VEd$D)m-;Eav8m2R@EuxA;+0)^c~r@EPY4Wg-SF zo8|H&RrmKBNaN@jk3QL`PnB-BgE^+H%@Q@aT|2A20TV!QaIiGw&8V2avU;taRR}J4 zZ*>mTY(L-xJL|?qwZbLzFglrG1vVs)*Q5OwZ&eIMk3ie6p|y7M_S4?8Yxq#6<;Cc5 zc8lj-)_&kUpSHFMBK&`Ce##JNvA(c^8F2MN=C7`srjg#Q60KY30SkCI;=47opBezA@P=8pbA2r#FqOCc zV5h28yYqTQG7PXxGX3{R&}Ofd9$}H|uMVIw>3gKrXGZnvUDF+uS&crPTo>gt*{}^} zw8=O8Df_)kQM{g}+%0h#&oc`QO1*>r=kR7Fb6IA>xY4R*AV;6NEflvD}`|z z$+5))0Up2Oiay{V*$l8Ku2Ckf^0M5Q1)Kz$qe*5(`a#%hZ$29=>D|2)LXyp_{Hw>^ za#a0ERAQ0Gv^dwmL}QnfqEBw=9Ad7Hn1L6HVW*0u@K)r4zp0HXr@N--^QQ(hq;*df z_Wp-z+?{Gn60aI{LG*Z(l(;{LWzrQXUTl}z*@w=S#= zBjd{DI6;}T28b<`+kF)teTJ3?Xk%65_+xT*h{;Bcs$}-KX1K*p zjGSSNGj8YS3e(5Maftz_{_bQlX3R*sW}xLL*5BVNcE?}E4*G4Y4K>wkhHgM24n;t) zWv_3(SB&DRpSDUah)J^5X!<8^)>ei1nw`HLYD&wIw$qT;L&xZQpb+M^c{?5R;vWI; z9s9_$E)?_M=sXhWG`4bEdna5dB1WdIGptrfMu_S`jpCc-aCb=gDze@0I^SGG_9Sak z^V=3on`P?%%1i;+5B%_7jFOnAr_>3?QLIrA16+rkZt}5QhNa(qZYe3>)PwCg?7Lro zK=@^{CQ_Y9+P+!S0j)COCCZCo;*{yDaqjwaaBLK->z+_ArD3o7U}H0NkNs~R%XC#> znph^CvVo7G^)%Os#!N4srz@_*l_DW6u8&o{=aq7w-r3?@oJPYFBN|O7U{|1$j~c)p z;YJ+%>)!VU>W3X8o)6Y&@3A}uHt(iKUM#IY{EqS}(Y3hG$Yj3t1BgH^e| z`vC`ce)or^Q5fc>pqT3x&XG8oF(l`q-eO#^Nz{18n#O*C&h6`HnUh zLs{gNu!E0f9`o(Kk9r(sk7e(lkaTYDrpaH;@GftW*Lrl$^kCjMK6c!Ao_=w8%>&bw z?#nIu#ax7$&#VIc@6%yI5t07iD4gg#hV||EKj+$y3+qL1ewC#%zzT9)B<^V6KcB!# z$b$!BL?+?fKv(cR6osdq<0&MLl`0<9n*HUO!uQEeU#^bCnm55=|`eI>uYyW14 z?s~>e)S&TVWC!C^O}eV|(feQ7P@l7^(Tl1b!U_ef{;LE!;vaQDfaq0R#|)JMiyo8< zHd3r8S!?aZ%E6PxA#mc)YATVpb_BDdCL^`$6J;siE`0sI_AmUWEq+wulgM6%90 zJ#g#vE+PFwG`_o>Ds2lj2kGE_rXFBE=*TaRE$94+crhl1ELGGazIU;q_~ZQuYILes zl9dzh(F?#-Y`A6MeE2C#DGXz9tFUfF--E*SpxS{C1x?qZrb4L8(o8URXZT1si$99n z9o?g}W{~W%ayqZAryLCYG`#m3vZ+x{_c?`}zLv}-X4cINmT;iU;l%q-Rd)8BE9dK6 zPie0yRa>F$Big-71j{2AN9W#sQQ!U*!4l8irynp&_8O5+lle->KrqlSNi#qGHwCxe zw*9yMYejg>Z9wLhP`m3hP3pCOMXqw&Dhi-HgZ>ZfPMGMdq5~ea(fGDsynMeIk?gLR zGh)}R7iu9d5sFudDW@&fNk?@1Uq0)M&9g@&xV`Zir@8JkbWP_MiX0= zu`WP7D$7aIS#4f_NjCc<>&Wt7x9f<;N@H1`9QBfhhesJVy3}A4W2Y(|n1x?awSMN< zgsX|oqwyNcqKPCkx65yprsl)~b32-T5zDsjwGZ=u-Uuj*6lrjJc>QqHL$`MYrWH4? zI5dqc4FHpPuwQy0x++_NAtl5=Chb7FMltD664>6?{{MLT3brV_aBI3#Vn|5|B?k%V z?ov<@fuW@&1f&@{q(LPG1SFJ{R$xF{N*VzfLK>-|8HR83o^!rGFxRza@BQ4h?zN;} ziqEUsMCMIYR1kbn{<@0wEitb{DLR0_d!HQyQ&Di7QpL!dzB=v`m{PKOT&OCGr~Z`* zkE)$(LO>h0CrtPAk!dP( zen<$15_Scpm-`%5lx}okPlH01gT|cpef1`--&0Q7G~70~`JDL2t7gD~-XJs~&;#{T z$mCP1qOpRebIHeok-VqRof{W}IZz+h!W7ZfNoO7EizAd*^E8(yJ&~jj2|<6Xy(J{7v1BqTta1+M?2tKb6t8NQ{#sH63+Qk}bcEl&%B{iwA?v8s5ZIEe z@0_xLgOeG8`f>FpKU_4tTAz~M?99h@wTx}=d@z3jx60`5G$zx8bqeYId4g5aApRXe zrF_HU5Go+Pl~kh)8HYVnS?|5I$HQoFHDsJuJRVG~5{CVRd8Yk@gDjKe4e}hT%|?(U zf!yLzeI3&%et#BemOqaey5T)LHkIuKtI8v<5W8PMni1N?K=B0Dk*rOb39s283)D-uu5czS1HW;A}C9ZwBUFu34Ca2P~VSF zHXqwO({bifqQZLcc^zk;k#8h&598a(*^b@iqfs z1Mc+ysSde4VH!ejIr7%toeo!@`EXmHxm&g# zNmoIz9t?eW8YfA8+%D-M-8IjDcal}?X*?ZHvBb&Z;DN?IGn@@Q&6Ix*u^IfGJcQ0J zllaH~!KvgbED{$xhsPb8RfS%NHSYKyf~7rC?EZav-;ZuD#F0>LZ+*V)Z>;z2?vDK8 z#fk#0aBzS?ffs0!+QEBANAP+(RN~Q<}aJ? zx%yGc=5s|+$f;CrY_OKVs`1E+ef8EBQo4I(nU|B=19Xf`#$enliGN|4sR%;_H3 zj$At5Mn@dku$^-7ofNO_Cfel%OoTT$Z#DK$U9rIaek$R+=EV_d|HK{8z7lZUqkalV3IM8Q%@g{ zpYTd;MRS%j+i+&>p@;*JghUI_WfTg^B605^_YoBM9`_1#>}FM2Pm zNe@f>i_DZ~ivvDsW_>w3&b5b5K$k7S#rB1#gd2r2%I_ro$S``!=6a{WU0!*TjvriY z&h@$&^m^3;xEQd-O4^>z89@rb3fa1<<&`o}_N5Nq2W4~_>esWc3mU~g{FJ`^8ar6@ zijMR3Hu&W4oH^w6^xjS2D|xtfz)aO3}E?g*=2 zb(LOHgJ%|vFSY2{o5)gL;4Z2t-3B4wQCG2=WlEBCM795>F z9YR!3mG-NyDocR29~MV@EU(Y0_GYh0_il!j-s6a=EL#R_7Zn;4sl5DNNTUAbKb{JC zDNv-)qf7fOY_it9IQ0AMO(me%EASSd<@Gp>ppgNZ%8?~|^%WQ+-SOSMrODnMMFk!U z2HbRwi84fSGZR|m?=kTYS;wo24!3NF^)dHZ*buu^_L!cxzb@`e+rFvFJDPsLn# zf*MTqnL_L^K}sc^_ zoWxqo`uNZ+w9X8-p~FYK_Vk}JCy@2lo3{ z7IlgdUsGQZ^Wt6ze$Bdv*Kd(+d@Ss86lBQR&u)A1LE}+8_F5f2={nut8FsMPqf#`j zxdw8`X;UKQuOD#cXRC>Quc8CWAraAR$86WU&yuQLjraGu879Cl5TMRG=`LmMudVP z31-yCEzmN0|8d;vh`TV&#B9Gw>s3FKUbXAD#}`;!2IaE~?Z0~1CVaf6?meFJ2jw3& zs0JX=53*VLJWvdez28ESa#|F*PE&3b>AQXRCjeBJA_D)3r=ZHCIKnc2z}|rTywj5G z`10{v7`K|jDH72REI95-|MSVX#pKP?tVz1jJ84Kj!cN^yA&u`#yB=Fr$lk=ZJ1ugg zbbVOX?riy|2x~Gli>1P^?vLn|%*Su%X z?520TuvSR9&p&J^eXa)9sadr|3GxT%MT*=ESHghpjFq-Skr7-Wq(a8UQl3`FM;z8T zg%NeiIiOvflF(~!V*5AkaUL$8&p6|g7Uq^pCg*o~H9*iI7t)}F&ynl2hKzBpobnaY z5aO}}ueQ?fHO9T`G9*bzUXm=rZ#paffgeZ36i0Z~8A0Fua-$F%Y(L;)F)B^59Ml3V zog3Gi#`|rq@XF`@@zUKe#5dc@P0t*qAxIX(Bs*>xShNEKe+A-iLI_DCn z;)Lh`Sjp*Ja~iC{0yqZ|yAN{Bunulhd0!mz5qVbJ`F(hx$W)=G4zn70ciE|>@)M6G z+~VAu!?T*|foRZs<}5Ox?A;Ed8O(NhX8{^P*>{gM0-vteJK0uk2B3LwP{C6UAYnjB zu*t%a_3tsGwN_h=y0YWVUY>YoT@++T&06-X!a`{!> z`cDy6V+waW%epPa!gY;k8iTg*PxQ9IYm~4XtKT5PA)C0jF6KF3!C>vv{?uskF+0#1 zCb=!WE0?a@&P3M99q2~ev5-~0|K%RXV)K!JkE1)#k_HWwWPV_Xc@QhC& z>Z=|W$}ZJs{^-Mf!ot>~Fe=KZgXvSw&L^j+pa;q}!~8AOz1w?oNVb>*idjt3NjR;% z(#-R!R1QL&qG)008Oi9t1u7T$%Bu<5+oY?RP)tA?+Pm-bptk$&%8fI{8ZXb&!EXws zkKlCy-U{X4mj?`|TUlNMuHLnL%DE&9+e*~{Hai8QvikT59g#{Drz)a3j_mUzBm8@9 zA>UDDQCaF^vBX%d7U713N#VBfD#fq>?p~=7UeJtT1b=qcD^n}ItC!?|ojsc6sg~1` zTHi#1$Eo|kTBLk+iNH@OL&`(84u&H-V~cRhHr+$=_#WoamaBWoK|d|34!T4J5zR>h zqQ|El^UHm%m;`hOf#&6PfG<1qCaK7JK5>RkqpI{7XId4Nu&zG#aD6;x_@AfWM;Jd* zW_aZOr|s|apmz>{KK}3B5(35JvPS_$H%MDk2Odoq%1V&66U31Rw4P9Bg)eo)I(s0m zhQ_$g70uFJzfSIu*e)q6*`B;iD4L*EdZV|vYxy}dD#g|s2jRT@?iWE~?BDp_a)P^S zkW^bTL|%pjUeN(Wl!rm0E5#z{?Sz&Q+$VG|I&2)SMx=%=roq#H9E4tqhzt!*hFjeg z@v`7uY}Nfr{;dagpr=pSfTJdy37<~;gC1}OE{A{6akbY-tCMoUWE+_$?eL zZGok>VcDn7U#f!J*f3Ag&pY~me?QUn-PVa&b*bb{@8$+zoy9xkpFi3BAGDWK$-C3_ zzzBv-&aZ_bMEv+Pb`Y^t^x;CsEKSJv;woIgjA7pU`)eg^nEe@6Hze7IYf|%%=3UV~ z`vJofYP(-&non4Coj?8v=FsZ7;gNJ@SpKR*I{tL}REGH8ei|`|*ba5W@xbe+T^yj? zqG_((y#3cFD|GYl0&CkYHR$80_ioZ&Fd7nnB2L@-86af!yjE=oWR}-0DExm}$bpXK zQw-Zn!;{YjhAYxxqV}Yp*Z#$lwK0^E#b)H-2uPoOJGyA2pL-vCiM%!cN;@1};n9&f ze~;(vqA~^g=}4eEhkI@IIDmF}Z(7a-9@cL>y!Eft~;9A?GYQ@s#p?t;+ zX5zKYF(HCtE|%6bec#_W6$o*sWw1y0rwdsMaSQW6uPW722XEM>4hM=K9TDk#U+5M< zF&ENi+Ifl}7_!Zm<4+{aW2&9UUk&7+m0ANlTqvVX+2I9_x3%UQue}94tff5lZtCFm0(KxMj?aZW9$%yaq7l(1t&wk$3C|E#~P`m zH6c3bzzgO4^}bB4N}SPfC2VuojzqK{k!+uS0Ko@R9$-6@?cLS_(^xH2UYcI zPznm$id^5C=2)G8E&Jzu6_C6&3N#Tyf9+giRZh5L$Lg`~k$v{lPf=aQ30CN{$M?ea zf8k7+jr=ylZ6rO=l&&7%5^g0BbZ?5YfAb*7#*SdZ;XExW*_J)O8; zqRHt&{c9FyaK}SauRX+QxETd_HLqVRe=Xw?nrMrp^=LaS>66tx8vXR}A47 z)n#8M@B8lQ^j?KKsd{mEO51F7jH~%U*+mc!iIy19>I=&6#_f)h8vBxWXlezz^yE9+ z57hDu@tPBtH=}E;^6%_twAFUu1!6+2C^wW!uwMkkT>o@*O;W)6meh^V9qUZ;-3W?c zK)UL((uDW^z8-*HS4K~xpRf9YE)m=&KOXVaD#jzK+|Q5wzmseNCn*sUOo&_)nDLAg zdHhW^K5zu*I~{MvZ^z;dw#B~*`jLC(Nu=_a%U0BT>+HZ7$X=NT89amUh*1BITCL7CK~-zwZUEoF6`0n9?FCfCQ7V?gAs}Z2loGDmJ#qFhK8nBQBH}&#shWdd$7Rk0 zBiXF(a{I{N4USe)JTwEgt@6p%p(^9S!bTRtW?(LC30rsc2mQZX(@C5z7zuWH%2*(i z`!%75eAgb*MQDB9l^~d~;f18)-kpiF!IiB01Ow>rsd;jlbLcql7V+L6qSqJtq}}&1 zoZVmX{R3NV`)$N^r)?MwVI8Se!2Vm&94|7_Lib0Y+8cD;de~S zv|8Ni8#|Esh93z6cT!~}caV2}r>IV2NnAA$fK)RUmtOC(HR8w#P!9@nsSEPLH=B)l zELZs3jfHoznL|(eFQ~3NQqf?0(Ku*s|B_g=Eyl6nIhwR>ifOz<$V3mrx@r=T3IDe* z2DCC{K+-H%-HW(2E|>L>Q;6so_!94Uc>NLd6d`R*$Gv~*^o3)5Pv~1z0AQV)%7HJt z-g4XWCG3uEWsRNd3V40qe>4bC!j9y-Foa1k_s=BCkHGUxq{#if!=rYv2&PFD8Pc*{ z#IvCcjpY(LBGh+YQhh|AWkGtfm&}-~It@Z1mSokz?EZ!L=eh2VlOD(4>tAjk>Qnt z8TH%8<=fvCTHqp#oRb$;L2XUPRZq5`TAu`hiDJ#L+aOl__l8TL?tq8%F|)(47Q8ut z2;{gA9w+~P%7Ek3s~Nec{wUUfEP%7^`O&Q5|8W6Ym$~>N|5hgGTus`7&nt7ASJy3I z zgu`f`c822&^o189CYzFO;XFxy|XlOx|^0bS|k&!Y;*xc{ddN$TIj^< zWm3&rI6H+YQu`_NF8|@)p)k4s51i;WFl;Qz-v;91wVs9B{qoSv5S^ACI1tZ{K10=Hp4ihsA$!h z_5EDpId2-VcxM$NiHxaC?{blmpW5z6xIu0AzKrdUd45p!Q1HFOjALmITP{~D_M8Br z;_9QRLHQ7*7BlID2J2vcCYd%sP0uso6#V%_&}$rExyq_ZhA>p>8Z28@us_^o7WJ-gL{df80tx^T4Li(!GsIbgYjGgR&hr5>^+TzY6J7MAU zv;ETqO5XuGdFmXx;_Wy#**&#7jPNg$K9tByDxgdJgR9pQS7bq&4OkCS*<$dy zz8^ri;|+-bT04LiTSSu2c*ctRS+Js03lCZH-@6?B-9(jF1#3I%kA8#CG#inqB5+2x zD|!lg6P#Xhs*rtCZbCWQ@esIPd!T)Y8Vf@xN}&tkx!NQ~mr;>EBA%qcn16!*$c!V% zC*TsH5cS-?vbW_JKJ9z;TRe$z`qE_Y>aQdE<&d-B|7i7SbfD2CXQd#0y!Z<9u!0xl z2C+y#q1_1MPg53tx0yo@rY;zu*WXs0(dNEX&_6!UvIs*ou{a{E-y{BMv3?auR-(r7 zP*Lt?QBPgPuWOj@#L+9qNwpZv*K(fGtQ7A%nxoWash+2V-_uXF0P9KtjNdH2QHi)v zt7=P^U@0i(5}*UI6yDPOS%dagNlAA75DdYnMNXF`ovte^TK!@bS1)Sfgw6h$_~>a} zeeMBSt~j_rkC-;)TvgKGl z3N$YqwuBinOE5SQR8d;H61<)pP(?xw4*ae2Z6)?-e)ig9S@*r=tEzsX|nQXM-$L;?eBJ;D%p6x&ZTU4NYWT1Abhvw z_;}dXlAFQnG{K|Xknch*yE4jK>Vg#aPV#yBsc&wNJ<5hP&=Tls{%o6OYEs&Z`tn@ z?A;!ulegTD^)|Jg{?bRS=AKvPH;yOe;tGiXFId}G1%yAwEiv4XO^Aj68CEFhiIZye zPNm{knhkTLgK#$#yWXLHna+g}E~x2sp!@)V3F&QnGjqMU*T5 z8JAmeGfGYze|JM`x91lSIYR?|DkHd2k+%P>(=2n1-#k+rv8x99D~C-ys)U}Db03Qe;W)=HPdh+|cyTwty6SA}i}H9dqHKnS?jqmXJjnzO1M*b{gD6(Bwmoo$^$Pk? zkc@sOAVWk1e0Le0#FRre)77oB6hqw+xkf2b$!0Bvla<0IpWi|Ym1F24P9OVX?ioH(J1jon1AC;H?eZVi;pv}R zC<0x4`_bFt`bA9zr(1kt3)3D+IHD#`AMjo`&|7gI=gj;23lv()UamaZClsAwL0U9A zm{;Bk!dNa=_w0~k#TN|?_XU&9lIL3yli5-=e1hLa(b?6P@`p5y^w)%a@wvZ6nee8_ z8q{LXlj={UmJO6Aw_c|1eY$grO2585lM@CXB`%aO;Ef%wI9z;6eRmg-Cn{HrGdQ>* zyw%>d#AFh!B$|OWBrywNL}4^q5K^$u2!v`5QZ{db4S5_^{xfvpCkiaDER{8wEZFWV zw;jjJDS0}`wuozhzdP`*uwhO3y;MdhqXm6z!hwk|_f^5r^M|HnY^Mbeq^iy(xBntx zMzuz-GQqy;<)8YMs?pCf#SRDZG4il{s5uX@KXLUcM}Fq-fk`Wz>~4j|Qts9-!7${P zpU%i<+Gjy}x$mB}(%7N@6q~{TNZ&W{3 z`hixCw*F_!aF6EKMoQmOj04*zT!Pp|%AP2N#nCAq(;188XeyJv-VS-jo*B#t_*?*` zkPV0;C>8y(e76t6XXbUo+gQ;hmGfmoPM)tqsR5H}5*m3W*pef_32ceM$=v6~Wp zXF^d|_~6kT_~@MN#BdGuBwOh9AS1Ch#G{oKjU%)27kz?*-#Daq;jtWIDY%2{3Zeg@ zD-IcIm$;~c`St~c(LS$hjvHZ+>P1wBV_ZvZd4k+jHi!5hR1r6~fu^Zv#k;wb%G*8_ zJQh*jqy;0yqwF8@?s5E4)0Z9=jSe_L=FxgDgl@XokSCKoLI z>2t30tvCsfNU zFK;ix=3`h&a9;RZS?#W-;wMNu5ZISu>&GL*mb*?=>PF*wS$q?$K2+iP66T#s{@(=6E*g`v2eYckk%BP;D>gO70kN~KscZ+D7kulUO~tVBs(TXZ=~ zyE<2yu0h}VGuqi<5~SCpSqD8~>^w)_F&vuf^CX&X96StWQi0np*MW0+13h`@D{NQQ zMz@U=QHJnZZ=0t{wFaEC3A%Z$f46-Lw6j2xCQo+>geOgHZ}!;B*AN4OJnIMb!;YXu zKh5fo63$$36WJnnFQw8&UCN}4_o>r3u-i|+xOGX@-x;afX0XqNr=%SFxc!*kOwl{} zNS0-aFmE4o9h_(@6`>8$-_f(YS@FCil-Ml@ouu$Ao zjT~JK#Cf;5rWW{~%{63RShI%Xh@;o**LG7jJni-X%J(#ybgvat~{AHTuqU zhKFz2h+^ay#jpncdyJtV@gXFQN8EokipLbu@13c-p!#)x>5*7&&tmKZbu8x-?8)bb z9WhhJx71_w5EY>eaBAxiwees*@D#^`KVbcGyU_MU{Z=l76_ao z&oV}=NbRzF{GZiCjrZ}7vLchZ3BR+dMi=ATEW^?*)ApC1Zh!k@az2sv`>&%?_d?%1 z4c)e11n|&oAw+LFE!33H#3Lx1ZsrIeUbwM88$=9>OBEIzK;+vkh0N2m=JmKqA<%Qz zACMZ3Pic^W&`seC#V*FXbi5_rK$S8AL=A#6oY6YufM!*(BO>wFX?8J&LJ79#VZvjp zkLwU`PM}!{4y|#@j-X*grXl0CaOT-s&2vIev3+s(>HZ`s%>%W|cw3CQM)|qVKlS{6 zgs1OKi_N@iQK{h6M<;nWdq;D?qzFM($^v7XmwqDLK5Z#&OV-on=2X2xeOC^?S#&5K ztGDat^Z89H$Z=S0(RZxe`D>WqZ2Lg@^uKS5qAjMoIO_l+-DFu@)y=&HNsS=w*~a1Z zw98gFwlqxfoB?hzBaT9xD0o(N+uY3xhI z_?iSO+e0tmWuhE(eC4Fnv^N`n-UaQvFI?j;zI!O9M8uJ&MS6L{^_gXU)jNu+1%k@63 z3$q%_|1le3{WdOaR3rH{yW`%J7v)^QoeW<3Eq|DaI>v9V%8vrqJt|$+{d8N;7DFEP zaJ#*;$q1~ZFq?=NO6{RpDV{)6P*eL^iVa5*!ApWCDg zVCh|oD`kP;|3P!qIZDeAk`~+4Ga!B?`4~FwE`e>N(1d8Ou(>P3Twa``Be&r~pl%`T zP-DK`yWJgs(T|2+AKtvTOz_?qGZ9Jk@1Z?N3X>{f)6Vf*jE;2Cbr9tvkJm#UuGCW> z8g2N7O4LFs^inTl>5bcRK|3bnb8AYo@aHKnQbstosHt?DUzPbDFh}|?z)KRTSKv~v zXw$6-+ZuL|!Qfh5ys2S?j6sx33Ft^#Eg}>43sO#^8m4y-Am+z^`M>ER$Q)*?h;K3& zs#3-^u20xwN8m#0(@fzyW>MzV8HMDN*=z1r63D)UtCWY~+;1jb;B zg#>g4iIp%{;cJ%bxpygLOlhmFy01pu=_U;XGs$zG81JO)1U;-Ner^n!Uj!C=Y6Eu) z4^FWwv84j{#E95sqe(@W9z8p@pO9Xp+GQ}ficBLC%2$l4{LY=jjn!Kr-;$t6^FS{@ zEcF-Wk!Kuig2a#UvmlJCodN!EIYhPRCg9m*oy;*^*nFaSbes+La{19gtHt$(gt#kW zQ@8=wimEgy|-nSNONLi5X)tdL=So(s4XVr zg0u#XTt5A0!G1)tmP#NHNuYMc>+ld&$+1dVlJ>xt4obA*(VVWdM^mX((53CsN}eM7cB^lhtprBC{XSOoUa0sG;OUYikcqM@s55AXAh*^_2r^y_rz!xUP_{u(q zEXad5<-C!{(V~t;*Ba{9M|hH$@t0DHF5`D6_Gnt3(oVTxjERq8yx=!sJB&FY2(u@g zSmTz`2Eb(D$w=!fxu?{ zgQO~YuMek{OOo8aGRq2<&Psavc^;`vW(9-36qdeDQ5f(Q$df%FYhSv|A4GVG^vnZw z0SAWlR~j-MFFsF_{aNJ`FkYIlN*Qe=ZQ5AExwYy3PgJ~aL$%^j_@=a{M2s#%pzq8% z?C3(R2PXOGI42%qPb+c#=6xTYY~M=kk=Cvu<#xD9vC_WrqC@y9UH;`Em(&s4*F|x) zI>==k%LsladfNzBru9++YR1KbJb1!|+WQIAmNA?#4fc%{CC%KvNS^|2IPrn19wPVi z=_iTbG|D}eI<~X~i>LRF2I-m2As^`1`doJF3Y^>$)`un`kGC&=9#@UZQto$dvsTNZ zUr}JJmJ!!Uc32chN)R1nnf~@RcerBgCWGPzdyu-`Olna`Pm&Uf$oN2WMKub#cunFJ z@#fOd*<$+c!8S_U3p=I%9v?G3puG5v9nXbDl#&LfEU&@5Y-Xj>h#v?4e#LvbPk4;g z)mA)v9rtjhMBc~nmF z`y&^25;pRK`(moR{@7w|5&#`Kwnc`J&QsM)IBOEYxrb{XIxgHwNP!Li zRl$gHA*lN0iXCP}9J2N}3?HiCbB%TQ4hcHtHmKD&sH%Tae5fkH??KcI#y#nuRz`++nLb|qDw=DuK41!1H0QQ>{8Tlu zPF2X0oyu);8v146>LA@nJee2yCc=*C13vPJjr^^8ihSd~r9Y?GOMG)Np z|Ky0Mz@L=yeP%3*X=wOxFA7`A4ETg2dE?dbp0wIwx;yyN5lPrmOD{ef2%CR}&=y<% zq`CnwLfwhS`RGS*1@EhZDe4NwW2HpG~D2!v}qM%+b%1Z+C~Yf7VBt1+W2-m3wd%Thgx$&4%|jwJq9W zSa}Ej!bZ}Y3#WcLD&XOr1Z#edo04=tRfAf%HW>JZMl!BDj~2_asIA3(1%z04_kgSJ z{?ui;OSS43WWm?(?wiMf-Mo!VU1C6uE!nbDe+`CD-p+HglL1bFyhPKc;R4ZHV1ea; zV9`BjD+|6i0&ij=K3SQ!l#Hm}!f5rBA)Yyn$LS)Fv^tWsJ{5j%Na^^EML5ZKreASF zoEU4OpSk^Yf`UoxuR54f(X+IJ=@hT41`&=eWoGIH;U#Q`i@n?3y6xX-v`HPo?(Hfq zE|*AH^C3xf{qLnmEfi6UsIx#xtO!i}j%bor>Gp4A{{4jMZ4(x`+Pr9UbmkzUx(7MM z68?SMoG|dm?d!BY#}P->zdUVZPlxFaMvXX{tsgY=jvL)hyw~Yq5ggMshe#Kl$!^Wn zFG1w?7nOuHqwc;F7QJ}2{x9xxeTBro(~d*`aKT7z@TVpZS&-UjC>uF+@uWJpbG5^=~KTU^;StftYepYj_h8m#S?Y+={Md zdd;*y&y&8@{WhVjoslefM*PBpXz3tVmsmYVHSAXj7^veTx#JYxO>Wy+M;!aoWy04P zDzCgkE=?oyRAj7T$7wPHY*Nq;@jK`Flepwx?suFP*;3uMag*4;Iz_xWZf6QVj^|+o z>Z3+})2K6Shf(7%ZjZBbj@y&MBd^wd>KITdk3U2wA|Rmll8e zhB-*I@B&|23Oh6)sgz%*@Q~EN_D~!Uwd`###5KOv^HXDa6$TFC!$}SB`x#tClnpUP3^`yBk(YD2D4m|D(c?RlhHe=!WF8?HGwn9Q!5v_rFYBC!TRAdU7gWwQBgi%H;( z1D8{-fg$z&M=D~YSCI#S_IUQj!tI27^TeCP;?@t0Ur`gIP8BTKhuSJ03-xnDFW6_h<;~}SIht@w4>k3T&&O<7m zY#c1K1s~`vUa0L;EoH-BlGa(EPRV&|&n2I`9snn!yd-DLhe|)6$DE$-Y%lD;%2(74Ylt8ogS|U_ z7tqoHhnl&EMjflXV|to*GB>MLkyig&4ZO(LewU0PVi|b*7x`ek8U$w3@9*fCuffDV zGr?&-Eh~$9lG_`z8RGHlhLnn{Qd!g8ty1i5(U?36XwM3IZuGktY-kgYRra546UDfm z^qn!|s46JoJ;c)Zpag3mgJW~)rmv8Tm_dwA@a2O<@q36`@^GJ5Ff4y~b1*gg{6qY- zco-Z|#OvJ|ZAJC6JbSaAmw&m$9nblGQG4mEBzoLfpQzY8ycZ+-ELmLGwx~IO9W{GB zOGqrNxTo{%>-59^@!WzJ$A3!Rjn4+>Yjuc&k~3%Pdqh0q0ieezg2!YIq-)oFcZ#i6Wq>n8BVr_B=epr$U2ZzB5@TMC8@>Ac-V@?mfwVD9P}}an!dCs zjC?$I5=RPmc4IC}+aV0Z4!$bZDv;)X?bTEK_Io**;qgb-&<*|=_Jux~D@k_I{B*&O z7VTJB1Z1BEl%rt!p`tj5&L_f0zIrQSfdh{LnFpi`tsN5A!=a$FjBrRkZ%i8S&Skj@ zYq*)&;-8vP=`SkTZZUH#h`8;RW@CBAN>=4u{2v#fNF*KSPx>LZ+CQ8PbAF`sPpLrF z>3_GXFWm}~P!v;@MmF#Ej5+{!1S9P{yC-~#t`BBksS@12A>z?1t|5;_g=Mh{7xEbX z?q5+uuPusG57K1=B}o`uMGF0~_R+w%yTHwaosKz=In=?3q=8Tj5i0()BVo#$&%Rjy7tFs+W z$%Lj-Vqa3d7xf?AvfL?Kx7KBtzd!(g_%tW*%j+Bk^1~CA6X|qujBB0Ci7D8$^C5S> zf!ebIy_%-_YzYVKS$a>DTYIE(lyu9Z?lT>hZ=^gIi*MqYe+%zpzfoD-B7`J2z0tlq z(>&j4ipOP`5ujidpBct#_32dn=XUSQijYu2oNBAVI-&;ASZ1*wIVe=b89b&HDG8giT6p)EB&%FJNqGW<7M$7X+l z+)Kuw$UBU7fGF7`&6Pgc^o^u(Ar|+AT4mt%cUJW9VjmbB7C3e|SBnv!VzidYcTO$l zx<(9XhFN?v?@lotYv0GcYOBW2+%_9N3K%QSbiV4JHS;*dO=7CLX=5@c>7aKw%~jWs zCcr1LdKj3-YxJSZBjd z0MNt1gZ`ae6!n|x9GTARJ?jZ^#B`sbr{cH1Gx9YYK<*@3%q*)Z&o1SgCg&?-i@a(@ znO9fdS~!~b!_#vxA9;pM+zdJ@c_8^9bKC>WZ&-#O+Yf+}=90s?LWcoPI49;@q3|r7 z_au1n8M2-xB(q~T#dFu~y77cPpRExLJ8i(cD4L`PHddYfweKwrv8ye)tki+JZ^aK> zsxJ>?)#!`;{jP;Kv7NDvZ8Rvlp0HLvv_NQKhj9H#nw#%#|!4)i2_jU zJcUyH@g*`9F86oow6~kcEj>kWY9|vpEV>vF{t^y<^?)GlX}h`wYR`}6aE+eui_+=r z3!9@crW>8H8?GMBdKz(se!n5>t&i5JPzCbi*RNo2c6L)_p!k=s>eN1o5*o}uHDbG{ zL9#wVhYH=XMccjDy(ie;dEVbJXu1uEipMqy*cm|=!msmkI;GCj%{@Iq%Bs2sBa5=* z(#a8+UuDSlDhN#=lMop-T|x8!BaaDAT+&Kr+kL?ZC)SwaE1|-csH~H1oD6&LWhTWo z&Qroif!hnA<)U$qjoydEx8FHBZ=V}HeQmgcy7l~uVOcG{=F1CKvW}S9a`iRX@QNR+ zvp2lD@E6|=VrQ%*z$V)7wAc`Uac1h^{D}Uy%1b0;oL> z@M-~3ggnZ-osI$u?aNnn7R;A$ih5K!&xxxNBzsnCU9ax+(Lem=t`=E=RFGI?$i+i5 zv7nE={fJ4I-EBeygTw3BfoHbLfo8^4UvvvPbj#rYCRJn!?Jjb|RKnKr<3Y|YM2S=O z^&j2iq)={cS0-ynj~*1mHflq>Rj=jTX9&=Y8(zg#Djgl1DkeB*#TILqU^9-v>ZT@$ zmXqeL{@zj}So+eJ%otv=8vq}75Hm;9JzF~pzEPx1zoh{3SskX8Dl1a^iep~q!@o16 z1MOd{$p-L67uE)qS^{I&7el>! z2_bSBuwVX++b#IZC~9FtCzlsk_CSWM-R`1l5K+W749K)Kw&K^fBAVj4qhO__`C4N9NVN~BvsEbP{a8fq&sCMGw+ae7sw3^v4Pt1y1a?^0Iwg?V4 z9GMkcT|hmfX?a1xldR{I0q>vj8y(wSa#<)q%E!0Q{hc=~lZCLVTh^sh`zt0fip!ra z$cf+qPH8Sn)chHWZ_EES{&fEL!`hWWgfs9e2wI~Z&2wuNM|D!bPf&gWFXoP;Tghmc)Ahpy74u zx%Dqc(Gu6U2_ViGHE9G#_p8VyS$6%kK-*0Sc6^quiKra8Z-j?ub$rLAZSKsQh$MdB zJN_r@wXkSx&Gq(E8K7WC7<($#_FMW>w%#bE6z7Fi4~7H;nVH6Dz2B%RC|3JKx4?2@RvGnnRPw=RH*4DqbA3NO zl-$IN?lxLc1fHURd4oDE*eaRm?PR z&w*Oh1fsDO$({Rku|lEKG*b|Gz0zzrdu!m{y;cB$2 zYlq>wAE;`gDPRVzwba*HZ{K9YpYc*c0ke1zAqu`)q-C3sL-`VuxaO0)_DsgwOKKcq zd(_Yi9+hK(pFybfA5@#OP(1)~hMA;1lN>}#QsX@({My(-#91KYsP6dU#NV`~=xGBk z_rwJHeksTPmoGR)?ve>V%bYl>(h>M z9&CkX^gh#J$&Sw#b$x@8oE-_S7DSg)2XO+ z_@o%y4)c$KXH9Km+$b9nv{~lyryGz`)FN`Td{gUF-cgA7(L^d+)jD?6dbi=&SDdtmjX7Pqlh}#vBN_ z4Z>m}DQcuynX`i4$SX~c_#Y$e_pOd3#I@dMFXV~YR!7;8pj30DRJzG#0e70@)Kpub z*%xarq2XsIM} zj1rFPI#dqCHv9=K_>7axXCQ=%OcvGlM^;Y?84Oz>k9_U0dD4kA5x&0k3um~ZSYpjO zf7z^-R+M*E?=q1xguo}a>d7dt>?8?n2T2`bIjeT=s(|;`m7-PXk$SF21&iN4?lVL! z!Hg|sxw>21oJG)>C)20zOePFgZ>V_c(?ok3lwVAQz}d@W#6j!B|qGT-O;;}nS_#R%p7e;HU zQ=4bg@CuFv@iPqTLuI@(fK{cZYi4(8pNMjhS71WS)&mMq+25J)nZdUIxZQR@$`zf% z@midDT$U)2aq{WXn@nrV6y31knN75uTYcdamo`b*wOaA~8DaYL>&JxZcPUB|s^Bb_ zsE|ZdM-~z;6o#LK#MMH2Vw%+K+Rq7zSKi<=&m?C8AbHf$>PpFLXZ`8h09K`k^>`v! zc7cCU?m576nWDu9>rKp)mODSj_SX@^$Y^g;ckR`6>AXVSKi9}bv4V}I?NDR}ll^V%L3g zP$G_ddm#3H;;ALA=tTtQ=L)fLV|HM36nmtU1Wj-Rz*W9b7sZwrsTMLExA7uB)UoW9 zBoHl_mn&+y^#+;hcsCH4}n&n+lL_v;Z0TyCYAsHTtwrcCa{iR);~>!R6CSxKTy6RP|GIm`)SH8l(6j&}J^ zpASmi90QPZu7Bua{H5Zvh%smC&eU3$oqCl(&y28&nkFNDLa$F6F|~+ zRHdua{hVk{;*)TP=W*XXex#9>|lRCO?EfrekzHSk>y3aA_2Wxv%# z!U-=csEoKO_Hn_=hgxqfi%3M*+Auy}rm+CH5Y*h!AAz-_=c!t<{Ayye5ZS1|K;U7zyv9_B;$*3RInHPM%!;WJdRJ!hyobo5Gpp}B1ViZb3JOyL=~n@ z@P#&l!J{PHH!=3|^2NzF5pQ1bhSYib#Q4jm(m(L{E4+;on0$4NGCutaG!m6f5!NPu zq<&KSVsSf&EYqXlemWBscF^IzT# zTN~VqW3^#ZI_uT<%d-93jzo997=G4EVr{gI1iE_rEue3OR%SvOYZX2NY|x5Sek`nk zfxE&WoTOE!Z`m>GCrymK_J&H4G{+J^vz6EsDgXZ~Jj5p9FlX&LXw~^ppy#M$WN2xQ zQ+~wcX}`}4&gjiYCN3jw_1&L)2ws<6UwCk5UnG=YdvyAZ?V#V*1-AZ_aMmTTb5m$t zndA|P;ifK=$bGChIN18_6-S^5isMb*o~Kc)@um94@&zOZEik6~diCveb9K_W`zn#7Fd` z6C4iRM2*O&q+7uxt@H_AoWyf!KDrvRATyvRc-IsW1FLMiVD%3IcOW2$17|JNU{s?m z!N^doARtA*V1EZ%)qo$<=IA$Vo48V1a^XLEC2PbBUtLlNBz&(xvHAWirq^id6w)~| zkDz#c;zGOXa(cNLGl3X=zSaJOEHJe~qU!CaH(F14M7jrfX@hk)J@&yNLok!N(?WiTzP|R$fG7@vk9Ehr4aBuih}2H z@)C4;ZUCsA``5%jSxU~RIMau{rh+`_r2!Ty^v(|s4;S8X4Qq8j55bp(n4km=R;u%{ zz6!^?4WqXtNPWxhWj}%kErG6cqxd{?FGVPqPuqxj)y(_S70sh4gNNxbGI_teEPOA(~|4X42@j*;a+g{tm<8XvZ-RzD6S^sKjK`eHv!%e z4?GK+ZR+1Mxsr?Gxg47&tS(+7D?SC(r^jr}#>j}Y1ss^g#=r&$4Yt5o^CC#-L%V!F zPsQISBe&a0X82F(_H~T=ehH`SasPeI{0w*1CDq91_Hn3GO8Qt5bU2%mP<4U5&GF+i zVQYi#EMC9el@sad81)A)4*&@f`!4~DJg~KSU4$xU6z4KpkA1`4{)sx`CSyJ(f6EZe zxS|$E`Mqw_v-*$R*qhql6yVRYmB9HvUwYFn9FuYXn!av2xEd?*qSS-xBHj4}za%$c z_Kz1}dpeo$fJw*kv{I4qy(caE1U}JYK46)~uf{)z$hSfXrWB-pzGzAwdzdA{OY`o# zTh|u(gTC%+6J@$1q)&YhWBm*C!Pr;KC&^5@MF;XeC~uVdEnS4U{P2V}7d1e4h&^2| zRGsr{BAn>+2H=US<yg^DMTl8p*W?4&P_!_Xz6iVdc{?U7yn)h$nBCF1 z2F3_z-Nskei@sIQcjd1SSA$GLyQ!v zE2;xcaee??)ZmUHbxUamM5S)iX7#ndWGER3t)0dOrN)dz(xG+fA~+B^o-Iq{-PJD^ z@wJU!SBII@+e{~iH)m3#rQ$&S*~D67F#3E078H>}_hm6cDJ06(cjT31)4Jh+P)iY} zG%12ai}=^(R^#c-(#D^Bu|!k9x+ zH_rqR%%q$=(dPvCpOYC(8}@K2L*;GA zd+ty9UpAY)0_seiDR|QH{3D8SD^^?32ly}~Y9hv39H;K}ADY3Xl-#%8k0nSWPwpCP zDsB#5+x5K(@aw5!1%;4u%GJoG4>|{94`>1C2EPi9g>e-FU%(FRBbALMhvHR8UVRL# zr|-xybgd-PVQ5MzRfpL>!;0SWK6bR~?h}K21yPma+XZIoc-ho}$>3pSm-U5IuF#(r0crsQkHf3tqbc zLFS$t)SUD#i=zeQT30vn1MFGGZZfbw+#C1sLK!ez+P+&n^z=>wW&{ zDz-*grq7Z}dCZ$eSpoEdNFc%g=N_NC9|-CeVh_s8j|Yg zMC-4S=$E>6yZ8M2!^B3K^iVI7ZvF?RSs=HDyG9W8Fv1J9qf z5CaqIR92##Z+Ffw5gQP=)pKW(Iqe>cS^B5>mIPG<_#Q{Y@&eVy_tIou=*2%SpKu{s zL{2cg%pl`802KG>xh#@~6Htuu{b^j2=X$k`?FhKMn}lt6*4yjRJ~8Ms{tk}9Z5Sjy z6UstJZcYJG3ykb55RKR&GWs+YSp8wq4o)w(?&WK?KB*#bBMh~j_N6e?b&(TgmozkG zhkRt8aE*D~uS}Oj^0DxAY-)e+Lm7_{LiO6D3ZhOs`cRTrsl;3#2~JUdU7ZWo~SuqHF>Y|TiuGjd(uZo~Qz(z6to2hU8-t9gEYnC!Fbo#W#4 zFE`-FX*(ZSFfVqcF4xBXW;adVo1fyg8PKvB?b+=I5?LFf=&Qv3>j9HUMj)J1r?N1A zflo_~OOPz2LZV`#azPWupmxI=qzNleaFC9;&G(o5jxYm3zAvPp^2!JC+j{Y+^Mcy~ zr82PAWh-QWwAPsKxxJi}ka?A9M+wRXq1|9iy-GU*#<*H0?~{slOgP|rWO}z;(xW|` z6xiU`%+>VS;&dww3LiE7B;@pJbue)W+aO4mba8y|d7(rRL{9EW6Kn0M+x660P3O^b zwM;U8f0+Z}W+21t;(VHT0es$G0~pQ!bknD7nhbBbc}SYHggeGftY>gIY~$|+q>66Z zlVGbFmxM5W$m9W`aFF!})o2-7VBsVZt=XcIUf@ab#0<1#^1W>cJonTm0xb%*kjS1k~umoet=DLOr$`hWl6EuwfGOr_wnU#w~=Qi+s zZN5qPe_VjWv_6LBc+HNJbZtTue7z`5AT?1HKPDoV{_B{rBdNmNI8ey&D&c= zmKg{{(WGtNyd%yQ3B5DwTSYsbfbd6u`?3yY6r-yhkQk%c_zYB_*^$d7bImYr6mG#j zzs4Nk&(Sz0kHL{z=!vOf#}T!Qd+`FRDmCCXfqZ~6%LCCGeM32brRcL>W({vGlvoZ>FSHsYb&WbfsT4{U92D!JA6lq1=dtyj;B zSF4@OUbeDcEyMvv7`T-UCVqcpL!I^qOn)24Ujz##CT;UQz97DMSWO_+KYnV1(!#zy z$mRHh4#ae1bWJj^pR{84SElL(yu#p7A#Hs_i#ZUo@e)St7B@|JPxK~2snm{*m@15) zn~^3!opOyjBhc=aWsuI3&Q}kc#1bY=uZ46BNwUDjw&rXDKSU=IO+X`MsMf8Q_$^R> z);b8+e@Ujj${Vr_Iuk*!K)(agZxqx8eSsOsb|<*@>jt*j(h!E7ACrPHhoHyw`lMZ$ zvEzQAs0gA%9ja26f-Oo2^>8lj7RPmzt(1;*ovW}C>s$}aI9y;x1^&hTH#Gvff+u5X zyP3X1qPLGLZp~#{6<&-;O{eTl8X+h_us43;65|6Ks=E8RC@M0Elx2Q<-wKN8EFF2l zE@>kv?sqhN$^w56+PFtg832S7UU+dY#2@&?@jHf>oF1L!I5sW@@%)~vL2*-ESw7R* zH-Ixenop(<)>ZOPBrYh|6)Da9=o{uup6=*(6g+}ntE})n*YqBupwp8rm!JlW*u4>X z#lNXQN-&KIkf7P5$8dUeuH)FqjYzCjF3Y888f6aihT3Pgh!{+SRCp9CZ0{#KU&YiK z6q{!Rce4esV7PUEVf*3$NIfe+D0)Kaa2-(DhG8=Qz7f}hb+AfEbpi@Amq3d;#*vhi zn>+vcu5B~b3M?a*?q{A;N!EU9+X`d$14AD;l2#|}ckDRcjv8^^MSohtPY}Z99zDBV zG;Zs~GPb{J@zR4nM0C` z8OpD{jZ>#fo_X7yXB*vR)Nz+mlL+Lsx})Y&yAPa(?!IT()2Fr;y3|aet{3E5$s!CH zpZTo)V%{mRAhuvV*>*jabTaJ1HzDGdxh1fh1-j$FDq5c%yODTFc48-v6km*X1hQ=g zRCg9C+9(uSdH3NC$h9t;x zZye*DZz9{Kro|dyfB3Fqjhf9$_}q{wYj0!O4t5RBb0$U4Cvz?QVWRqN`qJ5dCPV#* z2dxbS0`<5rcQCoZtD}0`uF0z31T154cDaV&oz^IuJ$!aBt>GR6n5avq;lT(@5z3*T zbOoHlTQ8L|eH1OCbc1U0KTM{nbQPTGhb61R?KxJ)hLZa?W|pjUc-?!}xBpgO{^sdE0iV7O$~3 z>6_Wzla{z+!q8)Vq`BhwPMW*QY3U#L!YJ!Io<~VyX_qZj##WUe>9;6h3aT?{%*gu5 z>`0W#n9gE8A!M(*Uaumzc%Sl++BorZ;4X;4^qUPmQ-Auv*?rfD?;-eq&u)5@=>!xX zi0lQF;=tjxo@|c%-Lr&sU+{0I)5kXok7FOOj2mitRQXK$shAf?+|S(;SN+Et?Dr(k zs@Y$CGYQtGbbb5RhBmLBkvy6v6Uh!wwXTQq@t)KEb>rU zo!8MP-62k}M%F{r2l3U(rJ*wv`DgTu?+CSnM+lCrGLJ=Kn$5;C?#0tqAQa7Mc`CdZ zks$@|Ne{8Xv&Eb|C0-PlDQ~pCrZt{_wx!3>i{A%=E#7SpRf>=i&*q)Zv@CzD@dkt# zB$_0j%h@*|3BtnCgZHgE1e}a^>(STRjZ=?2=~Xo)W3Ds_G=EBVQ!tb2eTigeYfBq7 z1KW4cH~zmw(9ELceF|&q`B;UI*8ZNh_$Q%y2CaIFeU8+6sa2dzyqFoJLan^n!^9g} z1>N!BQfi-;xNc`u8QDr}6K=VN-1IfG^R?5(D9`xfQRL6`M;(mgNE@9(Vph$;_Kk@k zzXTBmmUD-8kBQ(BR8Qkc=h^#kfuLeYQt>kE3@(O-QJ{&-y^0sv$?(Yq*gmF zDJSMB54jpNtO=&G{a($Nj4owjTEZDf0>}ra8Rq9Me}tuA5lr82m$Y4OfwkDe(m3AZ znk&BiRR676U*<-RZY99t!Ta4hDu8-+*j@*?x?xowbrglWB2Uwc+-g3CbhmyKMHAU6 znbfgcbiHW5&SJ;)QwUVx>&#I&j`cOZ<37&5!^UAbI!FC;ehHl-{#%X zuYkF(9-^S)cXt(1B`TgYil-dmrZ+&p^t`uuO}c>E+dN0$PmQe0H!`~JhbZCwm02#v z$uqaZTSU?@hPYt>5sMl`diX&~mFfMH0K(y`GT;YXS_#y#noL0wZeG;q+prGujcU@K z;p{gIp!dOwVcnC?%_vOGNwl@Tw(G?`i0!yXDBk)w6UTc z>ui1#5yFBk#gFX9j-oen%UqVVkrh_bnG)OZn4u5%PND_n^>Q=dT+jB>R!!`2au1hqQljpCm4ETbG^^0N=A^r_02L$wR9v$g1KC37x93W zowaab35q0awcQOyzhVZ*_NmBu0a%)8{dus6WV-FzH_E zC@p-J^3Zry3Z;;Kiz_tscbJ?j8r9}!qXvF>I`(Wpw9pHH2PpwWQOdR_LT+1LeMiKx zzAx_pt3V1{`yqm{4}-0CZKhAtex!kNMP)3MM)?<*08-no-Sw0l(u?WmfX|cxZIThj z^f;UJqvEg1>e&{jlxF%gSJ?G892C_+SXLJ2dGng#QwGW014a1miLu;HG{8@$YloSn zum)=N+#V5>95}Aq+h@o~NnZv#H1{k|54$kUm>7JkXcdvdLDwJ>oc6wAvjt@Cn;F3= znsXesGWZe^*>=~*q?{)w6vIsA01e#R+Z?D9AqOVp(hFho^wS8#Rl3%1+ItogFE^In zH@dTHeG-4mY>fynd?)nL!;9%r09TiS5u3`48$4tO^WTd`lWptk@X$j1`yp@3`cEAJ z6ezt1SD7p0I2jOx_-oet+~~(tcD3?9=i(AxVN&|;WDQg=sh4So27AI8N@a@FZihEG zO$tlAu;z^=WFohl#!=kD==&2+f!7y9NA&%MVfS6SbJK$^P``Qo=S~+j4HPxf zwVOoDXdeYO{~9LoKmG27(n4|B?d1z;69(R(xzcD6(rBHq*!4YTF@rttYF z^nn(G@U11VcXFjk3|aPfy5j!|l?iBuc?N0#n4KQqQp+OzbC4GmKXZ_})tiqLnMr|< z-3oIVF~>CL=R@Iyw28X|_Sxdr7XA5Ks{b8d)ZFre+vDqjfjSMeFVD*sg&n!~9S)QY zwscc9J^qB>l;GCPY>c1fIgqNxlpS|n_V3iUd_{>)26Oa0Sw0OWenRk4 zt>VuyoxTy*W*Fi7U9MmGQ)~UcpIzr#=i2;bk2t5Zg5wne_P;FW5;Xh7Q*sot1gU1> z9%}jlu-*7*$_*D3qU=Ca3#=ePze4Md`>etv9!g$AzTiO^1hk$q#MN&it_YKh0bMY8 z?D`qqfu{nHU;5ELSigF9$`x8ck!8<9Kp7g-I?-nKJdOW*@lA*FMC6^|-=~him;XJ^ z^P3`5efV>oS;+fK+tqdQ&@|)E=Ck_qt9Qh)K9`5qU#&EA7j462ry2J)mUax_@!h9y zFEUyupkf(NUAV*>6J4EcW!h4TnA1RqUc(sm#I~gngLiq{6(WdaPqn{;OkUdfDDQLp z>A!Y(3bMZ&0|dSB?`~O!P}sG}c$|asfzIFa=Z0VK>+weo8?*T?WdpZ~EYDstG*F+U5Uyc89LzMlU*xOt-{M@pp~Eqj%WL0LA_lgq&r*)*$v&EW zA$U;?(X+npexwI&=|_zZFxHJMCG6K2F|)j52-byTJ`E_zfQFO$*G9_$DVqz<&6(|h zOwr{<-u~62lKVyv7r*o=KBiK!UfF97uCl*B*dEW$f;Bgetrl5y`p|!;$uV(=VNjT5 zW{G6pLp(@NlHRq-GklP44* zAaRp6b?rBUAF%=X0_N0ohyJ`Q*3yjHTV@U$;dF&LQNF9-&MNTCtzl;D)t@pPoLZO& z4viAShK87v+3r=6Q+;uLbe-WG=J-GXDMnFlWK_t;Q)+VZcGCEg<-g~@nFQrw^N7_ww?AMUtFZjk=v}mZSD=zQf84%@Q6%;vca=C1y|ju-OfRDDGjPpYrA_ z3y-i+TgKov>T_Bh@v2|o*H!$Q(P~Gtq7iHxT=I9sj(82ml#)z1V`>Zlw~Mv?)w5^T z*RRTbBzHa=9sIY{yZmfZ)&cWi4{<&AKzZ&BY{*xEY5rY;v4{%?7g3ZKXATj#a8F`< z4GB2C=t`%L#iPgrg$m5$RE254a|`= z7pk%EhDv|z_`=h6@zltpFE1(3L%8HV;v|!5Uy{6>(V#i8S(?G_yBSawhLohf-V+*q zsyT;JVY*k|4J*0Quy}i(678faywBr5Nw|K!d+E`K^fs*GmP|qZ8+6b;K9Fp?{x-r z2&F^PR*>NaMXeq}UiJCWI3&?z_~AYUy4ssxtP zN<9#=AV38xaG{lp$s6Qr#_;HQS&`T}!^eXmhNaH6`YBzxb~m!W(y*!=A&bf>P51p? zTLTU!7*W9pC$t(YpO=K*4_NtP43Eib&?2JN;_A+J-P<=?{1J#pt}1UPtx z>Avq}ryVtZUpt;hT4Ipxivov&>uW)e;m=Q^ar)*Tgy_Nui6*}dXz+`4!lx&>56X4{ zM2D{hTfqmwE|K;1dOK9bT)`TZ^Y`l#&jnEey>Z4giEnA7Bj+eVOu4bG_)QwI7J8k> z>&iv&MLKi|wO&gs2nNQ3aeh06$X`fi8X!Im30a(?u0fh>lPXByh0Z@P)Y88DZ@~2} zk*!EIXI8NB#5;2-s%U2D21C0otu6GR{nbPX@CW97^)D5;{zGo-{3gIrv@MBdq}qs9 z)`&ybufhwciue=Pq`_kcOxyrS>#QdaeR>cHqwT;sO9@id+Wxo};U8p3cV>kz3Ld(t zx|#Ohr%hNv^r77t=6X=J(Xyc`YU6Wyb6=6|x@CG}i)l^#ttzhyVmmJ3BxjKJrk2Y1 zuBZH+@3EfCMrt+^mrA+5o44Bkps@idwL1IE_VcHD8tYM^;X%n!KM`fe?C&F3V|xzM z^_eR5!Ja-8-oDF5ey-I{5&; zN|71AGj6mRn#gC@dkf;-B; znQ{|+V5J7y#9#i%j($b2WI^H31ESU))R~Yp7?6{hx7#s^UsC@?Sp!oYZmf|QhQR7w zCbTDMys3OsN*qHHH{Kx*hAO>@t5g&vgD_iYAKPf9AV}58 zr~ZYjZJ4=Hp2dJ|lnGmN$3M3CjCj0jL6s56QLtmTXKr(43NjY|ASS58w&K{U_mstv z7p-D*s@Ym?nvRhi)6X2O3MkW+<;XeT9W4sQd;D}NkC_k_%U*i>^GbnIgi*hnHt?K~ zNADQ6u=Fq;R{7iRdVivDZq6jhMS@aDq+0E6>9=Ri?bK}y&2BL3-K|DXl$JlbbOkAQ zu)i8YAt03zOr7|Wy|qMu5vsmia(E9(ECxO3ec7j2b6h8ZWSV0L@_4f!u|`b+8b9H# z=8c4#O?Azeb;P6G%AJ|Ew{&YT04(KU!D#$C4fQv59PV)D8rPjcc7;bYLiVPN9IHZi z-nGQCRK~zc05h2!YgK5$H|5ehY&~Gp8Y{w7@k@FcDIjyb$Vs%Md}zI!m2zo4@rEX5 z8`dh6Rqem=dnCYe9>Zr4mig~brd1qm7fI3Pv!svgZ`>y@9bJT^nM36c()L&~4qoSQ zHHiDcGXA|GP#cKsCz)r;4J_cM2|XnG?L77J{bIZR5+!iwj3T;3ucfF2DhK}wqlxqViJg>ZG&FnOxM@dAEGukm#lxEB@Z@)d$558iq>ii z*v0>vVF5=9J)7?B_|Qf>b_!Xv^7*SP^m>6ovzP(UL3DWcqf6G3ZL2^Bktx8y!iz^|(JnIsdp`6LTOy!BZFWl%=ricvO#) zAARsJqwGh>VcEs{fzBQmpFJ?_mna8H*PVmxiJN8b2sZx3gv$%!>1~*BFoCzq#ZDhN z;g<)2ZQPiunT3Ub^Yxq~o8W#h$es| z$Z*^mM7P$yWj{G2IB2Qs!y##jkTj2mXA`TLbMG%&9WU@FzN4^uKPA}d6X*5Dky85I zHJe7ZB1rPNVquzR@>o3N=}P6v_fnp3Xm-4VT!e3RjjTCH3(RZ7NJSQ&P5E*Wu&iUOPj@kaD?0vo&g)oK`m#cjUcEAI?$BuFd;VX{qL#hotuA!;h z-V&lHcNI%8{=&y^RvC<+>bM%2!6AXgDVRsWono&Y6B#yeD;vAbqn* z&u`ul1I%yOL}7d$f5TVQhCe2gq}NPazAD$6pXmZw;3n>0eN5%JcxA6~hUTrvVip!d z$0LU4dPgHSWAK?nC2v*3!M3uyQaH&x$*XfZpr_sepr+>`Sj?lO## zU4>^j2;1XNQvtBQa1Lr0@haTVgED9kHUSdUPTOk@AbWH-h}hOJdZ`@1-htt)usn(* zv_-!2w6K<}YsJzY(=61v%p9M8^$>V6tOLn~XLcSzNi)SnryE*^26}AG{E}gX6v!hi zp8JLB2uwSQ$|D{H=Df z>NO5CX}}VgV!lr&1g`w1w3+q5CQ&9T`YPjGN^@lpW<|f5y|J`^hw+>#f&pg0AYR03 z8N`rWDQ)-Kv+<9ja;ZfBfj?$zZ~0v|)px8jn(YQMOENZM*mXVn7t>58K@#Om zZ{=hIYs-1RF%C=6u`ez!_KLBsD(j_@`4wGKWoIXdo`2!@M<3>(vH27y#vW?gI(i z&M3 z-|CLtR(E>XF?~tHuv?I+jfBCAd|M^6lFwq>>ySP87NvkgiZsul^FzXokV_*sQ!oar zLkju0VZ;*}-ygp`C>Z2k151P9gc29f4(F)gx#()R2~MzrVKS_gzKt1#N%O};$1u}9 z?P7BToVCzJz-iUeKw>FY?!#r8fEl&*IW7LT;gwI;T1osY?bxfK)u;A~PlAfCUnn(9 zSB8RQ>Gm3)m?;v;--n+bYgGS!CL(`&X0Al7nI3e1dIFzBM72B(@;9MehT)Ba*2Xr> z%zE&{Zij^_AUPZ3C(ol;(`FGbPHrXTwuHg2bTzM2(<#Qr!5CSpOoo!pVDQEet@vGr}YQ7@H9oN_-dIuahXf zIs>6}8r&R}C;37=+`$>B2X9uyZ}gkGg<>Y4?H$`ZfUtk}xtKMAR_I$fryn)9w)RoJ zOM$t)%afSm>v5$zvMOvf(dD(rU<(NVWA$;}0=Fpo9BU~On`havp-Wu08AWpK*r?{b zbJtOH=leDcm6w%QyE*JR0d>*_WAY&2c|6aHcDjE2ah*!;!Wk%=Pi=vgtTGJ|J)FKb6GhEasxud72-7fQcg@~AB= zO~5?ODtBndR+QdfOD2nBdXX^l=>Ks6w9ilo$$44#f1&VSR?%WO`oh>*i2;AZfcFEf z@Q9jNA3{#$wbl;?sBvf6-&Ra%N2lrx=bcM^ zOfiew4lbrQmJ7&8;iDH#fDbv99AT&}6a2(`o0#hXKs=*_i&ff6hSx#?8%2fZkkZce z7BJN{%?2X93hE1vFo9Gl9WbF)`bFfq5H>jDxr;oRu&5bBo%Y>PqFGGNs|}PFDB= zs}=O%76M%|2{@j@i_z>_BJyK+)S2?Zw02ys-M()Ct}T93$M);$PxpY^iq$vrPlV^@ zx<(cH-EgfI!HPR)vFIpN8^>G0UoZ<|snmo46W@UWuYG&*BFH9Ktdb)tpwa@X*w9L-vMZ+9 zOY$q)S>!l`kD33b3o9bm+|LD{p)t0TN-FgJWK!)hZZ6GpqFKmhy?jTjWR)It4BkPv zAR@+7hat&0y0YHHNon;;b+_L0lNdg1UT*exfa$PZUd*h=>=m}B>`{ZpES%!{a=YJ! zr6qKn<~wiz;7hlQ0xx6^N1mW4iu1%7W7t>p(X&{mMw_WmKu?mYAn}#MX*QPoM|ODpYS(jJ zz{S|`tDajmx0J@e)8(T{x$ZJTS>Kli~zyya3}VCQpeJ{&A_ zPRM>s$;rJkP8K6}9GQN-g4?rVBaANWwo*}lasPxzc`lja<-N1WCvmMW-W9eeeX{+F zHOfOnys#MY-)?qA4_zgYVOy@c`0p}uo*Xis+z`y&g9%m5m5Yso@@W|m*HYEO)q5bshzj=qZDcKY zt=%@SAUo6+k|z~gk20Yaf*L<6u-R`f=VrfvMxLQw@irJLOaeM9k3V+DB!79aLGtk@ zUhj9M9c)V0=JbOJL-Go+H#gAwxWkQW?@#deg^abGgQk;Me_(d zgd+S&Z;GeX`77j>_NM90OTAE`Ma6b;Wd5%pdkk%Se_^uhfocp-1Wm7@`HWbM?l*_m@d-dKo%OfF#)piF@v7T;o?=@CM+9TPj#G(l zDz~gC70_Od(uZL8+|u0>UjFu1PWaWf)o2)1qGO73G$q1}{@7^=5 zrMYXl2($!K%_V)=Qd$@GCvKg4DpAofrJJi_$%F0W9f#HY2#z;1JoY4^!q!4}MxEMB zg>m1@rV3dT&`kroN5YHQyi-OC;Rf+UAQjKP#iv97{hY9IvJTu3r*s%g-BD!+mRc+z zv=NA;a{&*LaVm-%aZ-+QihpJ5U?$!dX@2L0AAf_LD|*R+<-qMqP7{VBTN{9$sZE`GZGa;x2_zmyx{@qDgIh*42HVPlx%;MCR*Ow@-IhLGq95B z8D|KgdNlfqAo%e}Yh}RW8t$C7& zW&7VdwJXd5>S79g;TC`R9AzOpCNboK<$b|JZF78q2^SoOLOcH_b#y?4tQIW;2#@4& zBvsvaNe?lfV9$VI3S{_b@+@V?OAy9`E12r3+c_%6eKb%3{~I3 z$Rjw@qL|c}n2NBw12FoObidUz3B(km1Kl_dZeTm_?vMPqqygn%XK4L^g(2Z$mHS zYmedUGtp$C=T)@R4+j`kqWn)8Rd+Q>7k~G?r6-fbJal{gI3@vp!QRLrJz~9#-%r{; z_PDU^D<5L%aR2W^Ilvu$CaATDWY>4@wH}d(#FXAz6FhO@9XLt2)W`W8x#eZgjEkit zA4Cz6E{u-AzB4Dy-2dgbi^w=1#_iHLxQPULtUPG=d5m zrgL2tdTxySFF;x6I6Q;v?G;ts?DG@s0H0ck{oYUSGJ_sWzxETtH}m}cb|WiTV6ntJ zOY1`6a89eZVx+l#rU%t{7*6IJ(4we#o!*4Mdl>!3Z}K6Xqt+W@i=hUQpAjN6lQbm$ zY&PV3+wI1bGr$X#LpqPKzIOkR#A~U#leB$>J|j@S!{>a;yTs6a8=Rcite3~kK^(=X z1GMpK=uzTba!HU^`zIOcr{`g{V?LYbcT-3gM@Im0)5Lqgaf?h;c)lius9x+U^Yuvj zFtLbbOsoDdpe^#PQs(`f7xsGP&3$V1EdQtokq=kcLJ?Zj-5AX-qtdmot;6@jzM&umom`~<)n&Uk03?Gp7+dYLuR447pIysw=iV(l6V&c{N<~H3n9* zHpaD^V$L?}u`m!1#~=YX+`}m90gry}RF1)F;odmSH>Re6{Hkr3bnR49&$7#Mx*E}J zAm;tPIjUPvWK~wRj!wqb_DX>SAKScQE3 zx8{uoYU-a?=5P->p**E-yzbQR7?o#U$iX!`UO$@T?3H2){_U;3Bo&xqMK3FX%bSV! zutV4LW)1N$DVAeK0F}&^oeKJ=bH6Zlwc7pEoy$^8Ms$UwXfA)$6E7LMzjZrWuZw$V z^!7q2_d2dWchfD<`vtb}r^~uE+8&v`1G(vHvlu^Q#jew=srU_?OjYK~-m4H=Yrf?# zmr^vNl~w<{iR4=_I~(ROvkH=_u&l+{8jpmsN*b@p9Qv*VAOi= zER&ajp@(vh-8IXo#bz5na+-hkg~c)h5ndw4A@ zt}#oKb-z7oBG@rKn5|R_H!r~Qz}TQ__SMyJD?Z%N)xXFCEZjsE5Xo}(?=0;O+hKUM zTFNS9y9pEMf2FJ3Y-d$`Fdjhq-Sg)8^W-^l^H}B-;*F)sZP=;2>(aH2#*fXV*iape z+P;7qy`Q!QRzZQZd*42UamWS}THDvjT?6NxSe$3qMC4oLZY^e=Ojfl7_rX2K4!yt1 zhw{5qOtxrWMtW3Ho7I|Jq&xu?v1nQ}r5DHK6pEn^>oEg+z`X?BET1}FY_zs&5QL8P1S{B)L z6#m_~>4#RcP3=EX#QlAg*Uq69&C<$8o}(<~Vi~u$dE6XE?!MljHFReLt^l5=lgXvW zY>YksOz7BxYU%LYYKjHPo|sOy z`@{6xNy!3F$AwUQ@(vb5PRt|RtvZWq96$`j(Z1c*jj9rO@$mco1dU*!_EF!LYr zky!dyE#~tzwHrJ>1p3Qz=F_YIRo8sI(_OFrSy!bqt(!*i#+z+m=B?tuIVXS3ahj)m zRgXYvg0g}Cgr4W19Hqkbma09`L315wpi82P&E-^&-euz{@{`)|xjGW?Y)e}m&3!(Q z`miqWi~r&Y1%{$=0Kn2o8vZFB1e-KC>xuQEYU5o%+)l$kH%GoydK`lyg{Ov5_L*FSgsTn5U!~86(cH;H- z>)Jr9-O_j6#H1M@qd{53b!WzFKoKIyAhBWh?I0AAs|Y_NJZ(E95K2<=@3v* zK|%%T5u;nBW22D{fx*UjpYQLz-s^h*f$cia>HFNDbL#Uss&V=EcnRd@Ch>Ro>6BIE zkrH}y;2Pje&%4HA?;zqJ;HEHcEJd$V(f1JxbWoQo85S+4w!hg+ZJ8s5Vh5X@bnvqD zLsRGm@r&O)@zPL^J;(a_-)^%k&q+lG=sZF$CT|Y;Qnvc#o&K~>_jl+1-)m`ViB=c7 zu}r~lyGD+oPeIH^cbqZ2Uhyn8ib?c7H=vZdqUGTY?hjAv9^8-_N8PBsuY5tL}u& zS3Mb;?2K!|Irjr2`@KgFiUA@2B?CeN_uw9fR_eEO`^o^Q9mO>;c?IN}n^md9oj*;k z==(pH8B@ihHaBvB0sF=ql_b-+BF70vJ>NwlaafdFoZ+ zJV7yS8}>e)jotiu=SXl@{v2~3Ll=*B3AU&o6Sj0~q~x$ha;knDS@EP!%k{T#stBt0 zAu>zzAggnNI+L=;uF4`IjNfhB23APg$dz6r3e*cjc~>Fao1@ny2iMA|(cjw?DKBy2 zfiQO^#KiHegZI21^u##mV|)I3*Qw}SpI;A+96;dWgfHYp?f(Na8Nq~|utp_dth;RI z-3tmeBSQAqYEK*<+ zf$|ftzA|_1vQ57P;#Jyp_`s#t7{G_$;dZHYPwJ=&ufF4I;BTwCOLue^u#e3QxX3P3PmuE2Sm@_K*1m{r`4)j7vIFwjfrbJRoGVobGY z0+3*lg@rg%G9#xN(`*jU2hLJ8EE~D(QpU54 zzIQ6_6`(b%^~8uyzcS5`q(^_)3@`H6gIm5RJLrAt zzc-fXzVQ!Da%kq+ci^^FCp+);BZzedpG+YEMaCtM;fYXWXlx+Y&Yu&UWb$9fTxt&& zt-CUZJ+LcEI#a!mf7(;Ow;bVl;}#b|s?=`$+}c#(vkTQ~VR|#1fx`_?r9$ItMB2yO zcqEA4Ybqj3m&5I17U~d9bvXkppf-AT25=s{-LKEX8sI4OnXfz%5+I|cS|~{TG@l`r0yU1#izj-<1h#ZFqs+nCKhCLXQw;-A#I_}Y9q)} zg=JlWu5xson@C*l@oTJ67X9Q!1J{{hW`%CQ{C$kbq6w6yg1Y1>5t7EB3e0dqZo1BE zXTb^-5`(9CxMR#d8P#C?81*0^dxzkcG;6V6JqmvP zlY7U-9^(yyy<kz8DQo{XzXV{=-#`nRO>GP~tKGJVw=}i1LeJZ8+Q6QI-c93QWq}u#>9= zU*-Jv)$-5st{|JH5*`a*%|W&}6=bz{d_w*Yyqq?E8L$p1kT-sH{Dy?r)lh?RHeQ|h1(R1uWIM!MUij0V)zOm+z zC38rMUdrULOpOUKUNalc?^?|Itx5_3yIdZY?6lYC$TeT%ImoYhqY>$CA0%TGf6@`PyH-+C$a3+Xf_P%7SZ-iv2Jc?%?mrPu;&jWR(MSyXu_E6`?~oKZ z-EFMbmKR{hTUJyZAeErqi!e85#OB7xgJy0m{z(=42ja%7`3Eao`lW|QIwh^~_C#xs ziCSMF7}gPSaj--g3Fz+HkxHwV_7^L9^L9a}W1cX0E6!!eFVcKRUG@a=Io|cT+pBcd z`~S(~SR+SEyh?Up@%c^HV)i7g%X)}8!Ta0IMbA0u+P*FB36!%ff+Pu2Gdy*hry%Fm zT!TIq6f^d++_35I_Xg9K2v^+x8I-7;2+a3TFAuK%jmrip9-u}90K{7osLz$i?-|`kyKlMBC zAEx!HlUZr$4>i7+g3ezm3?061q{Q%jB8j-_Rj9aSO%f`m(6mt<6W+CRqa){q3oSlniUBRq-SYM3F#KS)c%C0;(Tgb7LoJPt^dg>S z?%az!coC)Y(szF_Ux&7Vrr@;rO3aeUy#J$O&B#Trhhdrbk(Wi9y$YtgX)_eV@K zQ7+3HiW?d2;+Q5jebkbH3QPdAqWRatf=wz81_~$ao^a=Zp3MEtmed25Jr^C)-6bal z%&O~MH_VE~u29I9{(8}|gwH;}@`CQ}SKHH9En2YVsabM-GB26Jw;GAhr)GKL*Tnde zB5Bw3$@WreG{-bW*SwzyU=I6XvZr%{2j|l5kado{<=Et?m-WXB+cRR27h9hZ+}-Q4 zPWI#5Ddk}YQB6$*pO-c>ewwEnWw6MjDZ_OJ-hkY} zr3UQ?0(?%6*a{9?&#Z2{+vfF6ow@xP{kk2W((yWgPm{=1$Q<*ugTMwRu+$#?y* zg75h^?wUnfQ|RLKU+rEb6Hi>_#1-sf9l3G0gS~&sv(2cEgPuD)+qv9y zA0|LM+eMx;p){8lN;UWDxK+3~POkL8!4I2wcRQ@ zTrlq}xo0IoSluOeZWh@Fi%n^o-#mMqZnra(f^~CcB?WHfbw;-r7%ig&){a>vBaJXYI0HLG9t7R#>hW~gM|O0{ zudqfei3%2D&9EUP{-fkZVeJ*jO1Z2GQ4%CJ^JI?TOR-J%)TtnuIY}c0Y2GW|n_)#> zfg9H-(Bn+d*D9!#ibZB)^?&~%fVqu-8M&wVmbq{e$q}GF@-(c1F+DjcLsDB;9{`*g#kh+Ny$pY|`~|KkG8|FSk!s(y|>s$-4o zDX&o8@#+@;6D-qz#FlzbK8;D}E)C}WkpV=KJ~2-5M|?gWHKPsV7>eOgS@@%oZW&Iu zXE7CwKi0}YkJCp6@vM{F$Trc#wBzJ>Efj1_VxHk=0Y;@RIro(XU-@eH(i1S*L~>_A zOlSQ4$xZ>k2Z2&#yoGu{evtBB)=KvXqFiG@RwjV7@gNlolSboMD6CQsg(jZlc!$a( z?Qc_yz$nFfD3onY)+&d_tCl*u)PRD<&T+#n31!DKyT-|MF-tz;c&DImyB6+^%)!@Y zn{gl+#`p*ue#a9|GwmMaRgZHo5_Q4y*yrZOC{&_5Zv&>yZ%<*XA0GLF&+$b0v_@CN zl(pw%C7lDShYHh91ot2)U4~rCaNfwQ)o-{uW}=vh<X;PU*|8(#rxtcovnY_~3 z7sU26VsE%4&t^!aWm?S#prByJ_-g^UeRs$Y^Y4+fYxl__?Kr+mQhiP#&K3SoPSmaL zSatS}6Y>^PLi{wc!qSc<)%Q_KifsH{vk%(Ef_&Mx!O=hYH*VdV~zq)>EH_x(EfgBNVb-}KLWiC#V?uIQ6uub$en*!+}>?si?F;eR z`19LObWl~46KH9ou0X5jBL!J3GmV4_2pfPk>w>04L)2*T!8?g2G{yOg9`E7g`wWci zjJ1~Y-TOIESX0Y2Qk?7fvpmIrn2)et0_NUaHUFOzY^l>^-a9 z8~%a@<)GyBQRGcT6xqYf?n=(*Z`CXbq8DT=E0AnY_|JyUAFnVT+Qn=T^w9oQ`%7j! zQgD|agM7+Trbn(S`Gt2wBy&=T6k@}AN$q@dXla2$uUq0!)Yp785!&E81u@lKzHBjK z@@|+zlRjQKi{*9Ll?^Qp6su3-f<2Y@sEr=TIL*MxcrPzvvYFUBn0msq$ZAwD* z@G}93?kYJLMc%vhkult|fx>pHznmKob;Bmd^1MF&-Hw|CBIGs5V%ZaQ+Y;!~lJ1blc=SH~f6URkJmSif)fBnm@lkDGLq@POX0_+h)d>p6iU?;87a+y5C8V}VZx1ilxIl7yg7539qkm>x+h6*ym+{T)YhyNT8 zwgVWWAB)mqBYTyNFSM7q#%~1-X>e=IPfXJZ?xhzUs!#KmnLX6aP@h;}S6fFc*g>rP z;7-*I6;*YUH5wOZ>0W8|J+wsV$3ItbKjVQy#CFWc;R){avSS+8wy49h=1pF=o)OM*xvnZ6|b?9va;LPn(SY?oEw z#hXaYCsJr)_)1l*G}n5a*1@~QYV5?t&v>8Uls(lLQ>RxaNeYSMR!DZ=jbrpAIiUap zI#i~^h5|n?gz*os#f);}KVi7K7|Qj({!X;(+xUZe-I|`Nu|=Ut!QdwFt^_h0c#Jg= z#U4%)dfh@|y~@JM`@{CVKCzgl4LB zgc(L!3@-xL9S#&+eyZZXHO7as{@rm1B}OYyra75w$4i=`8WK^=kC@*N^az?J;wjp} zN%X$}=h#Vu2_+PgzhB2aC;NF?Z2AAmsj$8K=D;8BIBK>Zg=-QhRZi|B`~FO5)x;~n zynRzZzUI&P{m2O-JB(t@KFBG8cTs>S+TitQc&k+Dc{8kN@tFh@6Ha3>5J2DhHtzOA zoNNE0>+1Xod$LNRE8Fq%9;`zQg?5zp=*Ec5Xp89Ht%Fl>W(uyNz~ z?;TB&=>Ost?60|vqpD~2bkk=?3F}b`n4-IkaL#5Tg1$Iy~{6`!e{DT~v z5NsYl6(4=Z_lf{IT=(PMm$NtJ95a8YW#>-98ypw=JW6ObX5v0=I81M!FI#+_ zSkQHF9P{nQ6R#tKmg@7VO2H^MJeb`68H18AURT=ztzlp|NUcQZp(kA*+YW;fh3&{E z9@K6!BN4@ogt{c(8>^x4TKJVwFT$&|0Q2@Fcyi@Dmls#^-O1ePw+6r)dFZ`u7S3_P z5+HbC9sQ5q&)si}*ws>g{w<~#v$+l);=o}g%n??nGk&$P9 zZMz(`zpM|U_H1ZP8W&b-Py;HVv;V4^Ne3(HZv)`s%3=g<`%huj!S{pxzq+Q}jg~u1 z{9n5=e}Q~$8Hjy~S?bc|`GXfjX;2}Rz1&7Y4zpoz-I&G#W~iwHKEFSEn|t6^~}d9wMDIKoE0 zP&$6Nhd?c(MtHWj zu4vo#K)h!V^^?z>^nTX>m~rLZ$f&iHgtbXx2&%_@@l2ZAv@s&*8&#=_XR)Q~9CN5MY$R)gy-f(D7E0?Uk9mfQvZO#O)H#Po$EYXAKr zQ_gVTav~swbY`7g<%j$K6X2$NHNu=Du5?kTNIk(4gj?ELExa>7zn$<>+-dNEH}Bl9 zp3A)B{H=UNmi=4xE5wsNvD;w*Z2!=AO0#fMs{EZ31@k&+xWMi8r7EQ=3Ayvm4AVN{ zhoBX$YVz3FHe5usL~8BN$$G^T=X20^)kZBk{Jiy*=W})JD9+u$48ov*H%~|+9BzQu zPjj!>y3rAjZA@AsJe~hFu7AdPGvQZT2YUg;Bcn{zT=+aitEBT&NlT|yH=z_8NnwW# z;rM;LGPDceo^OmF>c@b?dEB3cS7?#?#zWg;;)a~3gFGT~MhQ;wEF5q2L0?(?TFq5L zvrdAERGJc1iR*_HR0Xk}{CAI}UfS!-4)cd)J>fAU`9A(?U|Dj}P}4P2BraKZ9mhXyU@tt&i1h6Hl6T);i+q#aB!GpirO=PEDS_c#W7~mW* z_v859>w8p0heY8-Ix4EK=smse2D;lChB;$cSpI&W%zxC#Ok6qJ4pOprI^L5-Uc1?F z(_jg6m7sTaKua07#orIc^}*;Q2V1>)5PVC?GLgok3P2w8fp-y=HE2+ZKhDEAecuww zUz&7TI7yH+AK7@Li)`FaH`a`Tj@m#ta^f_XU)3W?#aq~Z;BaIO`g(HS1}HT1B$z1@ zP$>1}kfJKckMH!D9jtZHuA#DgeZOyMVk|;OVep=2A^zKDgFFWe6QM z8>n-M>mm&?O46Dt=BUEwB)$}9Z1Em8B5#Z%fsMYmKvB-6(fsI>ydqnrKNMsV_?DIM z5kB1(8Sm@q(=8U#XnvlBj?^*R{f~^gUUMUl$uAY-W@r5YNJQXj`7O#~O!uOfG8ntc zEL%dnp7gc46|ehM*O!JBAKHnh--;AVo>=wAm|{}QiRsW}YsSwPV2>QSupYml_+h=S zbVSZcG4(p!^+^W4l2&p^{wad&!;%no!X9P?O`uC5TNNsIlQ}a2Um=G$u6i7|Sm)cn zQCh0dr9?&>aEcDf{2>FRg zQUs;@W+gExP=XwVi3W!Sv-Z93MJfCHBXON?%d`(%gID;Pp%J{7sVDAhV4w|G9 zx5t-P?@c&nlzOrc(#e}4nSYwDl%v;>TR-O-)F%m3)S}b7T=;fdB&1MB<7Ge*J~3#U zK;JtTNIhWleO3t*&beVG;Nsy4CU)Mk1aws@< zEV(9yRhEc(k@Avl|1M$B!?**joKN>3q6cJj>~yDOykb+d_&E^mUKw^AxzVJ1Ur*P` zBnO#mvvQcigLuD|?Eo;(Fx&albp+Eq99FaWF+tberz_bj6E4ZREs#PjT6`_xKh1)( z*-@7{N}}VRZYzCdTekC!95Sf;1mtjwQBC!FoH-Iot~BFo;|0(>#A(S`NTttF|z;$ zO!>XEU4bM@5EJMaN`V(sDmdA*4*tC+y$S#4C9A1cVMwGZfdV;F080ucxVC1X4Obtq(O%(W?el_l_34;Xpz6%@2eyPQ(3e z1(m=d8Ro0avLdxjQ<3m$G1ee_3e@BNO) zpH5V1RM_*vITz3R8R>8lv_Ga}j*kBmoDxg=pWvhregIF%k=d>?nnOG_Pnwh4!-|GZ zs|dX4mA_*3j2B#p$rmKP&Qny9a z3fJ|r&&;!k!l`F;MccQp2Lq4X2){m=?}w#UfPb*~H1GoQEpwa}2`{idYmTV78y7$4 zx1t+`9aB=sX@m7P4VQTm#?6LlXp<3FH4y$<;4VdUHD;)+ND&kKt9buCQ2s}Ln=O8e z3WkEttdIGBPEwA)hT~$^&^6xJ?|o?7tw~C*hf-UhZECtUmtHrcMGQtd+|LrgQGGOf z5#`*E2W+!WNEZCxp^vKQon5UuQEx36#;kRxdXWZ#U(zI5tQa`#fKve7&A_mab0wM< z`qi)`+90W((cr;dZ`=VK?J0(F6;*nqL%@6nFyU{$!C1Vqhg6S-d~`T7gbs*nDsS)2P)b z<>2uBDQ3Sh@p<7JYI!HxSYW&~Hy7M;RTm&^#9?Ir6q zLGNcPIp4HThp#(NnG!Oq(j8MXDV=7X{3L|853%DmXu*zZ1u&Exvy@2?W(Ow+OTTWX zmm;>!LA1L(o*sjgFK335ISj)r$;@`}ElYjU=`R-bDjCPLsE(uln6EL zOgRWhimE>9Tl}Xygg#4dw?Etd7_XpMH{m)rKgV-bEauu2B63fI z!1IO9eDeyV-Vxv7`bH*QK&?FuVGoHDa?O{$4WFOXx}Y7OK7WZ~bp*!Lc&hr@t#e5- znxE^ohAjbd$%Ei6{huofJ!IOuamR~7S#UV8wWY?f_n2kXYDd#$Nh-Zkz?=0zAHm#{ zfSUblyfS#5fi%R|($lISDUw@J#pI$s(3F4%L24PNno0m+wMyJUUNsS;oM7Polk*O<2u&BVLxkwRI><3LmMq!TOD-EY*8Ds%s;kCO_S~! zJX8SNZhfjLZf$j56?wk%$sH&jUA`*3LbIR#tYsYZX6c7Hd72kji;az>y>?J1q8|KG z5Gv;Mj&C*NDc>>eqCR%{3Dc?fhZ8yN&g6=p&#y`Tj;Iyt!WdbkEVJOk1$hq8O-x{$ojin@1-NiWz~ew}yCn_4V5P!-RC z6jI%=o^ZqJ4#1PzCJt1us8ZI2{d!Ki9YvT%bpORph6LOTjKhhWL2J-|#ZLmHa}=RD z{j{8{|^ z9V!!b1HVztw!W}~*~|y6Y4kqG%dK;@Hm+ztwtx7l=s_g=@;YLF{|3M^$C*u22znRt z`Dlnta~?B{4M*hd#KI2P@-HQN^j4y)pA4o6qXQ)#-f}fnDEc6edF4OYFdQxuqF&E4 z3rjJ`=O1LR#JPgAEZZZ+I2r+8C2nqSy0dNOK6E>V4r;E0rGZ8|?%Ms%Fofpz6P1?0 zQ(5*3U^xV(g9`pKZFbIyMwI%xJ;eiKU#Wz*d~4O)@ie}>QJK-UfW6MR)GaSd1~S@w74M_4C47d0uw2p2e=nI&Spy*A3g zq4}tf?=YJ>AxeQ`BI^@#WbUe7x#S%=lne`c#? zK`wQ#TiTAMto^Y(rjl|QhcJx1%G{l-x}-+1gN5Tx9LtgsMR-8ZxWgxn*`+rGfw(Go zGV#56UsfhQ@(2LWzEqhuWTK8MxyOQ^Z{Rr`J}py&YpsLLqTnzq&D6e4lIkaJuXj95 zKWPcySCg~UVE1~NfNS;K%*>y*6eXg!xvx1ZB0O^6AXcG}{=3y@lb5P~V3B4g!LyEz z5e41z%^fOINET2n<_m6b0FlAgim!^eAsJ$2*;EH#{B$&F>hVbGk)+K4;>WiL00X zC`PO6(4|=CvuRq&!%z83rem2V%nmBRbM29Ks?DKE&U52c>*~7yK&c<+r;^I&ez~%B zazNUv**3&veI~+03^x)d8|TlRT0a;M&rDFwfR9M~yTFJ#04_^R|35B3uWD>X za z%|%kammYRjA|i3uGvv~(lZ*6DzmFk&pq;rc9Xuds`Tm_^aUX}WtP~%axw+{HdBwBv zr_*tl7jw<;Nn);QCJw64`W7)GDA;XcumzHtIL5(6YJa1qgAu1N;-emg;kdM4Ffcu) zPiN5s)*zJXMnM8igm7k`_){3#{<)YV{0}$M_>kb^9QDv@1yY^)_*57ego~0!NWTlZ z&-6vT@&0{3-cUfR;Vr;fOmI=_xxen%u)X^)<>tUV=h9ze{cApxlgvgQoDR%)b;XLj zQw1`rO;q#vtY(^(Vz=Kra<`OwTkXQbB8hO1IMV%7cJJ=5gW>b!zJ~i9=;g-Hy%KL- zwvEQSJfW8q6NDd?Dv-?o){$Jadp&nM`}>!BZ&socpe3BAAlIiBNbz=cE_QsHeGWU1 z6feZDgQjCCbA~VAZ#pDhcR|;KS2NVu;N8JMA90-7I=}xUbo>nzPN$|%a{dhTR# zLNl&xt*nKgdMxW~Ue1-cRt(v6Sg!2n2Spz}%(8yW!u3BT#?h=(tmav`*B*9Ue^&1W zKReiym{W=?%#bKg8)bgxA=D>{F`0sUsJyO=7-to?d5azl zskm-L|8rZb&lPE;YVyAbWvnTY?hxu?Z?@YGe)8ZtTwHjIo)Gq)mYDkIw~__HmQF>< zG?td&u>~jOiW&r#kEFGkYnSK-P4zeLUVhvW*p+Heg%J82ltv=a-ZuCs>`l}e#fP%} zNAgTK?!*d2_ax||TGx)inG`%Wt3VGzUOtrks+fsgjS(+DlW542F6fRjV{az*q^3}QGL%V{*U`q1mIOO&B~E*&E`)x(@SZmq-%^ zETWH1@1so?Weblqh_Nuqyb zp1IApgpauKX1yv?*JN8&Dk}>iMpGJ|L-!(B+)n#B z<$B(o$Z>OY8KB&8_x#5n9l0al&8gxx1f@75*ZEHC+12bI;Qaiz;@+%(m=^r_?v?k_ z&VH)0HL>)zG{m%b>(m*}*fI+>KeVB7y5_{AFMcSis0m6tYB{M$<;qTJK)%G8Yv$xu*IE)1ZM zY`4+jWz<}Qf6{3rONF(X*uS7BR0U`a7G66mShfe`|JhXCoY_+N4In0* zsV>iA|8T?h`m^9sUG&w*EhPbr@_?s=29&fn@x#8IGQhwS3vp@uP6}N5d@;)^=z5sK z!X$EUMU{g-JF-%JXCWO@cTRK1W&c}hH$_ZaBdW1QzNMmMvjB3^^^Q&5pUdk5`CBh35Ol7MG(yj zVIocu!*?(VpY}?4z!6aU#$MZ*5AY-ve=-LtP*STc;~47UYl@|L1cZGOK0W5Bg0s47 zNRmbt7?9IdEKh1j(*hzYAwztdj;x}DbejNUO*QJ=Dz2~cr@f~o882YFzc|c?Wz-;f z@q@bw|HP=(GIQwL=%3r*WYnC9)k1Em2X?paMIaL$F#v;1M!Jx{H5RHBCX?t_XIVCt z=I`rBq$7a6z>LY^ar0g>+2aQgN^A-2j@y5CebO##vbU(sb#~M1p}|ZjODn=jsSa;j?#oM z1)10SR)crA9z+&Hqd^i)gdMGEnxsZuztZjny8s#+6p%G3kA6_~Hruz;T_^`NCscOX zXu3k$leT@ra_SLp)flbkMEgL1a9T6*^Z(6{ZCD!?+~a;C79;Z&tig+=%j!Y1 zoD6|4=m_(^H7QpEz(ee#0H%*zlvllw`9l%}zh)reB?rA0FjI}Y<0**|dbL)R#nKX> zP-=y;(a$ZZ;R=V`o@E@jD;FP6?YqC1t)|1#JPM_oZrwO~iJnG`eMnV!8>*Qo|DaAJ z22@XRS+SJpg&?0*hD6uFC@R3SX9albSd8Uj2tfFc;abkKc;x&xrnt-=a6zE9^^bSL zXQk7tq^k=#)We9vS-!N(zUVgyxz^d44i$4BII|vEld65GHf}eW)sZ~~ z=`YtgG)U2Bolf}f#1AaAX$n)wK1&}zM7|zvdVf8Z!y)=ACqL{P$s5Ik+=Z2BO?bCz zV=1c_nbgVgos|fgEWq!O8k?n9GN6w2C?Y@UMO<4AHA>I)tkrl^`oO!XCU)#D0h*3G zS(Ib29MHjJHtpB{jf?VW^?!N=4*R9(Mr`)d_4UB|i!({h&jzX4HpZH@mNP|3{jgm? z=4>fKC0!MzT;br`^9*i$n~E~`e`|n`Hs<261PPJLQpf^tH!-3D z*sp!v+poN&2Q22-G9gf6maa^NA&0v1G^@yC?UU|vpJ3Bog!pI#Gf5#acdnm#V&K%D zBYr-wnobd#6Xe?uOyBr@&ZL2?vI`80i~_^o_u+WjiU|HLlpA1Hud_ZGb+42E3f&H6 zUzjD}g)5r7SIo{z@ogl`$Xq8jqp!`vQYo}Q2Qnx^Ke>K*5%Q!`cmFxstmjpXwKMO@ z^v9nko2Nz3<9aeyxJ|lhQt9v^o;tx{eGT+BiciM<>7&~4U~VJV=OH}SR|P3UF*e&& zhu#lax?*;(2(ONw5+`H;q@unns?JU#9ly4CK=Q%tli>SwcV~^oBeCyl2@|6(N!Oyz z9wp*g>N*#*Tw$Q=V68Qf^Q&k0EZ*$D9^HepxslZ;X|Gy@?eo}n3-gOZUpj0K;*mmF zS!#YRpQB`D8ICsC3to=13l&Xei2O8c4lR!`d$XZD*-=-2QJyt7h#;~YSUt1$pBoK% z8H;6En4ect8QS!yAs+j_8Y1iqhfV+O;zB6aPp_uTeEzC7#yDZjV4IvZne!)}6&SkP z&TaUgPd1mqw|u8azp|pn7i48{vw(3wRmB#(2nh;6dL&+C1 z06l^}oSU^Y<)r6I!lCZuO4}Y+@?V{R`rNbS+jpqBI5BY=*7H6W>71`0PZkUeAn(Vy zo(j+HN0qt)?mLhj?6!$FwB-DUF#=wXgy&ZM9G!)Vb%XH#()|=~Rq0 z{`9j>wO%k$h3bj!&O;T3BQq8&{o!xh3p}UZj*Ny`uKtJWotHa!4oSyEo(zx4=M|G{3@-(#^FU7y#!s5W9# z%hK`|lHPsG*=95X7HfDQT0Z`Ss!vy~;`rQdEIS|pZ zPZH%H%0Roz16At&RXNjcS3fIKBUh*@hQcTS3m&7FXaSinI50G`uE(Z zPGW#185O2{+!>>)>9(&$>LTi4uq(Pdoy~23!)^c2j6=~$5~*19(N|Mca*V;N6HvoP z*IbDn-G523J+tswiKhBHbicI|@@nT*pA#|%b#ymEo)itcPJFD*5v=O#+aDPgr4c{| zFMV^CLg8cV>9_WShb50=@#kRdzJmG*(*R5kqb6r_qp8<6A|g)2-FeZ! zrGL<`V=F!b-&=gt<(48G-@aE!%R@#)i|1{n&VX4z$kT$7#VTrj`H0mWEAZ@_d+`Cr zx}R6H%c7Ya&3%j*ODm9(AR)5VagHVN4 zV;o7UZm6VfMBa%-V(_!fNP@v!-lhTBUL_BjZdA~n3~?tKw3J}K`Cn7uEtx@W(%rB0 zHi#EG)aPZy9ZK6cvQ((=(OYgbM}Fj&2K$W+eZ`spgtCOk)m1l$+1taEsBjiI93rrm;b>@(dD;#_Xm-GQn z1rD@_k`E~@ssaC!GZ;Azhj{a^ZdUR)qeT;vzGlI@i{uxRKcESFrky-VcsLRyE8b?W z)kaWsfdSq2UaXP=bki6EoYe1KT>sOpK>LoqkQFc@z2=t)qWC4i)5NB2jear zlD9(Ch+_U*>6rhcsGmT%rI+iY1qm;dkv~lTo1Dtwk(*{IVesdE#48^_)4)K3oJ!@< zdX%(kxNm7su!MBo%hc-^KUxb>o;D=DY6BPGe{1)<8D>)9-YzN|+h4Ibj)$?qhEs8{ z7MZniI}Dm%TC|FVQ6N3>knKR2410~=cNJWd6l0)pem&$K`~0=qr?#ICLH15Cw^^|%}NXpB`zw`vUDNULrflQ!Ztdod&mHru=Aln0E=yoCq6A=x<8L$Bde==~E zkFtXpWTAcna0RK=z%&lSQY1sWL4I$aizwgj3Z#IC5eQf9>M`I`4G{(nl4`XlO{XW;)F}W?kE5Wqkbj#z=_gam{MO=Vz#TTaB zaA59v2-3u85l@b)CKIj0rt5Uq5xl)m#e0seg^hrA!F=0;n;^vf-;@p|xn5F0l)vWi z#rgxHz}r>db*{Pa%`sYw)R#FnnEkRav;wYO{p8NlV8J-jV*~hVg#XyYRZP0HLxgYG&=KPonq(fqWhNzLSDu6hJz?@Sfauq|8P$B~l_^67M6r^j}6 z)8h@pXtYRR zCcd>?f-Pok&-PJV!G9(Czm7{-#5{Ym1`2s4S8^m1-CIR6GB?+IT=%$37;=;<02<79 z69IFOa}^H9rUBEOJ?%9(XTFc2VPmmTWP^E(eg53LuHU3vg?rjjR8gv{^?FF0=s&=w zsMT;|^Wjz4OQ#yIr8WOevMph`r2;g-I<5FFRM-BkP@qm_++YpP5tQ|W*wX}>;O?Xb zX1(RLX87)?ZbNiyYJwI-N-MnSIE#0(*sn@|}4=;SMcK4mG zVxA7O!}puL=uj;QaL-+S^m_*Rv^cE}V#1)ME4q<7PkIaI7P!Kd-ytFM_!g_g=aK~s zuD6O5P{-;!u2D$_vZ@*on_CP3sD{zJ1;)pM_&wbF`KC(gABM0#p8uRar_y z;g$QKIBADcDZJzRkO7g}lk(f)jq%!HB@HcQCjReTef-n{HS3;a&eub&;+;JiFga39 z11QT*VnqMsYQ;*=>$07b#z2XV^YNlzrCY3G%2tw+EyEEPy+_m^xEt2iNXCz=9Dv$M zme{#SH3SqJ01`&Y2(j`yB9^47u4^|nx_6dJ5$3-=7_UIuDH_6y0#6;AqW%aS`Z4W4 zcEqmoC{VozDq`8VVUB%ND^Ute1MKG1;L9HF}GuHj&V2tGJ5|EJ|>NnzCA2P7Xua2Tp{!YE=S09nml=Aji!(4AbC%DH@TC9gK~0f za08np9cAq--{-8MF1SNU^#fK^fJ#fJS0CRAq(Z<)SU~F|jU-dkjC4QifNX*;_Jk{s zcBI{_#c{`-$@|n|l6Ci_AE`&j^hW%)ah?o7vj#@cs#JLZA3W(W{IO13`va=@9C%a> z75r`kH`{SnTgF4N)q_}S_2V36Gj-W4z;np*eUPMHg#aVj*P?!!m~47JJ#HTf(kT+c zllo87xWmH^a%*!Qg_#)ic!s0hLP+rp z_4p7{&8u|HrMSt|xZ2&Yc^RMn_a%$j!%Dw?`cPz$kGgA+u40p{IaC@C9We1V9J zAd*?;T;$W?;QT*_=IY%O@^c1R4;SZyv}FO{G4#}wzQnF}uVCaee2KYcYXKUc0qzMHg({wBUC1BeWKf#0c(eA;~YVu`O z`H|y!?nhmFPATxNS=#y?F9MU3&2;XQASwP%f?X=2)@#Nd_d{uDZdapsG5J?0o7D2d zs$4%g3Z+&ol{bM)bYrm8*&Rxn*X!t+J*yQHjM7}2`f-TJXMmj@Dsg!q03q6zU$(&t zihlnCzu=5G=P2=0>LQ5sGygzR+$muiRa1#sou<6&9fb~Sb+?8}p8sP4t&cX+GG6J* z2}uK;NJkjWvwmb4&|ZdlpGx;fEFqFG{PXVoH+S`~XVgM^E)dpos=75U?Xt2nQL(n-vuXp8Fn|i6ESS-KR zr!84#q=M*c)t<}lOQtds_|3!mM5L1Bb_=AJ;n|fM$9vhWFya-|uTd#SY>`Uzp$p+h zuRf{zyTM=g6%KZcByhoUHxN#Yo7?2LIey;5dY-Ppp)^CU2H94Gi$SGo&TwAH=L43T zS}F5-A^koHk$X*l@Dhi9T8~aslpsg5S`ts}RE~6n=DM5@3|p^w_`BX0nxw|t$DIV{ z9k{LjDT3aUCoR|{o~J&15)BMVS`I6jNg}h5=Vvyum>*=>aMWScW$CVeiRO078EsR_ z+WHzj{(Z)XJntt!Qd{2^q1$Eh);P&b7v7h7eQ4ri%tjwMXRuu~0aEZy<3 zS;>#>V|p-h=XPLsR!}e8)ADdj$h9iJlNs8XS8$5BP8=mtM9Z5Q@$|gu9J%98Ep5h&Z$EQnbuBM<2)gdJ#VE6T-S)gdh1jwUM!^3*)J2Ce(KdR@GDc*~$ ztZMokKVk|64-do`@iQ;y6!~~K_c92U9K=eohuTZBCq?&BPoz zl>fP8d{XHg+@f--cx!=seU38TWdJpPe#%P`XVUY7QrzLgvye4hUv0;(DlBRB>x)EW zVYErM~b$A^U$pK+gMP9#P$t`%~^=Tc--rEVMLurP*9qvsm zJIP(HLNm|k)5WCzAzt$uYaBUdqJwDpjiGHhXIZa;g4V|xd8YQD?39REAS?4`Gg}7< zEA)8yiE%2)&rzfj&yF7-W#4 zDP=hx=EYl$QXY;@JA`qMdDhMMEl7p=odsSZ=u~A4nH_G&xL{neYNUVpH+toiji-wS zlWO*Pj3z>QVqUNC>IHA<1BAuf>rsX>bC5bmB!FPhvgJFNJ9s6Ct6jANWvC&q{rJZh zEQkv6ftEP2ANfNd+DzgvS7J}|CG07Cj?ZGR>xXZoI%n`y#0Q6;Ji0FjKyx?Q7}8it z8bv*KT+#NVyHNJV#4a4>s$%z*b25m~@Lts^d6xV~9k?(_Ls=*A0a1uUj*UIgOy@rI zTPPUP;xBrkB%=FV?t|KgZ?p^ZY@;Q9bDIMW zJmiRmOFI7&Amdh>P=!^Njn-w2O98Oom3{Kh68@gJmW*K1WjWSR<#*xa=DqHMd>HET zt}s;7`)sCl36FuA7ooeMw}D%DBVc~nNJGd_K>jol==tT2$2foZeu z(`D>P55*ZBchZTk!k(+P9W#jp8oQ}koTWy`1gKmb@1WBVakpnOj7q}}dXt1o6~hE+Hs3_QDnpax zye}RN)bD|P4x&|JAg4>SIT$EtftB%h5W}S~47b+*@EDaE1h)96U zzDcIdTX?J_KiObV=2k;_yJPZ+;dg1!nN!vn3y0S7Q91h8%qdPazNl0Fg-JZfyd+me}k`U8tBukQ}5r6E?A6`8% zeOC$CgA=thmT^*fn~zxnQHpzKnKKtnExoQHG_-KLSIM7JZMjZaz{Q;nWo@~dC5g%_DNdANAd>cTi2;btVx;s%+ zNAdt`;(vee&HG4-_)w6qdQRKeUfPZmP|NJ8hiQ&yZmAo*s%n1KLI$S6D)xupeM1>T zx9*a~(6lFo#r}<~(*BY8K||tPJnGFGwPN1e;YBG+Hm)Q>RCV|IMjNer(RQB_3-9XA z+&nBF{ZZ9WhZ^HYLt_97pY(bk-$er*vMX%UCg&@N4T^8|K)HIU5dGEi1*SEL9SI^u z#ZiOy7ZUpZu^D5jlXjY{-@YY&Bd5ozmH5YbZy#C4Q`XBTXEg;pSBnFKAi0OCyqdyR zL==2rd3fWBt@ew3{gfq`dnkFILJG+PD7D$5aMq6L!LKK%{P%_s(f|_Rw19a5NvMFZ zawY;*Q2tgrM0dpFb<^6TGdPqZ=CPWg2P?rK8y5DrmTOEzNQ(1>G*`53IQALQ7Ny5w zVvmtxuvk$L^XD0ArJ(`Ts$-l88U`??Dop$nc|)~Mz4^qgyER-!M2ADwDJQ!-I$mB@_b;dY0Jy zoRYsg&ln{VA=Uop@oqXU{xeWM9#9B*mLkcO@Loy(?R7p zlodeg@s4#6j(DUJd6SMEex^-#7=OjzEr;E0YgQ3D7)?MAdI_5c{^#ltbm;dxg1l)a z;zrqD>N`FQffWHTsu*uPwdUl&2eR*-;Yvea8+2Jnd8lrP1U1#dIMietIw4_9twn$( z&yZ4W_PmR8q;uZCh^AP=d^U?GWhH1fH6QYaT|Y-Y?}lI?q6SUfSRe)gC$`bY+EW#& z2L26Qmh`SU^!!pdu?ZLFZW_VRt3G>z@J`kh6P9hdtnWu+h0EP5BB_As>S_@3ciTce zX1VD8%ae!SqdXk-h zaKreN@<0nSt^AKWNb?wlXi8q>kuCSXWYRRq3N*Kk~Ng zlS)J1b7<05>Q|NnZQDmfd-~)qv*;Swt&TRr#)|Mrrs_`e=UI@Mm}qYz(m3l+K7jG| zmt9ZQb#$_Jx|B;p$YbV2gtr=RNoLOw^Bqkn*Bg!rIC!p}@02|D=8)c8yizW)ZJEwq zuc@i7oXIj~_`+>q2n{@df^ zBdyV+$a+39=?!sZs{o!|;x3Wf6zYMdve~bbkl)U{m!1E2V_%!E2vf%jT_lm+$8zL$ zPwx!w1<|tEXus_Edqm0$0tp9AxGPt`)CqcKGU}(VC0^ntzFwA%Lg!$ievcwL(r@cP zbtzVFeM_gi=iEl{dgWZyc%S1;)WD}E=2=ls_?^KJ!T=+ly{6ISC2~6Cxz+bYnhYPN zwCd-_i91XG8UCtg+3oG(*ej>|yttZ`FG6z)B~6|hU;jEm?5jN84Kap!g-t z{qRs3jLCfT+SlCw$b9$X*Q9ZdXo~E1&8KAC^0^dKTY)Fdu)x_Bn&b7>%L6+@#zs)h zG1HQ7&}AY7Au~D)K-hb<(4JANu?&$&ib|ZN{ZRk zyLc($xHnP2d-RAv+p@{Omm61Fsx-oe^y>UO1~ucgkL|!^fTS6)UhPOS~C#|)Q?(MEaENOB7p4b2W_>M$=v9+Aat^W z!2iKg>iM2FtTGIZig>GM2EU?`U7%ad zR*KBWtg#8>rh~&B$kNz$rKiF~!07?Sw)lP|x~qdw7j4R*D|1{A@o5W4_es<6>SIP^ zkh^@>sjr>YN{*as_(uEkdP0+~6nYWkve*V~Fk^Y*m=NsDsp*2rd6=FOuQTlz_~cu? zJ?8$zwvM$u-Gn!iE$rKe?{sq$0N|%Tm|Xhd&iVRQ>A1x&eH3DSV_#SD0*K^yWVi#3 zv5N_Lessjn(fzdP9aqF0kc>nmF6bQm^GexGx?klJbt79_y$X}5K`^1Y78Y{o7ym+O zt3{hxfe$^QFz{B9{!OW?8F>Anp~$m%=hrU<3fr#$-5=_<&`9%pkW~2Zi&Eos9GV2Obc^n~k``;ZkNgz9Anki&xOuxjIlD~>%+4o5vjcg7f%18_p$RkQ z*$kx)x943{erd3Rk%Yzb6@$0m?^DFfqjX9Q~QoB zYcV*Xq_gqr)Y*tnX8z_dU{|mBLnq_j6(cZ$ih>boF;7KX=D>Bz$)P4l!-z{`zfY#?{8U-FN$Um@v|f=cue|a=vIsAx z{={t3XT?o&nDKZzc4(=r{@6~@#xh4az$PH0QX|{$5)b4Ci3l?lxI%WK4fPkrZ)r6# zwqS+cYvxW`nQfYEZqRMXor9h-e|u%}b5F0;Z0@Z(lvD=? zkcFXEo>$ZHFTfRdC>lM@Cn9ei(8eil zguP5<88W&EtWv}jw%NVFwx-U*4XF5fCp3lh)Wyai$_|%dF(7k84=slzB$PxH_6L*x zjECj6;qnKCQsV2lf>W><(R?p&U9x0_VB|z)*^?%87RMuzYYsq`zf%Fd&=(_l zEAR79h4>66IEmNc6N6DYEfJ%e**xWE;x8GCzFr=T)FBIAO8m5g5m`0X|KNCOZ2b+6 z=^$MpRGI=Pij70Jow&FLC1qzARSN@{p7OR@Qf*Uz=DO?r&49vSF*y|2KnLUs zXAS2TP^tyzVDj>e2;!uu3mXoADOMjRLkylh_!~%AZow+0U;)IPjnm;{kXI2^@` zP{Vri#U`%GRi{(OxG6x)u0&L~AA2CGOopujVuig=4nkm)M}Eh!YVuDx&!3tt2-#G$ zt_KyrMtx^53M(t>x??D+;V-DhE!Le4I_*`P21sNbj^*qr^U*Zb+ba_Ber5E#RO*^cEP{4gP;tjxt zGAhBIw7u@kgZD*?Wd*%-3wcmk747WUWS!-VWs9nJ%ZclBkG+giyX;CEDM+2q#* zCO&|?z|D3GWCLI#sk*{%fzuHB)M@Qp+KphjB*t89*7vSxeb%C=*>=f%z0P~{H`8VT>%V zbVUN0c1t@51{^;r)0ZSe(%h>s{an-lgrqs}i1UX+g%GY;e>Kif%&yQHKfzs)MqNaj z76^|)M`u0MgtD@be6X_w>Ggax8QSILUj@WaWH+>$UHb!sLsU(^(uFiw0Ho=Zt+Bu6 z)?C|3km2*Q-Q}*@nZYP8NrEj~TvRZFnfn?1%SmtN4(vTvd0Uh25YKQR)~0B%=A6*d zbR)6k&~-6V2QxuX(-^TK7zOn(&-@rAnK~O^gq7`O5Z@Yp8@>L5c!VBpG%i) z1?$|-?^hwsd5;nb)^L8Q{SZb%2vE$hQISjD&aBb_9k`D zL395Cxd63{E_m2S_9C!>>A6`GTR>5gPxpT{2?jO7IH{x{yaRXM`K$up;Dq`&ij4@3 zH{P-ZoAlb~i1G5Tm6ulzW1bNLfKCa|35luUnb(Qlka);x>2!>~3x{~#XG#r|H;*Gr z0bL{!NB?{C1L+Ny4TW-hu%^31N~}citcMv_DqDe+I#sF8x5TX1e$BhhrvMaORE0BT zwau#YPv3?|P z`_HQzS^}#7E)`l1T|T{hnrh3&DYE&Au$OP?6ZBxdaXQT`6n$5=Apv;5SgnD{&Nwn% zONeaQa*?I2l^Qc)vz2!PO7fl}4(`qZ9#_*GGNk$afCymdgu5J0z(JhIZs+&D$YAXo zB)x!4h=r&rr*Hx`Ps40v3DGm6nlx}XCnKSkx=R15#Epn#$8O}w88szh$7ae$;T4%I z2W6ZFg=TaK&h_tWEp+@xKcG!!y31CD%gy9JaUp-P9%q%TX@vEN^uRGbG{N*~NyP*2%8{7Lm3m0_C{mq^q;HW08@#%uv*S*~Cmnw; z=z%r5BVe!}^+*>Dr3l}DxZij~K&}IZ*XxBl%|!t-Ot%_Xe$}EM*S$dy-zqFARTz|l zNG6igZ+N%%QP+jhH5{Y&n+Ynssn{S9FhZyN`FZst(SO7_o~x1Q2-@X+uED@FenIOp zSX{`7Raq>2QD-PK=ZaI^)#K+X9sd^DN7gGFt4EKF_b>kaU_!S*$G#uucyKE&+2ICW z4{Gs&i4MI&LV^qqbt2!f#Q`EQ$yjTz;)b`CSr;o~zf$5w#D34+MCJC*3t@LZ6jI)w zf0rJ=S82NF*BXrrBHrAcQHv}x%MptQs!kiVu?}K;K=Ft7sbR$vN%3E3YX5a@KTT2x_LIHI+$OE_Fm0Fa7o-QUOwy3cxwOwpC4 zBAo?v(RM^tLLb@0$h6`h^2b4OyOg6gb*n~`$7Sn3jL&>zhRYRz zwp+d1qQP6J<$CMr_gDbE39kB5CMQld0CTMUnzd<;FHIvmg#}!i8CKHd;Ud%aU0M^5 zxQ1&d*2!Dknq|S}UNwCf8b-V^dBui3w7PwsEDB)vLk@`GWiJw#PJXvO1Vop9(AJlh zO2l-6*gSoDNbdi$r*ghNq07Qqvmhm}>|}-{-UE{Wz&qa>yPDrmcN2{{`9Dt{;&lD~ zSs0}Pd%#S1QJDR#S8QQU@}_b62V3ySrJyp)CQNT(#riJ!l%yI>66&uTORQ#{`g`BN z`*$wnw7OO4^;Nfn?)rWaE@|oj(lk`N`{~bYOPrS$ym9*uMO@~z9f0jlyRAeo@OsfL zVx5s;oJO_l^c{Y8oh$wIK_545PxN-%?Qz@M(&Yt>+vmmAnRQ~iE0v2#r`DLr6z_XXZeV(s3QP{8aDzj?mhM@nqo{TFBhJJT;G zN5hyYLK?tDv?qxV+t}i2FJbGSThp+4Ki&112SJtOj)he$clgmW>VcX>&jzn5DDv6Z zP>JnDxTAk+x#^SO2l$2~_M&XKwP7!u1G^LC!0f=SWvxqnL}^}ZwKr5B+1~7Jjpk#(EBAn2j#l!p^DA zaQwUrt^X2hvkheNIRA4y3V6)5_~fR+GR;!?sVS&xBG&B`V2NuFRC{z6heu8+c8`YW@&vC=W|}A$kcWV+gFQq zsI(l73?8eC$rxvIp9^{A!TZTGPug~ZeD8iyy8Z+_tAXE7a#`dzuQ5NL{*|ajj5n`t zao&y^H^Z;3#O<&-vYl&Y*t(}@Jan*TWa1fnJ+#Ssczy^&AjBX+<}z8)p6?$}?9#o8 zHw`RaDKPeICMDON@DqFc`2YU`H2?PnfK?0wH>+^o=IR5mkO7Q#y+q4C z($pPFc#(gD)-=C^CddB)1}#incLPgRC-Pky6@^j!sMcW7?RHk1xaLMZf{QOZ_*b#; z@7e`aynINW{^%xi!BifLXEn5EeY^YamK!p-vldFy7qoN2 z{sUN-FgJxQ{a?1`?I?)x##Aisj1_ z5zwH6y+4Q7#GU@Jb+0tQ)Bcu1UJ{zfCt9b;Fy-~1Vnni*bwH!l z)@Acbz}m{60!|IB&tLoJ7R zSNd@G-Q0;CO;N1`X4M85IUKALXiuY>9?f78BaBXNRBfdJ}jf?-E`h9U^KP3255`f zZL2ak0J)9!ysh3FV+KV6&rP^Fh@I@%fSD- zLLLwDUR01?#r+E9Z7C8J`WuMV$FC5Hd7etF@)r0xjV4?+T0p#$^1e}2^bJBh64#NiS_7hYNyWdhOR&*T~v8+GecqX4~^?&qMe^h7dl000f*1sUt<+(!nZ*vWtx zxdkckCac0iYi`I={d-rUQ!W)jbf-Y4bCKK_t`MS2;kmH9 zp8R}&ah_UM#^z6-Y-(}`ah^qPNObaE-0i>+Zbtk9%Cbqe{ij{{_%HUg{Fj@ul+eq4 z)iILsh@<4qHi$0o@z)jSeVC8u3ksfyp)d0svg6+Q&A&->&)_D92O08<4Szygo?41; zytS?#*i0dQd)B-rof!`S6Dd$HWAV z+lm|=VF4>|efdo7e|ExwVIW3gqk2kOC1mmp57jit-gI7d+wjeDYF_-0t|~dgu^z(mRhPfCSNnGB%IGYS zwy{2k&vo~cUuZSP;PAIzt+AyIbP&VVHc4ZW#qZ3vV+SKM`;^VDz2KTno=^D9sB)A7 z2o1QhGj)KxxL74*JC_xaEkS7ra!j}K&dh{CwXFSMo{b8r=VKa)0RzS5O9wnY4rve1 zVAp4=Dq#?JsfeHi-%q<33I8Wk^NBIo9egRk{Qn`Vb(meEc{=A0Hsz=z|My@%9KIvc6|C!5LH zWU3Rk;$Uo%BO>2AM>ML;i$||psYhEJE68>Li?Tx*tCNUio5T}`kt6_3E_REiJHV{5 z)B~ zvXGf?6XyQWxzgPq{=mn1eG$xCkB=K?3g)wcd!{h(?8w&h?qU6AH^fyOZ~=R5=Q5*2 zf@=H`S}_Cepw>x<2lkaDAysIjeAX}&ZRzNazAt=wY~F9#E^oG>w4SS(F$X-6@-&xk ziWFS|z%K%>+cJ1m!55 z6^(_Sxr%ig{eSki@eb>kP++w{Bf$3512X6TrnCT8fB<-a2~h828(;gaRRT z^Z(@i!;9{v{S7Z4cZne9B1+{-xiK@CqGIH{)}E<6 zXqf)kQ+~VNs!M%;`Z@3wh*xa?4K{1t`>K_yYB{9xN%`19`9Vf>4&Vi=RW|}%8f?1{ z;F1Q^>YhOpOIeoOxyQ#2G^X<`Y(c*?wnFBp*P)y@gW?g+ zWmS{zHK#evBG?m&RhS$jzT}vpklA%bYF4!eZeQ03C&xa)<_9H7_Vc-Tu^B_1d(8YY zs~@>~zw=O1pT~rXub)==K<0*~66e6iL*g7Z zwqIRdpbp~ou^d5iB<)o5?F_SD$J1L}b0-`x>3^LtWvia_sls?FB>fjl?XO+qog_c; zjMHJVE1!+b0iK!{pUI5By_>G>qdD~AwXLA{g4A5|^q;`i7$biAGXG+yjI z+nisKn=Iyw^iZuEZJHLt=I^fuAxm)@M}KVv%((z)D?^$<)AnJAK9C2uA7}0@VyXUY zz`2S1u|=0qKV4d812Q0OzxDv24FI+6M`knx5m?+rD_Y;G|6+}Do*GLu&g#knmTrBo zrS?M*xeWp!B9_A7f7F-8os^RfVBqc*>c-r|{-N6C_|u)2{#%xg_|bRC*s;I-kJr$4{)G&ddeqk~e9t3=4hp<@6_YNJHL!M?EO1^$kcm*o$K`lk#UzS;4 zl0l`@#E-b&aIp&Y(G~FR2BkcqCoIgAh&@#8`nl=^`@*wC%quse=7k-^1T1Vs7gLz`&htvFKz+Uqg0-R zCA&ox#4sD*rabKMrOm~i3NxU|Xzl!=BaJnBX5;DZ!;YK8txS&4oSLvHM=Kz_?MJy? zJ_E>tJz^lb(m?Q1%qlGyNK3tpMneW9g&7HVMbgb|aoWM)DM_17(R&z+vM((?j4)QU zYLGt}Dv{yts1}aisGckd68~~CPc*e3)wroePY8Zy{`>LH`g;j~wF|N+X_FZ-NXwxJ zlHmrpHCG6y?`ga0x3Q3%%ikiGKSkni?{j*fyEOO9ux?n z3zmbT>6|<7?g!hER@gCfmenj!#Up98BX>$~Gk2Mjj~&0OQ^U|inhteBx-TwH{N%|} z*yd~0?(#b;T)vW}h!ZXHdaF)-`+nPrB&S6DB8om`QfRgQ zEz!f0RZTG#z57U`8~e^23B~PnOe?aL?vIbwgB_|wgHoqA%h)r4f=|tV$F>(9l*@<@ zS?*mQgPCkU{bC>)0s0ug2Nu~Tmh{CgAxiZN59z6H-L<(U7^f)-(rB(dU{-IIz|@mg zyds8CNDIY@Vh`8*#{Q^ka#9NcObnJ@!kmXLE3$iv!L<$SI*Ak^7)>Xf7Ox?KGlt_}& zPKOt9=rdZaMOE5qmvBh#Xse zf5&EnEn^=51PttDcI*ISTTme~{ibENa>;4q$qgm2!)+pe&+{NPHnp=i;q&jm{>y(8 z@TQn#BTAEz@M*s#V~~II)qw<+W+(d**XRN6@_fY;TT2B{Gc1e}(a>#_jSePC*8j{V zbII?D!<(>}A-grUc6c!q$R+E48P<8R42aWpv?QWJ-qsFDl-`)$JIl@pj@_}O1DIHn zL^A!Y|5YuH)2r`Ts9RbX7eQPnKWOvg726|b>;Rf9i&x*hf(E5t_CeBxLz~C6+BzR% zCGRleiFF>R>Ateq-ez4Lmf$^wS(W$^n7GdFKdy(^d^noT`O!hJKF-sl|76DL{q)_f zb?T7?VANl%&-OsII4@B+XO8(-->(*>4gLnvFd97H-FVilwL7@3zrUPmnlkc zH3wup9{yY>iVb*+No#&>0>Kf>ZL#prw8uNk$@;$sv{{~gfMt(*=kt@rbSaN(L#$mx za_TN=7oBvSkMq5y)1<-6lR=5WU8hu4iw8XOPe>L^uZe|h#Au8!vI6C&?BHd|xqW)= z=9at+_=3#m&D@{Q2e#=g&)|GTL|Tuf(`E$NAeKGAPD0+S0~ROuQZTR#^o9RUEf3Wla4CZ*P(=~lp2BMb*v*7z?r!sRu9VUpN^bw^en8w z1(_GE8sYM#10PDd>Lh%hQ`nU2o;_{4VcR-7i~CM}8yD$v>kCm?T7mj`5y-yw5lOA( zDmh2eEKa)7+Mg=kglIVY{epkVH^y54+MY9Jf?E++Ut?grl6{lL=4d;8ML5fg_by~J_~G)Pm1Ng&)Jo7&+`R@ZO^4sIs5VqW#aZ= zhmpkky&vtK)i?BRiC27C=|LkO$Y2ET_dS57*x(Ob_z@vB~a`4<2&Hq$?XX`4Vj4=?mv_~($ z#nI74$F4}r{Ra$H^^H}Wdp?Tlv5hBaz15umN~Bx0E(#XDVHwdjxT)zxFX34j)98o)&%1HG;KWqo*01=!z(DY=gl{wV8(dBgERnxx< z`r@yLo{N@ad$o`ex(qctzuh%>%S{GNY-++)Cm8M+e!(@F)JqNcy-&~9g@`%kFK;ol zM4%-DN`lC6nfer5$72s@rwWVwSEy3MPgYl80N-%lQz!WRbkaqy?kqXz>7o^Z-c;!4 zB|r2Sx5y95>D4h(!7&<;|g+Pf(_+X^bxJ_psd zl2;3-N%E0PGZ=7 zry!$$J0u>XzroCUzhZeJPizwH zTPg1Kw8TxPfG3dIVW~sXGgXo5&#|HOz~bea09M_Ukw<&1^3K)rX#n>YFnbqO)NW!= zAY9=N%d(Pamki+jQCy!OZ4a2`%^Mo!e!?;5()l!hPoLC|Ny@LCs?Hp{F)Ekvvadth zxkpkC{@%a2OB~gIneJTgi<+5L*VRRH0?PyFX2ssonU>D5;JX{3pz6f~jVLb*NkCrZ z7H|hf+<*q7;#UZO$8qiPMSlBn)Z88gO7sV9lCe<*Uul5UJ$2`ptpD-RdlG?rf?SK& z;WkkeizH`GBRKCAshiBf#d2|qR4tIEFgWDi&Zkf*^`Ao?9>@PdBeZh=X zB$L1%Irtn!?7Qx8vSl)r*$TGGiX0U&fIjCIyb8$FXak*z^pJsUl>|QT2BkH&kjU~L zSu6Lx@)lN!duaP%Wz-}*(xt++(wH*HD;rSAvXt$f98qey_qt4k3fNX%-ePCd1$G0FU_G1fw! z;(UHf_fQb%lS!UN&KWx$=KZ6V-Xd(;TATZS_)cvLakzcg9P==POAlojGQv#K32>`Z z^E&6+^wQ%@RKEtueR@M7+i;fer)aZ88aBR??hNC@WQ3Vei~xV&z<=*F*!kjjlbrK~ zogos$b{l9(?0z0^7an-$i=2fNYO+|Y*8eqhoGK++Sr>jgBXZ`gyeI2H( zjr-wW=g}bhA{Xm!6MUK2ats*$J0rBl{r+YRiOc{Mw5IhLbh(qN{c4VVpV9qj>uJz7O z{OgRbbxCM}mmO%Lth&B+XCW}=hXJ^7szb6FV?|GBj^-EXR1%wQuC}N=W&-int(rut z96AA6{~13so(fdDl_6y?wPcI!4mML;R>r76pFFsI^2S?eS358pmUHQa|7Y*fb-ocd zS~SWnF%?XvwqMQ!2Z#lfRgqhwbCCx;_xPO*4Ys}S<90~xGT+U=%=u&y)Y@Ajj~t8U zgMv9ecCmqbR@CWdouB#ke2^`fVh<`|!>%gN2tQbM{XV}o7YW4nim3K!>SsuU*(>pl z$48I;w11TERIL0Il6fTg|A=}Ew?YV?v{{FQ94vmi3J3d?yjX9MGzFE z6ahs-q+^#>Qbf9z?yd!v<+=U5f8Xo*2ll%5Tr+deoY$E%oDzi8*!F0IeM9sXaPG1s zbKs>nFrVhx11rG8X95)eMpU^75-~|YstX*0OvDKwnNu1acwm?1p-#3rKe7xG5h~o7 zDu42%2T>RVNh!;zC<=i+)6HfGEKkSn=>Ecu1S;BWg^XovEdxX4uoeyV%~iCV4&b}z z*nF6cmTiJ|Upl1jg$}Wa&jO}B1(3&OulI0B7BVdNfz3_?vU)^%N?_P_r~oi7jFIP< z;z(;6ARn{37uEnXRj;n;|60}J&C)j?Rr5dNwfqu&((hGMCpRT-ghgU$^5<$0CBIO1 zCFky|_f^)&u~_82`(PH}_U!>`|K|!#AfcJ_c1!@q@Lyef$b<1~ z=MVt=pfWm$co>#{0ZN3gc2cVJ?^lrx?-7xo?HP~6UtnShblvGV*k|g!xql8`eR%n3 zKOq)*$j9vWsh!*9hQgMEFs@46Yrv1f&#(s1qY|)*?0+~azVz*gG0pjUn%KNJ!{74sA55IULQYAt4J&P_m(2JZi*KK;U%4p! zYw8NpA%V}vWhe8@jb?=&oLaB~3Z%u3IlsP+W8uWZ0J}uh{(tjoRb@Pp)t9@I#q$4( zpCnNHVlD6LxrYP7@MZ5!O~O7d6UFGCtU^6UqY4y zt5Fr~k3wM&EgOb6IhScQzZLA~n@uji;X7C*QVyS#NoU9e`rHE?ZRb>H_*-Zz2|UuC z*s0q1^zAS|KN44YKu^Mv;Lfj&GhV0umzbe^LB~z~*ulYZ-PV8jk^Lk`V#L_^y@yA2 zDJ@eqc~2NZ#l3l{Kt?YvehL63Kp*fI=r=qM%{;D?_L}&x?+Oey401`oQmo*ry_f{J zM*!*_HrNkTPlFqAawn8CbhEZr%EAi1cN8?(@x3KHs^;rV^csEjA^i{EhVUDD2c8n3 z-I@B-S?rFuc$KS4aO{o{`}pm#9Q7@U3-tPvKusS{0%;j3rE!ZEKC&Snfiv+W_(&W! zC}~m{jn&(o|=`C5W&0@(^WK~Zu6cE{gj zF4?Z1UjC99-SeRQ7a|3h?-d;v3zH+vf5LypYYh}a5+i-g8qA*;Xinb@=zHvoMTmXj z5bH*~9rPY?W0@d+<`QtMW0lg0x)$p|MWGT&s+!aKb3)^{=4XByc8v602Rx**Qgljy zv*$+0rke<+4NlRb0|pBiSkia+!TG#|Y-u}2^sw5UJ+yGg#{Mm9%Q`j*xQL~c1|&^2 z+vEZAcp#v6;Y!ycUq|IeZY=UT2QJnX^NRvd>HX^ig;u{jX&8O{rNG_BoWxWDI3`P} ziDqz}lbW{vP2#-72o2#Psg*iGM>N#hx&>6~J1#i2{{?fU@8?=3VM$jIfwJC@Ea2us> ztSq2>7%KWA794mj+_NHQCj{)=6^2?rQLipRHalZ9=}{|z&Be=D%Ejziu@Qw7bOx@6 zG5Q++Hq47%9xGVcOP^8Tor(U$g(LQ?zi{^JNZ1P&=*`=uxlo!s(uhY+?`y)}hx$VW zbUssSWTI5m3Qfd}Gp~rkcy6MoODQ>f5HQJlT;$8c?~(U}{BbD+?uEX7mPZF1_A;YM zU0LS99Ji|YDU_Ue`^Kl+p*k@8C5_PD=xltF2$S;4tbuFy$PGdJ!-;pGtDqFd25Gi# zL=2>uP#dWQ88A%>E?E90?($5>?{-hyCHT_owwzJ1z0$9R*2!gey#{$r6P@keG5Hdg z3WQ%5d@4#3&iZ(3mU*jsAu+PSg5<)NpdiZ%&YYF^m}{Q%1N`eo77fUSw8Bpj4Q$D= zeMJZ#CZr(+O~^uHIv3ej4yyb*j*J4=So_KQjGpM;P}AVF(A|7q^>I}gYRzsApD-IMGtN5U@ot+_ zswAdyn5Xd2oLU?hp}aM~jL3VS!5cohp3Bg2jD%o^LSFtKBB!r*7dGTJ4t*GYSpiGy z9)U2Fiqexg0U1=!83qSq(M}6AlBVzSgh;gAl6Vf*`p>9p$>djnx!z2t(+x#Clf6u+eCXz(k~2H#Y60vcfVrW%$iF5}i_j3> zD<1U3WR^@+iQ!6UBi^WwdN2+T$-(Et)%kEgPCMyzct773%?G@19gAnPGbouKu)k4S%FbUg&`~78 zNd;TX?Vi|2Wz&;HP~9DWa3Zabj_=buoOmiO+mu4z;IevNh~C+45Hn$l8AUz5Wp5T(zGp1Ojf zL=NjDT_yjg1)w+0t1sL*O{w5OpAoCMeIyW;tPU@oEnqYtw)t zu15j|Fk!tlTc4|E#eecd8e{Z+6450&sU3v>()T14j3=#609MH*toOpTrX(vVxzr!9 zJ_)hYMh0 zR|+0}hzWZkg6Hw=Ok=5vFuxm7yA}sHX>pbe`YbL6ADjy;w{2l(qfc*g8xI@oj2Du1 zy^d_hGX9izD#qZm`4c?H6^!9Pb7u|&2={iIH=t@c8rSZtyUC$MO}de@)<_%4>cU_% zo56}Z<_=^t8}8S#^FEb;^XcQ~xJNHIJ$1c$kWlQfAEnB|WbgP`2&pMr;*fNf z!#`}pxv#&r!rLhH6ua+yCf~?hM`&+F^@a6?WVIMv*NdszTQ>YQ-|m+z zo87j3s5=$%sfY5^y0qb3{}CVd>@~NCxO1ZiwYQ!cRdu)ZjAC5!P2Qrl1dEKx-lre_ zw|jucIz(E)1)OEcJXN3kL(W#>i|45|q@p@QN&^)Va;QGEmu~(j07eW{AkAj& z-v=ZZ#-ImVXMdWSEs{iAmdB^bo5aoi*gw7Oept=;18q_MqV%5%( z8R0$1q7zwMi%Vw2BGI#aE+E2Wq*ST|VBZ?pc72%m{nvi(>R3j^{NVT|Ojc&n6NMXR z*XwegP742ALt9rkTbjOmlTo?{*1=o@x6D2$I83klH~d{Dji!qI7?PWI11B(lQY7{F zBZoZi;9R@l4uyyyo}r+zIchEIj|-~}_KW>AZD4n3Q`79a=q-mqGoRs#j4y6G%hxyF zCSEu6%7w&m^UCiYK`eT=?QEjklY_zH6v7xp_%374UNiHG&1U8F0kFaSG4J zgPa*ee&Dq(sNAJ5e@p!!rjnpBC|I5z-zc{M23zyOM8|ZMpf$JNeX6?Gy8$JxIGeza zMLZ6K-WIQJFHp31GZHZSQTqwt@$o2`+2}xRH{-Hq<0ifYXcT^?qlZ*qowGK@)Mi1CIZmKgYHcAZswmxieTtrT=zKptTb@B|= zDB(|$rc67;)504Ig@Nxw$S#YFK0;^?dO{ZO6`b`Y-mfEUWCEo~z7k}JOoqR!3Pi0! zS8(w>r>*QyMgCZGGu+k2cN#iVTdLw^>p|3Nm;j$-_{A z8qw#C%wDfmBe}+(qFg+Y%`A65csw6zdemjvLm=EBKPj@=Hj8GADYgl!p0ERdY^eE;@{IRWa}e-&n`J? zbeD!66aa=7INs}DVP&XCIE9w3v|akkBnYYroMk7Fyp+b9D&R0Zh?W(Qtj++V{fCA2 zdys!vL#g_n_Jy$QoNBJg=yO&>!@1;Fln?04ZUY>OZf#+!b5F0%*)dxts@LRfQ0&{4 zf6cM~HEYJxiLu;Dd3my8%{S~#r-H?`F%0n5P$WAkn0N@;R^;Jaor)inE*jNoBPF*z zPe7&>|9kmE<{vSzoW|q}@r7Ir+?CUpJbcdz#?k1XdCxVo1z+0esH0zUI2wNytGqeQ zJwu<)5m~qYlp)*Zw#KCoIJ2%Aw4#@8u;zNQdR2P)FOP~$Hvjc8%Jq1cf&{OMYiTCEP}%2tl;9AS=Zkl z*pRtCAuV+?Hvxs_neFfX#lGiQ@3he!aAFeVJZuEy#QiEFpCOI3>{Kf^Rd!@-dcbI9 zU2$`LaH&Ixvajms#+-0%{PK2hC*D0LRp6AD_Pa6o^=;Zs-g_dsoNf0Mw!#tkFdpLc zQ2eQTq`L;HXIM{+1r-~oA9c3G^>VamH^^{>+>Is~K&9oz>o>Xl;1jzJ3;a@HiVt?M z^%r8E$EjyXoVp0g@b$7PstU{EsM_lWBIa&dtTDG}v zm0$R+9ctgOmQrY_O~6!#OsQD-(A_$E|98t}Mk_<${mJ=GuZ-UoH!E4=;;~3xbRxw; z?Bbn>qA+@3x|QlzWx=g3Xd|Rd3g00{MF{~=s0d2b{s%?+^Bbm>iXME7MW zQz_<(pvCHI57o*^K#w1jqQH}BN)2Ic*T`G3G$k2#d@x5Y!RZC@H96kLzDpOXnH$KSDu$^>p-zlKP3Z8lE#R*Pg!O$ekL22AeP$EkOU-!n zWy&M7rV^5e{DhBv`V;jhovEquZg1i;p`E&NPlwaYWq$eGn1b`VbnXO-V^*M~XHe5q z;f@#VeZ-MryOLAJ=x6ahCkCEVdjS?tpBRM*U{VQQp&J;T)~O33^Rfq#1l2lXY^0jA z6!t_qCc0t~;1@)`R?iq$;2L@fvRyHVrY_wb_DA`M1kZ4vY(j}57tw7;$~2>xVByak z6NUqK?&#^x&%+aKswa3BG&_H<;hd+Km(c>)t0r1zSVH=Xb`}Mh2 z^sbAns)Goqz1ogQ!!W&!RNcr<9kB6vWRBVvTa86{ve}rEDSZ;I9&J4aK2fGu(a-}s zKl}x68w5Z-9EDzmEE{~;wO3!N0tu+hkVM|>N;Vpw0w(PAe~S+315JtU^!0eDvF2j$ zgBF!8A&53f&OOf{Nb$X#wY8bo(ML-7x_lq6VW|^gr&zr}@kCF@6Ip^`!=v}P&LW^R zV~-(MyS*}=(j`g$V5b={MBatwVhP!Ls$L-4??ND#U52XYV(Q(PcA9&h`1_1rGCe`| zfjT)iC#xs!5WF_P*$CwAfZwaE4|=+Ibn!PU6Fpg6Z(qrNEHGSQ`gxi-%8UtdZA%&z zaXWYOSB>+Ksyol!WZU%P^4$R(#CqO+GtgDV#m9h z9S_|~gNW5X4L=Rv=(LuwPg_5q#j&<{Gs;1~DL`f?#j)FCRvd8a_v||qOYN<|5Q8p} zm(ze9ILRd27%IwF%g-rkb5>s{yjf;`x-nnQ%|RXPPeg$~VG3$ZN5dYkBS)ano9(DN zIz7e$mjbUhrD5qz1zof@O`wGeT(3iU-TTZ?+}sZ3Zcg&t2$%e}zeFh?q7DvGl=W=D>$njo_c;Co!&glqNz#H*~P_G}vu@j0RuRmtY@a zwB8pWK-iwp0nFKhO1CO2GGMqghdP-rmimsKWC2>7VAm)XsxWa4f6!<8s4BaKheKAT;Gpw#DR4@^PZBU*)G{d z-7T(gtUgH~TX-*G8`>V$Ymg7NiZDBVYed8>_m0Hbn8@c1&bmW-Ra>}b>?;|&;raD% zI944sgJF;L4C;K3-S)69>8a>R19_Fg+2oVIqdJuf+r!9d5+H8qL+*Ha>(a~Kgo#`S zT)eSY@83zvk*K|&3M{o{V=vtqW@sDDvVxSut@Wp)-wRxD5YPCX7BOLOMH{wOywF zgUHKK?0Km)HO@p9-G7xuGhrX$zLN-e7Q)X75-{FBVi37$$jyXqw!)i?WF}{5se*{G z30LBnG9InQytLaVys~C=)GbHh?|$?nwm+AW%^ zNkr!HgzYyCVD~$~Jvl47YA7_=4rOZvkA-Gl;60e$M=sl;q8Kdv2qqwSh`#3OjoUx= zfGaD$b-0tn+3_)R&^!^Ol6M4MeGHy>Wb|s-cdDmnU$eWqX#v&Ir+`~M5=OwB6g~@l zcod*mg?B7@`&06il|CoziCkD-g=(^d5Q}aQ!^$yP4bz-LjpW?u(hcxX#7OCZZ?s9! z?;tOmr}Ef`4@8%G%h6FXz$BEC^+w86U8D+%XTBt+zf0{(=^W~kC9|# zd$N`6tpdYSM>&Fyk58oBU^clCY~fGm^O=n8W_W%B2?jJ|`7L;evAB$`-&QFWCo{GM&9_wx-s`FOjIQwTAW%I!~y zMy7dd1wkxrhZ#1+?U9LVTE`gaAC?C85;!URk-dj+#&pQdr_Arm4}WJ!s<(-a^B-wX z85=`I@WR8;jh8f{%6%gwlV_{k>6@skNm2Q`7qoI#Gv`8imTc<7d(*Ogxr*@U;^jgB zoAbC$`nO)A85FR7exFK*mlDGh1*At+INT?AW;DZ%Nz8LJBkH*06E#^;C|lRef=QVG z2j1T8dz;jjyuV!^-*MNDRIq~$RU%6n66+o2N4%7Gk36oN8=v9KK=9p0%ku$F!77&4 z7k8re!Q)mpe$c{jK%KP9?m$=7!(y0a6UcZ*^{fbB7}Hg-AY{!sosz)S9yfrO@#)S_ z98X7j>}P0atPZjV@ksv8G(pN&krXG^6naLAcX<+^>q?+LCzVK&71a^W zG1jSK&8oA!KgF{b@?r5bzOEVeDG;opgJKVf@a-AA{cl+bdJz1U>s}yQ zxX`7^O2gZHn~cwYy)b|u?U1b(z0&KwHvh`0tR9}_hu{mmK7~R(1$`ls^GEDhcZwE0 zfuBCOv4|`5lL7gl3mWM#E|Lhd&JoGxu#8A&+T6mQIY`J$+t=*6xnvjL;B)g6;%L-m|KYOsJ|tY1%1#fSH) zdJvQ9#pc7X=&6T79r*;qbsLJM322MOz@Q5%xv*jYmgAfi7(I?g0yz|yM*C@HiDo4N z<473zRDm#LKhMQhQE!20Qo~^77dxK_J;6=@ks+~K!nJJA_0^juoJ(oE-z6x445G{I?i>#Pe{g66oUSfBZO>vQZt?s9 z%`m5i80=dB5;ZPaj;6m_=pcz#hfos%b{AKg7>nppxItN?T!Ki^E`71W9<+33iDLr! zxo3SloE(J;OL^}Z7~xy^1sb(*YX&URVc+)+D25O2mbJJptsPTP1})4ooZ6{x2l_t8vjyR4p}O8v41%79EH<_%!+wF1`gA(?n*r8;aHNZes_|{XN=fsgI5C&AaZ}HFmYT4aiuislcPHf3x zKzi(u%45g7e9M0*9+|drSa`&%Q=7j_coR!oFj99{R`n zW%sK8dRf;yv%a-M5qh^YiosGdQb@)zJnt%+B$zd6je!@$rrbbVxo?(ALuG=_&8W?j zTkh*?R+J}+)Ptj2`F@vhzY=z?o~@$6XHj1|NQdn!Q5#_N667o8Wv!Xe6 z-S-T*uzuOu)EWvUeM`B~tZkC>w*DNt)jr9&#x^XjzV;EELNXv8!+AW%G_u|r3dSzR ztxYPB^ z*R=}KPz%~+5Row&HyTj+c@D!^+8w7_yy|^x4_@{L3C8}z#4|l!JoaDGW}rZb+4_qDT>EKW2r)x=6ZG=vL2V48d#qGqAUk5HBB8{Tf2W2f1yw z8QEuzTsrNnIXIE`iOVb4Rca(=`=i9{Ribz8AyLkW!|C~>)v6e}^Kw~dA$0%NKZr5_ zriyKQDC=Nyu;)<-Y-`Q!fE*XRRvbqDJxjE%hju0tN;*BRInFc&v5<;cGdvxG-Gmr` z%4^x^gIjK|pto=5FJ?3E4N2cG(B=hBoF?A4gb9`DHq);R3xW+Fa5^PvphTN4!m7F! zEo`~+ufZgB8{Yv@y$REl6}&3^qey$p-7GESY!FZEcheQC7OMr?DInqYYFyTB)Ef=6 zP|L4vVGTg9n|Yt;GlkK;GK4BoV9(C@@LH1<0oqtYZ~n zo&->?@2v@EnOlg~WlfSiDPGGq%DuCL?0**gj_BS;IDqJHoBMm{8sfT4F`Zt_!G#T9 zyGHciMtrWv7l;`b5sbYX`1VgBlU?>xMFl%$zd61VfeqIAs6MGh<-cOQR0kWRMgOpJ zA^aa!M$>Ef(&=@9{nsNCmtq`$`7&q|`><+N6wjA5xL2w78E-6nPwJGE78SF9d~0rB zT)eopU@sXFQ?QDCU69ue`rP@Y%v-&BVTkn0Z(SazdjMh{Eqx?Wk9>lS)tyNRBCOyI zwP&?fCXd!k1j6g~N#<0{+c*L*F`6fhVtEks7y&w*MUB(5)FR{uB(P`9kA&ovn)cp# zZbmc{1R0-x)451X5?Q2@jyv7M171xM0v@|@ZDVMf?P%}(R-bQ4 z!5|ixo&9{|hmOh@;ZI1o2;&rlp9BVu^^tBXO^b~hvPPAE;PP^wRoT2F!yKb5kWhD< z^V;;GH#sNSdf1qa?$Q1t^If)cZUvOJqNh(fv-C4y(8CcISY_%`}IW+_T}&P$YMUw&+ph{%~=a)L+~ z@5CUR=OfL&(BgdrNKt=N76jeSH90y&BeR<&K?E42)UAA%yHxKk9rWkn0iwK@_?u}H z8XV>TU(rAYBp}iq5fs&YmY@kVfN2K&{nfGwT%GC4P7eg!3`z@RtjyZ3R~+*6CL)YbkL-rhm;F$-3QZ)#*P@ z6yI&@z!AXI;o3#~ipmX{%bAvXb127K5EL=XvK0#vGuuXjr%l7fazi8Mq#NJ8)^HSi z^LR1DE>0Yqr7FS}|8=A2ZcK;4vbnay-#TPk6e{b>6_WsH;k#=^?LI_=Z>F_8#K3mb zV>df+_e=jrb+?y-#hLGRiWCp|2(LaAuJvX!?F8k07u!#0Ph~=6A6|Hu!Bq>hiBc|l zMt8^-5g3hE-$N*HC3>IEpq>W^bG{PZPUzL;KZI<>NOS^i;yUs6V=BWQMEa1Imw|Yf z-i1wIUhinPYiSJ-O|RxPP;A8=U;(V3m!OyJbB4dxIZVXrOCwrr6ducn!uHSo{-~}r zDH;18Ml!urcTSC;D_S_+7SpY|Oetl-ceb>{)O<<(@AJ8nP3IE?8zsS8ZU}JzjC>GI zOY7CNh^F*ojm^YBnQVNtN!Ba&T|#{@RcCQ-)g%6IyGpTd^rl~MV%EZR$z?lXKU!9W zn6t7>E;Qz(ir%%e%FnG+Xo2(oTn>Ol2|BoVuQ_7IE$N;D*(SVMuf_DN@@j`9kJjCKH9;;NpRdV<+A`!gRorjW1U0`ujpcF7}@32s=-TvnAsU6%@DtP=m- z9@Het+xNeV*JOtm*kF_6+sUvTS!qE);R~B&3p!<$lmFX`*I_wGuzK^Ir-O7RI^@1= z@!uA2{Z|?bDRTVA&R^*_8#S5fscY#!>uSI}HaO@@I@carIO zg(9~fzco3lq#wL~&02B5FF=Mp@>Er^zrX*loVV%`_%9qS%cM=mAOtUmZmHK}A)L>9 zQo(auAw0(&21RwF%kLeo^m)_&PYWPl(K0}2SVv;L!t2rSLn#IGQ`u~YmqcaS>C=8o zeOINT=Wtq^s70RZP0TvMsX#CtXy@SRJnu6Oi66iU{!FTfFk!pMYeTQKgi55;3F|{d zl~3zg&!V>mti@|T7Wqfg>^C;Q*QnnohEEMu9B^%wh`~f2v2 zowg$Xmw6sWox_UOt-X>Tfy6_|r~xW!o%HWT;7WELUe6-~gXyb-1C|-Y$YC%eadKM6 znv(CWs8%QMbT#mNO&Df!I4;87NDE^A^3fR7aZwNZ{`_ISfUL)&szx$gI5Y0)fSpH6 z1%pM)%O8NCEbH>^q+?-Nt6TTty%kGe+{%WHc9)jG(iQECGMQLpEQt8GNbzE(ovJGA z+P}@>$KE;M+VxD8J!&^pFc!ciDSRMOvKtqAvmgymZjh(HRRPW?w|J)WABne?9};Fn zikM~2Lk$h#u6#twt}Oz9C0X?W4+%U~uEMqm9{6&G^UI0Fx*1iFy1; z&AE}CizR{SkJQv8@FCkWMZu;3)|v+-3uf^PE4kJ3&N`+Va|P7}<%i2M6eJNhk_Bk` zQVQi{YvozPNZg2Y9`z}|E`y?!T=}|q%8h1!?PQOHXC1$(#dBIGRZ=SvZ1u6DvNPXc zPXMeuxOeYAX(258*bnNEZDDn;G<59_OOQQ4q!{0RCH@+lo3(duFQ&+wUCGUSFo2i1 z;Yrbr*89HdUCxBJH%{ar(@$afZA!jN%&3!Pj#^ss$=W7p2 zCaZ|o`>L;8@0!}>F3^m7tzz#N`R7|v+k_nuC3JDJq~bZtB!y^Kp$6PKll>jxOtN*|h!ghvgpkHE-dR?mlHQ zWhW{9rabM(&oL^HHpAmXA_TlFA;E#OlR;-jWwa5#B>Xhz8K`wG3odz>+uTp%IRyrKuGaPq;vQZoHHy-m5-c5fpc z-hl55I;JYm{^t^uAb4J$$!YGNyoyA`T4?v3mM z#J2h!nzdb%hsz2P=)3;Yy zAUIRq#MwB!fhn-$nf+m9|0;idO&=NPwDLTmT}aIy~WCmHg6bJ6Rx&+N8gt z1JbT|ctB9xWZU{hqA+vK@WDLmOT_6DVF$)SuyO1u zU%y&WnUPa^YK-fAjFj4bV*Yv#1Sx5jR#qE)mNRH&r}nqa3ixTj+@>adL$D$z)!rYN z&8VC^($SO2AC$==MAg7j0M}8BSEYEB(957=TiPW!xrJga7$dt!{bYg@-!H3_MIMIb=W-XI&4rztCHIO zLCVmK3)Zkd}Eqv@%g)-zBz^8uok%+CoeHV8n()G5sW{(dLvPqudUfdJxd*KH%EiGCva zBA1Vcz5(4Q-<*TI_;mg3)|H3ttaT*Zw(GSY!NGWRe$MH9-L!ekRvppAP{ zA;*IPpYDNg(l|(?%%rFZ%>D7(?eyIMb5o-_p_2B&RMGCU#v67mH*+l>Nzc(xgQmsy zQk(t0Dzy@3&y8%nAJg7+c;=}mhon$Edeomy<=W(Mv!noz^u2V-rGumtoT-tg@(@`3 zED#z+IK;-MI)8lHcG3a{?{;%=*dI1 zOxYMJv#3+N@38~vi#G47XxUS~+$ABB@8}E|>QP6O#m^2N;|b{!NbAu3&QV<&v|N5w zcHN|Oef_f1z{+!ZXX7pjzvIf?1DEh)f!N#N!z;Y|8OO~f3$H$Dv2sH#Gh-m?Z#iu_+R$aui*##5ZW02gKh$;)_5zsIoK1q;L~)_UroMOe`w$US}HWxbyv;dQ2`l8QgKOr>dJC_M3E zD)Li3rIr~ditgfC=!m&|Co<-g$hpfSL3QC}1r!nxe|va-k*A$38%e~+znT#NcLC8X zg*GxACs3SQJDFMCk{-F=Zu0E+GexCfa*pJPQF}S=n_`%vx~IGB(Jv_)G&QI+##58` zZA%(Oq50H?nGIQM#ckjdVt<*wZxDQ&GJ$U~$gjkL9&t04$0y%3P#3BtF-UuY){J`0 zb&46_$e8D;wTEm!i$UY1NL>-w4|$wtqo^_oo9&XGSX@l``N<;QxSu-q0555?+mh*#$ zQ~B6#@v@*_IOIzTi(w8jrEYTO4w8o%e~zCzQL_gl8wu=C%r$HE+nNCcbZ-3DGb!^8 z5y^iC0mXT5>%@t~Y+JPr9pa9pm3E7CJUT%b;G zb8o3J`;`>&=GD(R3kC&DtVa*$@KU}1E5FeuFvE;*&y>csG7~SSguS5%L&TgY6BPS2 zn#$&H{5vHE$u2;?A}8r=cWWpTXQT|9{NBS|bkaBMT)e5}H1LedB!iii?m#)kNV!e& zB=B4to)2k{FqchB7*Lx5>_1x{0j=azIY*-gZ!8zsaBKMO$~%&j+;3l+rC#hf=MFrw z78C(t6V&TKE z?(Uw45FV)@2trluz!BzHpQi`E#?v0@s%4`JfdO2=9%$N@2ETzp5*_l6;soCcv4OqjGgPU;k{kynD6jZK_AG=jf`5Rlvr(BO+uP#rtiHR&0XNnIG=&#=EV|I?1jalFCQuH>m^@^0N-qgi7K}lcL z?Lqn;FuOOu#_hVfQ+VhT(nSCIT>a4{I;7t4{X5OP>Uuh3D;i{JsrrymsV%_TF~;Uj zN%v}zq;S8e)m%CN17K|cU^V{BuylDDfZM;Q4<&aFd9SvEkGVgm1&V-$6@nSqru`Mh`5={r11-$^8Z zY2)iumaC_9NX8$Jr)~kxfuR&lDdASpns+9E3pA7f)g}4*>o^E_-19ApKim5w1HBdU zwk>16RzJGg)k7Y5$i(wLXPA={mYBkET(D1L7m;mC>?SU}>YLMuUpKZv@1t3keQjOh z_MhVH5R%!&u~51Q<{{KXV08wekzOe&mOf$Py(N_cQ|RTn=*iCJPyi_a9Ix={mEi_` zA}+c6KeB;Rr%5GoL`Lw33kD9}V;H+JUk~b#dh{ks`|Vc-4waj6Vps=32Of#w9iYj@ zYIWFzn44MG>u`z!vh%j4CuE^T8GpY=pc@D3Z`^VjW0I{2lfn-YJr7d%qHUHuz8ORlAPW^=K|AK7WB%9E^x^_~zJH)V`+5T) zf>_>e>IoQIZ*2FyPn|~5=!ge=@hi&D%eMO8C>kac>giGz>&!*I3(uVQk{~;ZJ)qUo z6{GY@%2hn%C@c+rX;-@#bKwVR@G61i@B}s<6R|QN41D?%M6LZ!1y?oSHn-I~n{)!2FD*HEDqOnrXGbCVy?pe|b zPg%bP6xf0?*X!Fbi)60r+E6p;K^kbFi2UpuE0H!4v*&3hKrT_IWT{_l)ItKUOZ`?j zz=6CgC-obP8>$$<*8e1FDAgN&T^Mn@eXDODv*GQ^z7BN$3?z{q{wyz}T8PL4OfczDtY0xpFzEHG`cD^T($h^N&a<4dpzOBDzjOjsj>PFx#oaF4x#ne_YM%wFyI% zW}c&?U=@M5-=Be!0%Qm|lQX9sg(Yq?FO5vThjo+h8LVN^-y&Oe;ky1HR2Ndkm(qiX zR^U04G?`y)VyZ$D|EhIQ4uy5BEGhFfls{g!+F;A}Nbvan;&!#Q=j`>;pZCm9PiLi7 zQ5pB>2(qU?&$7zPZM#j5&az8X+j1Beqbx7RQsJZB$f_|{`d%ngkwZg01byecWF*WE zW^M)dI2M~f@>hM_0%1@`3Nz)Vs~^;?vb`vY=~q7S2>Rjhs;0gnM$&L3tv&TE&TM>8 zEJFAL9;|y7M!@Gq!*--(jMh^Dn!@4d`;Vo88|Nj&JqSVG1_}k4Trl;@We&%Re}R{a z{Af&wBQErId+hK-ms+PpnRJXCQ9h2wBdwYbYFwxyM=+cBi79v6!%N0xND+&s2JVl= z5sII0_2M*^4(?CwHLy;sQIbR~c7ILW$yS_ij}yu^9zK0d8hhBO7M7V2m=(Fr+=RQy zO8qYV?ZrZ$Sj>BieJA6PjSZYv4iyE}5+zP)3;PHrtY0c|=C$6d@p|T0L#^~Itl$0u zla@bQ8%8gPIkR+|i=V{srAyT^`Md$!Jzt^;kz@zy<8KU&>XK!)4dEiP_NrHw2#>}c z5)1_Y4rg_Y@{9S%5&K_YxQ;)*ig$<=(_sl|eYgCljitv|#IEcD7^`v!4!5hvJ^fW7 zCFsor?*AW1@AT2Re?BeSe66Z_)0;I--`ji)f7pdl>0-FllK0^1`aqa?ME#AuG}$$0 z8o<>$7(LL_2al_@dAO z48bm?1Mgf^vB>rKx8U`aZ-3EGCSsJ1p~jmqB^6u5nB@LI4vM?d5o-X=dGOms7?=@F zVu0gtlR5*w>975ZSG8yfvPq+ee2HXTM-tux2IS}1eE8zI(A*sDYR7lQ>TqDe>}Pht zjNC-YXNX1c+}>2xS;YHc9s5MMo3oA~IBzkXAO;yxET@&l>gJs! zsii*~f?cC7q@Rf9O5vfZ6}9t!&H2IcN2?afQh@^v6xxV2{dIR5C^j7XdyXumH7O!d z)X||cI3;dRn0$hgkt~?FH>j@+)PwlG%Ssn<=_EoHtt$RvPOv!MU7Cmm6*CyI#^hRT&h-rD*}WxN7DQ}eaA{8r6)xdr;E_x`sP7BYae zDg9e}&_N8hC40>?T+|94$!%20q*pDboRPhu_YL?d{rYRA@jx;LY0L}yFM6D$0&;VV z(Ye$;2r)0$t8B0eu=s`ByA|u007OdvtAK}R1cl!rQ(cT5^KzfK+HtWQ&hI;L4Jn(9 z1eMoW8+n+Fv3Bql!4^K|g4iQEa7QIFyK%Y}3_g=9we(joKAoj>IT^C4ZaoKzQ9fnb zUZ}q{iPYr@E2vB-gqan@*=!6-A^6L8k@Bv5c-b`WV8=`MsbC^E$#2I@G<}$0{;o8X zTQ`zVL6iox^Qgxgoj!W$^GRG4P@U>-jr)vEmZj8gQ&b4f%?1!)F%L?)O!ZnT=;C=x z*2We6FWYM#3q3SP_2=yXpR|bMR-%I5GGL?1Rp&xRJ97499~W89QNz9ggf#M3 z&M$0JF7vtfmgea$3|x+tpiYf@pA?8p@d0~@V@7wBo><|-rmH* zaKGYt@zLV7%oTva^7A1-nMoq9ZQa_74li_C-wQynQa9a9BvFax0(caio1`{*n)7u? zw~NRFq)WNXV!u_)K4PMC5mWVYU#@w2&W~TYQ8Jjm4etRoj~+QQ4~jUM6xGUH>K_~R zx2m}hjtXgBWJ-XawcvStLJn|ACB{t|Ya`LW+VoQfx{;p1=IgeN?qRU9;fMc~?I#73 z_5@UTEqoIvz^L;zllnU)6gvUY#2NfR%RbIxa;irGsJ4L`Eo(yiF%Y)|o&5@@JNPYy zPQodNd$u-Q`;Jn2LP_cWN7GvdMA>#-!!QgmbayvMgLF3%QcA#)p;tzJzc~ENq0F$6I zy4NaL3eC|jW&{1XU?VRV~LX~(Q!79wc`;GCT zV>Fcc|Gm#dUPo|p%d=2b*fMgFuvtR`cqcCLv$u-Yg_C$>iUKncOkcPc7|frwFNvnY zgAmqWa7r+5J?eVgT1jn1v+P7B59lF3Noor>WdU3`lh@(% zZ;`DHJYY(?+Y(eJ6$X6gbQknRY}`nTb1t+%SgmfH%53B5H-i7mL;*VczG5T7DKrzczyNy( ztkgx9`50mM;113s^*qpob19! zwti8^n=?$`NrE1`vB%C9+bl@&C~yz?6`II|l&W5rE}T7PJw%OI=EYbWrmNC+jdH_x zt}-@O6bd`P=raGL0xmOHSsQ?>ot2s{CAR2am~jv8({oF8m75du&Ha91fnT>q5&Z0+ zRkWvZsx^Lmb=&%{)zs;pX~Rbs7Vz_f4I_=!a-3*g%pM7Q_Gq6UqlZVh?yO+-ZXt3q z?SJ`(1wpDg5t$UyRVUjggOq69tHYebcZ=qVA89j%34xEY;QNY)lP`dI=2G$aSWT*2 z2u5?7#>95U5@9_5MpS(?Fy~$^ObcMqLE4qX6GNS_DmZQNDZM$yM{G&CzliiPPkh3W zw>(m!i$bFfTXv&ER36D#^-?FS_fJ?jFIXG}+CZsKK52hI0gp!^_kLIPmIA%p}Z9d@4h z=t4n?kzgr*{Fkr)FHJF!b*+HoVaNCRq%+ubZ#tenZt9D$L?_?k#sO5aSUjH&w_dW% zvv-NH4vd5|L1T*>LJT?tw`t00t7Bkv0~YV)`)hCAf%uoj z8n+4W4Hjbup;D&RG>1H4hRt?Ka{7YaU0$|inlQg_iMR!yu?4Q;st=C zFEq#V_a)g(_o7wwtHRvG13$*@q^l_HHmn%I!)K%+{B+wW6{X}>Csx;nw2e>fqYLZxsE70o{2OXK5BjRxd3S=@?8Lryea}I|jQ|dNW`8c-m#9?TJfk|> zf@Xu0rM}P!7q{b(e!JF-D7YM++ytw9iN@SDrXmk!esmM7p*SRh>Ou=`i9Z6xx7mPc@Dgz8~U4Ycqi9%eB( zHxzWR0IR?ui^W?4Zi#2+mAPQRU+KOsg#^o5n(|btK&U_XQu7L%cR$_$ON9U`m~1vs zgm~BS%AmEcR4DxI@M2^nns8q(>`P`wnW#JxiX)S8Sp7NL4OUDO zTqzU~^FWvpt6!w><02aL_}gNz%SQjg>})*o(Fd{G}OC9k9X4T;HCm@m)Cv$JXTY{ka>+ll|6kQqk?l9*tT(L(_Ts(H^Zzqi)w zzqCu!C15<7*Ou5wXg0hE_OOcXMyU5L0UT!#U*wMzn(FI;sFo*@ciEyM-p2UzBAvAARCMY5X(WRunJUBjZR(2G zaml_(QOHsD;5wUt+oo@)A^dadsr-SxE>@SZKE94R`Yj>POqamGfQ*GIwFpdDv8B89 z!RsN+7ZxU$#a0X+og>M%GM%k;9U}Elry8`zi=q4UNkuIoD_cg$9hnrJo%!=f&qVVH z^NSw(hpV&QQc6ibdanA(rnp`QnM1$5&{zK;>4H&VzLXT)Pq_D;CFiczYH$JjgTW&LmXwL!bSPxh*_syyxu(gY)G3Jak_b1kr_%;1&(Wt!g^h{jUw@);5eUcr?d4PwQfma!iLy1@ z0)$nvR|^vHFsY5B(pSkpdZMB;;)z?}%PD&rI6i-PusDtD{zwYW+yt-v)713;VemNA zW!`Pk^>{N}br&S~v^vzksFuxLH%NX?gMU51(0o3DRX%_hV(dDZ^gf$w;_Bw*3G&ZG zy&%>CDX97dO$*(;UBm;xbv_w~+(?Vou< z4QJaxz+#lBr|&T-THC~u_TZ zk%7*I;_)5mwUBvQs*Q>@ao7hn47Dt5gQjO|&zl#hFjN9C1@vjw0D=NaRVt4oLaNOn zf8pz`xe-31J-7C*L3~>#j~IS)`}lME?xgIFkMpZ%Kk4?jH!l|$BxSM>)X-0Ib+h(w zYb8;4^4fdq@X)KFN2^DQXwXSRWMaLKerc4*D8M!QUq&Y%b18~4gy#bXXx(M+w`ZM{ zHMh1n{z4Xqb02b;VRd0;hwf`pDvr0m2x{ha@q7OE-XV52hVo}F>MikR`nZ4Y+;;Ui z6If#mO`D54SCD3D@p0eJ+fD_1nZ7+gq9fM7p83k>NR+8Gg29*{?w@d-Qra3SFBk6O zydx(gR#<^ciBCf?%BhQcp3f;m(pdyI+3lP0A`Eb$3T#-VkYM9k8O)&EW?gEccj_ev z)3rOPQel4H<$nma=fYxq0u~@2wa!>Zm8QiL2TSxd0g`M1;VHX~DhUg!K5blRs9OJg zAbl68+#e&0-kE_nIW7Bh0dlBi(vhoeDabM5;RQa^_$P{?1z8fH$daS6#rR7UJElbo z*+vTwlK@3ewD!+D`G`w{O%Y?muJ0r5*t&V%NWBbILihC;Db}-8OtG&ufh1eB0(GKk z-)T}JHM|kTjL9S4ZAIQ82qk+Cn7?{4%9{jjCo(^gmof9oVm@2t;lPdNiay}recc)r z!t`pSz%6ZXoi|}oWzjbiSn$X)V(edqoFX$VXBMCS$ehiHE8h#kR_niM(yUest>tG9 zsB}?3Sz>1C+`UNEemKS3L}Kqe@yvkkeKBf1P-Rl`|HQk-TlmNgK_TC?5(nccM>G&m z|Eah0qQH3kKG|OQdOPi}f#I85CyKR-%NGirHu>rRBrVsAO3GkuKS-a}`4}u2U2b^UwV`awhUU z%g=i~-7qX%;R?p#tkS86Dw;)LM0zj8XqE}6&6>wUcy!#qK<; zkr|xzjloG`LndPW>G=cKM()KL`H(Z@>fNf#(topYRMME!#hCaEO3{N*xm}Arfca-@jJKt&cZT^d>}dN9 zKyX|1LW5(x6pze% z#Pi{X$WQduX%P7sL-M#gw8PBmf*;y*H2@v&8byaeC7k}KjmSwSuK$PM(nKr37U`ql zB}ac$_pCO7|8^e(DEnXOn$9K7w+kil-8-%I2RgUXZF?RgrbFuc@gnKeU>4kH3;pvA zskVG^6vXP134`m>oc^7;Wu}u9`nZvJGpPF}l8(TG!Qe%C5<{Xcfo|OPBa>zCcAwnn z)W31&ITdfhJpOy5Aykjm>TV+KAJ%RxrYEA4^)s8gb770VmuyY_BtJN+v87C^6drX9 zl(bx27nAM(9%T`Y^ZK3O-1X>1h9gSM@m#f^-*Wu0JhIp8K3jn%qeT~c^~RJ{*S}`h z5dKYH5l;P`5)_|$eefXv>mTV8KGe<*Q>wPl-t%bx2~o^}yq@lyzCQJyn@9}w6z&eQ z4&zE|M7tT`C6xpqx#MDh<(YmtiKP+S+#Fpbv9l=*iI~6Dvk`oI_?K6Bl(+IW+o1pF!RG_h(Xq|GAESSQrZpcNfTIwf!=90&-EMkn zjEGPV(gH+l0GN{d&}F6jzYkCi7ViKJeBTV7NbJ-`x7UQQI0*H$sgk3rDuUCUgSG@0 zB)*mZZgpI`t4klUW!$=t!#3yupYO^f3nQd{%z`N>znu>(iVSLg31}FV`*hoY6MGn?(eFa4tTOnG7!h3%j_psWanMimv`eV=Kej zDS7t9<8j95ayZ`hznF~x0>&xMz6BWA&cEkVyc@w`mj{uti*Qpiv8kc~obUda3?sF( z_~K=6%b_h}edj{aoEeL^V>*Xw)le6D^;a@b3tbc6yWxIQlktnRH)DQcrF(eRa9;L% zIYKpbZ=TaY9obkGz8E1^;85Lv#cq;(#I*q^b{0y*fV7{)Ds`WX#n3yP7{^rOFDa#l z0M@>sK=F*6#iEI5O|wVa_<2-eyXc3S&W6(O*olb(g}HbE#H)Y0;)YIT%_TN=Nmvuy z>#xkVzgdRj#KZLb7h?}de^DW;p8lbg+6JUJoCC9RGU#!vHmo{-#D|Y6H1q|eC{Fo|tk+>?%H z15>V2$v-j%z=ZDc7+w22akqfX%yd32s`Wn+Lk9C%oLLh=LKER&5*n~ynXd4Z0J2Z| zICgP}vOXXdx*pv8-HNwu_3#%hzs0QLy^l-otAXYlrW`3nvU&`|{yxSTsHJ?VU(x9< zV}poI(gj8HGqZD?fahN}HaP8y+(^jm(XcU=zWSz(Ea z)h^lmwUGO>N(;xKV26i)(J0_p|D*J->L-u&2Ag#3@l8-tc(;Z#r~87Tvf! zFG26WJGEH`K8{d4vhLJk1%Wm_JlxYl86KIvgEnlh)@%AN%WUdi3M=;`C7s*9oUS`T zjvM;NcNJa?k7UoC;n}rbmJEOW^lUN&C0||?*Z+|j65Z{FVgsM9J}_eTVB$gvW*fdX zb$smJH%~r%CI$F%pz|YMQX)NbEzr`Mu8cQ_Ha3k3C76j*A5yb`BsVfjnYKOGfvX!9K?vCL`X>8r;d|4D70nj;@gFdco<4LV26r} z_<55FkG0mo(fr}0!}uYYcKF>WC&deT^Q8bqO>Ezz7(r~`iPke<@>VsFQ{>|S=zhRU zU1Qi+D9001?>Fb90TE`G-2JBd)STl>Ca3j>SCz948EhAV<~?E^mn2&P{^j1%cy<|- zhQxgG%jIY%2n_DB4U)Sq3R~O)9#io%X?DQFMtS2bN3gRa8_)93NdIITLi89WsgyX>T0lsN;sad0Dp0O&vIuLb!F%kE(N9yb_-k&oLDW_h&*QQVx!lcbrxy zHDjrR^SZbyFj69}bKL~X&To_5<@))VWMsxVerN@2zzRZt7gt(q<=Q_9=ORRkq!eyARW>79qX*#Vq^T@cQ3ibqof)Nr z>)86+seCv8{81N2MZaS6Re&WZ8t37?XsOT?;doZXS28LctG&3V%Cn6GekXd1t$^+; zpM&F^Lv)va2Y4yQ#x1CVkg*drB-$c+R^`3K^L38S7`4aIXY}+rl45U_m#1QP%;lT2 z#%Tob`wTdc?x7wimk(BM(Fd!DEpdOI0pDVm3<^w()b^lOmav8mUT{QZCS`8^oTI&W zJ9Y3$M_2ly)QZpkr7*#8KSAg93I*Kj*}?kh%9SLG_u^Sl5XSR^TTF6~#r!&=H`nY| z8swl4fE4WyjZ3j(`+C`(z&S5kV5>}*i1;`$5h9VG_>@{Nuj1LNXUyO_0JMk$4uz4d z4^`?aGc`}Ii563!C4OU*(Gz&1x9qp*T!>ZrD&=sgG*=U?zA0I!?fw0Y-E(Pu>0rqf z!KZ{ifrdrwDznZ`mS}OZtSvf-brm;; zqJw=aQWn+pJS4VVBdC%~oYu#&;qSK*!|PL+;>WM_5&c@kvRyJwc?5P^P37Fw8pQ6b zSf}LlPGeSvS}ArL0-+M0hA)&iPV}-)Fkfy5aSQPu>Pw>{nIab><{r#`98g|FpjPwP zay|PMXwKI@U9RiZDoB{eSm8$R#SgBFtN(FYK52i|huwq;gpYg>*1FxHZrzM65I%Gt zx>kXGl#C}+;4Y4e%ug>LeVonRcruc()C~+!TDdS8X2HF&G9%g_BK$5iCWVR{NWuAS z|9*CpRKoHL@3NocQe$P*Af}bL&)TI!GqiVTBEW~2Qecx(d zRG&Dw&Oo)<-;n4dINr1^l5n5nt=Et!Oow~+D@aqe3ap?SsA`}-#Va5Zds}&jTdv$jd8}`r1F$%ORK4c+0-A7Tj$&AK1G>? zcP(#cBMFqao@tm^T>sAYg4{of3_)*CRSS0>esSy1?t)Luv@?ygS0IiLum_L1>eTBXO1GF!)mEWx^pf zh=Drx+ap=^{W+4q4*B&&ubm_4-d!>f{7yJkRt?L+7kDejqW|qEHsAL*0HHK{E`USDT$?}Ma*E53B}TPu(fHNE=u9ZzS^!Chg}@R;bXMRl~C6W3G!D}N%@7vs-Z zN&x*fiox~C$f76wU2)duKu08gA2(jKk(Qm^h7-&ANGEYUyzM{G;N}V*;5WAocu#S* zhXPOcLWaeA_H4bt==~8^&rg!rsjC-&va{h3Mp6MVZ$fImt%BMHIFyA_;N z3>QGNhT~xs=oYIuC1F=IMy1-aPzRbcw8p3;QAgO$^rZLsEc8(dS?H4hkeg1FrOQLF z3FCmQ#Sg%vCZRIQf@m9xzdh>2NB(FYO(Ag^t-L{;bi@>Q#LgMs*x7SK|{YT z>-WSK@;s~PqfvJ3&b|9=MU1$+2t90-^_aclIPN4Xx z|4K22*+;9u#jHQ;g0&-*r4QRr+l1dTj=gp-%Rq+vhE%5YCBp2!T4h`nN0eOYyk7Lm zp5;Uf>^|xc>!GF4+rudq9KIBBiQx+9rb&qaIso2b0Px6+>7chjXln}2Yn-bt5>T<2 z(L_>brh&r*_unds?OzQwS`L{&OF8SUJ zy3uNyP}si|kaJq|uoa@5u#M6d00}J`Usy5;1W4gJW|&Y>pM{)n#l#0)GzwBHNJ!q7 zG2Ui;U@U={Vp9r+l-Zv&e?5Nnrd2h)?&`R-p~zjem+pjgB=GYG>+1ID7Qm0_Nz<4m zK^7Ibn+(Hwisn^7I1-0W;>;m#xIe@0``{HhF#0t30D^Zj@yA&<#&G4&@@@818KLh? zcv!qMB3EJSxnl@Kyf7T`C9}xVARBd~+PRyIZ+~hMju%Pd4wzAy-*r!Y0DQ&Qbyj5b z30gt_St2Wtb*}*nJ1C=9#~vgWzeT<`&L`$rEh-u&Utm0e|MPQlpOws&g4>gi22<1WWV^0=+ETbos_b^uoaJIr>_^mn_f~U7>3QCRI zoH~2%d;g~~b#&2(Tlm}?BZ*af`8t3pZB&+5DC&H%X|DMYr1CGH)ZEgWCzb4Gji8t6 zt?4;lzNQvAx|`5H`aTe}IeN&N+q~2FSiU8cKYcFVGNvC0lOH z#9=T0_v!k7Uu-U=1K&Ku5AD;o6M`IZ|zYBLf3*=tiUMNSl8iC+RH z2RT79M>k<>Gb2%DP#Vr47%grj4ERjH9Rr^!s8b;temj)2{c<2iQdn~ADhY>Mn`(rx zOk4G3@Id>O^)?r^i1V^PLM?=+JH}}mcP(VtPY(Z$)pjX>xU}mZp}s_JKI|WuGt!A7;T=Fh>U&0tCL7IZ62tQRbP6LT#4|uVRAk; zeLeQ#1I-Hv-v#8!J8Y_qL2~r*UvGoq(kw~?U1uMw0<8)otsf&a+)j>8c{qFq*5>tr z6C#7AJ^??Egak1MEV6WZPCWkXzLG-J66(fG3|^7Zg1QU6O-gvr>xnxq3X-y#^wniU zFIXl=O>~8?C_ml@(>5|!Pb+T(lpOJ-D_E)Ao&`nJ4j>VZg5(vxZai8Vos^SN*t2K2 zKN$pK_%p=8WT=KHoT$CEhP>Wl8TV%5$(_IP!krKQZA;?^p-S8cf?X8*7SyXR7;ZUX zp`+3Nps4)q*fK21FCzn)KDh2Xb8O}^wYhC8liO1^dP0~X4rOT`?G3;P3>8=$`MxLd zd?IbcTiBbwb&;6rIRUzYi2P~D?7(yjJ8;bbZRgEPI#a>d&33WcW(8;|Nc1GRQffr- zd#o7T=w~c|`pbpB7ei#PWsP!_3oPd{$Bn)$9C~`^8bReO{Fjd=WG|E_?WNIn;Ybx5 zB9RR2HD_b*@i5s&of@6GTLZU!Lpp^UZRARc0ZrkQ>Ep9DGOc07nu5EsU}dF$mRa$`&g^!nBNIJ{_8HvJ z#8w{ab`miSr9@J!d6)I@S=UalsuhtF<(H1|RsIXMA^W+D^>nJDEH!GVURW{A_cZagnU~Xh$;yiQm}}`%&V#$3}1WKr(^+bTfz-fhW6i)FObK zMeJYSsWoXx*rBWSf63uz?G2?lMIQ#ONQd@isFFVZNRv2RyK}WpJ5(gabdC>leNt0T z4Znp#0OB6j4s$scopU}w=+ydWX7*vrZo1sNy@mJu22bYo@P}?;iN|^#tW&zstH}#0 zrXp87_R4L47caF*>mUs4PO8D1(YlA*#<&x^tHyv9OVry62z)IoCE63Kl-QKe3s5ra zpQ;xw`P`59y^Q6&UoGQC+cj<>JwASNpe8%bN1srF{@LY3p~NH5M3gvT0U zu*lx3NzDb1-GCMOr^jr{X`e%uztBJK`5bIDdUUq9UiOvs6j%WjqgbZLTqV^cYbaWm zN}S5Z2aDnvnErmkW0^`R74+WtXUrFB>TYqZ#@Hq6jhLWflK9RiUmDUU8qWH6-WV|j zdlCEC#p;>WMNti6McyLix6B7y#0AqE=l$hcdZ7Y0u1q|NjB#%vId^P49JlcsXS8o( zjeon1*0WA zesRjc9`QB~Z$xzqnt|FVBx8$98{B48zwZe9a9m9-0CipM;~2Z~!rg3~QQU@7p4r#E zF45X(T80PDH-is;iwwpaux_9od|I_hk^cX=02-UjHSMihPdZ63rVAhP9u$vn8}g5I8^VYMqtM%ULBi7A>01%$1fV9_awGdbGE3=m)lQ(``X93 zPt6nztY;dQmW?PiehIuHm@3~n!|}S=Rg|=MWdW(5lf^t+;B?s*pT6D0`o__EE5#U- z8k!-E!T3ZqYhVysy_0Uhl_SU`WVaow3DhrHc_Mg{=jppnV|{R;hOmIx zkX?lnLN39PzGC-~PJ?r|JWR@>_{upffQY2RlM^aVb~v3+Rrq@%{7vq8n<0S{7o?2} zqj>c6#qBe^lfeHBTfG3Ib-x8Qk*cOu|I|Ku1wnuf2+~fw`mbY-eG3V^(v}-P{>n)^ zp=okej6Xi6XgQ+WwafZ(gL1WJ4TD*;GpRVFSI;Z~v&pm4s5!~YIMVWUkE4I96=E(t})Go67QZ8zCGYu9JtJ5{Wg zdozFOjYABUg=`f#=l<%Xe$J#HPwn>|AW#0!gAq z!FUO8PQ9HunQV%RKHCkNNUm1QBRr4S-nK)h*kQxgeuzgq!E2F}Gi=DSh{Md^a&PE6-J8gKv*ob0M)U3gxo) zadxqjvgr&XJV|eM586zLGKYJx@S)BwszHi!^e&?n0;XY5>Xg8a*~&~@FVyz`BJ2!@ zCa-e@riwl)fmIU{7H03_AgLTi>@Fz+@Gcdp&%;yGw_zz8Mwh%2GCAgO3#pC*evu0$ z`M+tGF}-n|76YpNidEzWyr7%ib#4KoccJEQKWwwUB*!58Inpy;b%JU?WJKFo){4Cl z19rab4feZ1=pmuT!F&B)J;~^Rqsiao#iK=nRR8{41~BPLsIzvU_SF(61;pdxOvhsG zBjVr3I}5itH5DpX?mtuUOaBGeC3A)BujxrM{5p<_^+Z_}MbBuBWC`h5&bMT+gI*qS%-tUC(sFQGzm}9PmkC3faLOQO! zPWp*r!%~8Erc1VtHUug6EofsGSYB&P9LC0X#BT1F!*`#G1EW6%Cv!BL`zufS)WfR* zL6gveUwM3r+_0OGVL$pCU)c#a5t#MHE|9=JCAMzL z27JtAHV#YP%aAk$t@G74HnK*k$HlYeDysrX$TlvON^;^bMIpJAy zl!!^_<Zjkef z;@`?PZ<_tC3U*(~OZf6*CDf*7c=ZN;48mBOVr7dtp(Fu7h}2~ut$}+AH!l;@1f<1o zZS*)tdW%2kj_ymoDN?8e(FH1OY}2pST(E%qw;m`4tt19Ud(=%cWvJ8TQ?{rSzL6tw zRc6mbONUf0&ZwEwn9FTxh((Gn8)3taO&-FVgajMcdPZDQ)SutyTlQ!aX(waGCE9Rn4ujkF2(*t@G;g zPAIC(vAx7*L+mX|`LU5vW*A>-za@M2-A#10Y$=Wt$q20IQmSZ?#ag=To8d5K31;z~ zA#p*qIeFdrT~`B|KLv(hq5_G{vP8NN1$;g&hzlSvo8yQ1+^Ah8#gAOPaqkT%ez%+& z-5S^5yM3K*5JZ2-7qf~wNXFjoQXTFT)4zHsj)Z-B10PWgv%<@898WheN8U#_K+2}*DP$3)DvPy0zwSKvU3x9+{keVT^aV+;C(pOW5)uP z;OO%g3cS{aDo#=Jl1zerBu$g4%9VO}xU+K1N82Ng2da6A=B`R|OJT3Q$vej%sg&NcugXrfzPQ4LT(!{pgY zlOj8_3P3lGGGTS(3Fs%W7i<+c^^UPU^kVW?N;iu{pSgY2l<3W(bI`sjlQ_-?{BzAJ zXI`30cTO4psa4!~w6i1en>O^_g@lhH72GO?83-??u|I^f?jMm$*;h&P|IGe%B7ZUF zxo&Nkcv;N@9_UkZ>jdqKH^PA1nDj#2SD`SOp;JM9fhR^RbpCOnYqR2WIFXK9XIAhB z_WM=PEIORh)1e}>v~^HfZs6@VMc_P8av9Wz`<|c6KZld@kui+U&wuG4`#CS!b zSYoHFOOKmv5*R=)!3i9_tn7$F_ys_`bnaL?{Ga{VUJI#P2h(>A>SPVLb!c8BlMZAh zcHp*F4s`u0jhJ|gtVX%7x@|a-UR4}nCWlzLZ5+R?f5t9B=5WgB&{#nI}ZpHj4=XYlL=u)5?y4)@3NL&dZQUf{3r z5U;iX6;wnW@a2F+AFX*8#n0B4%?prRyhLWBP zf##>0))a1LYPO{8HR>_-rj^bGHF)Es3<#$~(n$KFTV|O+|Dy7489!a3>nr?L?37UI zDb8654+Rq2lqT*b;ol=5P#Y{!O=WI|8a9&?| z-eJdl?cN|t*2q!k7{#IZ>cJ`{Qg~@^lUtX81JY2`ZorYi0-1UiBYb+UCnc<3bdVY? z6W^a}{)-f({U(GrZY2=2LI1UDc1-*?gX)Dg=oe;Y>BsZ{dgLy)U__0Ej>S4)G;k8z zI_}xeRQ~Y5(<5*HZEf>-%WmeMt+hW$<~{;=slh?$S=svdMQYI`Gyxb~)hj4-@}h;o zWCq45U8BkO;7#& z!!D-xOlTG*fc|<&y4HDxBv__LUgrCa0n6XXTZ0Azi0nXl36zsk;5}hS4dB-;&0PHM z9)UfppquY~W_MM{=NI|;*{>c@%79N{NQUTU0FE``qrK197e*z^^Azwc_xOa~vQ-BO zEbBl_YeTKZOFE~MhTc!xUY9j&l9Z%{Ufj|PSInT(=E{?#IW_tx)7;mA7^lks0AW;r z*7zd6Ulr2(D!p%=K}rEw7i1uVYuCo~jL{|-66ZiBqTX1W1H|7|HU-sSv;ZTMnL~%< z6CIcHxk3zlaV%H#73GMzm)11CTLv*%N6vHqzE;MEGDGI#cp$c>6Xzeq_=u>;${~QO zvCN;v0^T7E=W>N8NrPZbGX6!IQZ?t@Qy=Oxwy8<3H)WX0?6!BSv+#HYszP-q zXB~P(Pn2WfoM`NSc4X7~ueP8K&4%=CRXFFC8shrk74?|_;u#LZXLGbQ*Pq1*NrqwB ze(N+G@aBpwa*%AQp`Svf(no4zeS&yC$P_Y@W1MqpL5x`t%aiz({9Nu=ZoROc>8NGV zrE%D_YJkM#Z)Meww34z#=1Efz@fCjz{*3LDpjXdvfjucNs{*^d-1=;kYwxXpx|xs| z@&Py7Pnl%P=sIVo>EGV|&Q<_42s=w3%hve=KsKlB6_`t1(PH>S30iIPAXzss8Ka8BCDaEr-5H5&V=YaeL!D7?v8z zgXncai2@)xkSb%~d(opSxlAmg7i6CRL>Q>>x@F+;TOqck@{ zO`{8n%Yu2H8ZcoHo>>LyAb3{+?@GKE`MXMZE~l9(R*`9fG(>NBqcNHq*>d&lNmcyM zSRUdjn9bZNT3-39=a^!w@0sDZ(?`W3wox4aJ!oNI|u zMWo6p`KPDSA42k=>(WLPAgY3ggX_k6y7SOcN2K%ET?He{Ioz|Kr?Qb4AlH(icMB(K8k>0O`-Reoi2>bHgNL8yGKrYn^&<1=A{3$H zQ7av|?QSN!)7+Zj1x5x0@oa!Q$f`-pG1rLH@RAmJgXpw1zU9+~=q1DOo&w_Fy~WoI zqkuoB_?RwX>!G_8(uA&eZ}4>lte5WGE1>m$-9G50#KwfGVE~fOd|z#7)EGCqF-h=V z_xp!)6HX>dlHmuJpn2i;o@%lRZ;dmo!6f1VUC1iL=`GnyLgT8B&ou+G-X zj!2hUm?!av?#*bjJ1z4j`I**akVo_jGqP>g9GIA7>j}wH0cW{*OU|j#{U3Z0n9?O7 z>99>P*O}506pzL~Vq#U{Q^rM6^e8(UUkq*Kn3RXm2ofV5T zq|v~Ofp)@#(qJcKoKf5|WcHu$0@U&_l{XRu&9a+}v;k+zy_}2hjr~^9*pSY3`x_kF zb^D5G>O=*;r(YKvi~4ZJFYoDH8gF5Xp1>+ugXR3ji+!y4qm(L)XLIFH{!u^jc|v6F z+l3|2YJ}fVfehM*PVZ0(Z#PLS{9^eL;q=0^PjrV%rEh`#{Oc-Q8bG05DG5NnI)4wd zs=D%?8jI_YuOwTF4ZWn=NCABdlVPX49I^aI^6{`b(=nD{dd&9$7LWgz{cSXj`HR%$O2g9ajrn@9FEiyhsBoH11I)&>YG| z^P<#RQ~wztI>K1MRqB^-QYCe`Kt?S=&0F4gLmFe^hr>=QB!w}!;s zV0=93vWgw8@RR&OVOV zma?{ee#5`;3|b>5Tq9)WG=Rwr!YJi+~UxNy{ZW_|N* zPws8o%>F%xs6<9E6P(Aie zVM*7kAQjY_8+dS(_Bcb)u^ATsRR|~vJ97I+H!qj(vw?%u?N{W}!usEkjAyMhpHGx; z0&ErK#IN<>OLr)fKZ!=YtQ(o0Pw|OjwdWNh=$E}t-|&JLZXp+KKNHWh|7$xwb|H65 z(3W^@1CNB#Z3dct8~Dyz=hDp9dydlt`xqU?=X+!cxdjn^hb$6gcEo{r*$WDPgXy$BVVC zH9zlPg^ikXjG7U&I+#vNv=v7dS}rE$jrqR)zvK6!K9fc7{qREiO6}ezdhmtGFSS@7 zb{x!;QFc6}+L?#KmZIJ11fmz2VX9*i@_(xRrFn9bZ8f?J=$c*4+*JDHJjw+!;Lby=*D1zY(oU_FQ`+t85NX{Z$1yCUbx!+$dQwjv(RA$G-M*V z-EnDXhTT$`x#b4llE_m*Q2Z2ve(|LZwEB@7^-@$7Fo0E~cqE*jCivFIaD>iL+-oz| z6E!%LdWxhUc3jyYdXsl+1yRZjKlx_-Etnj`!dZB*-lgY9aeSiS=>gyKg%QANV%%mj z6A(p7oCC4=uHI!>s6K(i0yQnspR>Nom45#|kYRr))Z}`o zrD`s4FKNoH54v#oC12ESZ1WLFe`?3IFLqqA`VdQvlR5bkL=1bpHu3#TFP%g1ABOw$ zS|2476;YmJjr5LCqxT_urwFpuWN7~@gd%I;O{ zmrU4o;h4KiVc-5dD2h5*O`{}_s(2Trw~Cy07z>i;1|X$6_wRTUUB0v4YyHajd_1mD z$6t*BG3f)9;Zzs5-keoo6R(AvM!H~yDjQ*GJ=9-y;hkY&E|eoxH|zZJ>K}6*9yJ1p zmU^4V&airXeUQg1UVdyDwj0?$qJ#!VUvGLv7S$os05{mIv_J;zgNxT_4_VffU z4fE&^8jk1c zHWvG`Riv~9W!r15szsR+YvLEYk7tIP+Ro*#9Gxe8!B2 z&Fe5VCZbKyGHG6TX^0?-O!6tKCWx^fqL)Dq-kW|im>mz53;HBYClVV6Uv4YS-qx!= z&WNbRWU34kfg{9i*O%CKnkj}6+9b;oJQH@qDx0pVONmo+r%3S;HDRHP@$0;w@b{7e z8FGOaXpuINQ2|%Oq0LkDT8eZ#PAkKqU+MUlDUNlupy`!6XF$^EXvJFC%&zI>wy zCMJH4a?I*_h4qKfm)qQ!IL%pK#63_=)kdZ4w01ub`{q|xI&TkjIx(LC9IrOHy8`mP zG9!xWTtAn07w@fk_<4Hcth2`dEK06TcII>mFDm`;>T8YL7`uS^L5ecoHT9YiKU|bA zCKP$gGFErdAP^=yM9cq`m3v^+;doKpZQ^u!)2n&YRUPzExhL^6APO;ix+nbx@N2dz zMS~N*O{|ff8GR>{Bdzo4l2jpiUZUedg%#My>gq6w;zqWtz)y@3+7J?E6fOOyMRuX2 zzByXM7dvFHrO#7tF3m=ZP+N*WSk%+O;B5?{$@0Mg9YLRl%5ROyL_&l?p<7G00L!Gm za`&FkpZY+E19Je3XEAUV`Rg|7rt#AS%N6{$KJ{F##Yf(ZsqM ze&UEviP(OZX<=!HBajq7DVt^Kiyx?JsY}-7ZOHiKBhCY=q(>QWUvzMpZlQ+zMnsEZ zo7>s=l%9MkLbt}kL8llE)%R<|iC&B@HlTX++6~4j&Ui=NU5{d@c+^Dm0?kJ-`m6hLl4r@ z-Kl^`gOqeA-4fD>bPV08h#(*(A&s=e&>=0-F-Qvx-OLQ{d4B)v{eC{JYwfewzSkYL z59?p>WQHEiiRcq(bmP_uc8fBx*yF`i^2p&8Sf&Y;@Ss=i@{4yDES5m;ACYrFtHYx7 zayemP`!5NNuQ}sF1lF#ppc&?q2Z_TX9|l(Y|IO0{OHC75*RTe1pwVJiPA(C70(UBaBpsz@+W6gF|q)p=S6c~BWQ zdHJ@C97q}HUy``)F9_bQ(WiJSN<@LL00g=VJDacbY?_%fp zAo$cAZ0;#uDjVZ(yKaw)T~BxazLJ-USdn&R3~e=|SiWg@dEHQAAnb%z{T1CU1GFKp z7?&zQz@ir-UJW=pJ<8CMy#8{R;U1nJgfT z66cSszCi{L`m~rGQUP?fU#g+jM)5_K3yVcaUjy>RuT5xMe*gU9Bk9xHT$zx8un(#^ z$c!O^YRh*8TQ!$;*|9Y9tUCq;*tth5V2b-k)>mZu3i)bTw$??XJ|U)||L8RC0j{k5 zeY97^Z9qQih)VXMXA=%Emk2{ida(qk-$MioV*0DtDBILC;xt08?zy7SNQC#2Lb5pxBKXlo?&1$BZ ziw}PlwJwF(a=4(cxPE@j1gfV#sB%Pqg^&AU3$73z?Fx`%r9xyiQoQJeR+H7qPCS9k zzrM_0y^SsjLa~AU(y*398!M-TA9G6LmUt@jcO4MGU4PrQ`oQ3p*K@x zdaN-NG6R30B zQ@sDr1%Q2mm&;qYttDW2=<9O7ZYm zuP}j*L;n+X5u<7=HAo`yc@Ff}RcTk3wH(Z?Qw(@!{w#0hISH{L1H?+pv+m`%7oN*x@ znh;_Z50%x#wF!-Bk41XzcGONc1xDqO{tDIzZe}F(i}y35GalqDK!W9@sU-#;@sBK! zQfu*3Nz%d<8pcE5o`C|wle83=A9twTx1okt_ZQZOeH0Hz>B*{ADbtzfWEr`Xr;?sA zj5Aa*x1e`%WZh9B82#{BMtQ~4Ae9IDU|v(gnIo#6Zi@R*HyXFF|LpN1o8ALlVS4oO z05TB>e~MPLCbJZZzTTx~RSg^RRb-B9C0P%tSUJ#@W&6bBo$aNLoMIaUH1Tt5agByIt4@93eWlSpD?t(`j~nleRB! z6J7LN50Emj_5)n=fUCWLwF5lFn!g79$KTJKKV52^YEs`~^4yK1F`{9Mr#;ayfm0eT zjMvMatsm2|`Q!ZoRTXfHngXg9(54UI8LL_V%+db7FFLhD_@nkI?mQDAp16YS9Auu; zvA3D4(3ZH+jq`T_!pS)_zUGPKTyWzu~+9u z$q{@xAYkgN9Z&z)`(T#15F=v_djJq1adD2`nBqgii&ulQBMT`XCACoRMLY{z8)9kM z7`u$?5nT&y5&09A7j~T8X6$g47xk?qS1%JIfuUwkcfcgkaC=uOg_#}vT33C?Iq1*F zheVFT)0+f2)>jB$eY+4R${pu|89gi-?=%76i;fsr)T&1Ne|{J(xgDX828C* zf6ZWDul(q)MtH_&Z;)>;QEzUJAR1^Id56cw_l?FwXkGc8XpGBU44pjM@p!D6 zUDbv;;b80m`fgX+(4mC7&ZIGl`KXV7^({+OHx2m?uwLOhQ+Vr2xmRn`-fjvjhf>ib ztXeNeyS1>Spq$uo5k=93`8;PiwRWL@{MegJHVUvt3?NmUFFJY7>&*p}jZ%ePmM8pZ zLEOM>?de6xhB8Bq_4clsqqsp`3lwOzE?@)XL=@m8r_NH>T6bZ6VM!6x)?B#4LgrZ( z{&V!qhtcgxd`N(4&^<}p1aTCr|D??F&J>E+{guw=cbwGdP#SWKN@6Pd=wXu5K2zP3 zWgMOR*@z;zAWbd6w0><6hd0qI9FE)fU6V=S9hFzZTQFpks&lf6fSRTuiX46P&zRvs zFm6CS=AQGc5^n%t>mfsM3-e4BlI{5l_gNbMJu}RkZhadWhsuHoym`^X5!mu`Of85% zZQjzsjl&I)$i+%#{$6eExfv79qF4xYP;eQv<;Vj~bLJj1pYIGavmyld|hu%@8w zu+j78w{yDc7UP>j9b9kL=9}w$#Wugmo*}wPgT=mVzHjCqsrTkSaTu&E_J%PVn}E&F z1`3AFm|iTc3;9}&ng*2ET-X1jyBcu3-kN8C0`9Igj)DPHD{6^54aI1C+NXcIwVf=vYPZW?AwWi8E)%|(R0pgEbH0u zuwo*0&B$3Ymj^NO_%f6;Fv3zN838P@%C>mCi8DP4Gjd8>;OPLFKO3jBtl@NP{FC<TSoR&rXQmR72sASlW;bKD){&Qfd%}R?-H~H|yy=?a^)te$1S~7YT=uk~w7s5SIau79olsH-n8Wa1( zWsn)hyr2foJ|V~HdU7L;qrIqq z-C9>UI4fPfQ+=1p@X?}$wI4w^{ckn??ao4XtA(yjcir=&Yv4h}oS-#HS}4v-yyJi) zM#8_xnniF8NucS9+7uc$&hjlucc<#5H8J1CL;&7HOSM$BhtLmrG?hf83N~Xk6t)pf zVo4iTqTqX37H>TsERv9oWAg0Tf5-?LG)CNl=AG-z;w)Rp^yKv z)h_zEsqU<5kHp7EkMON*JPB#M-y{U71ADsWI$ukDh^bQJZUf(>L`=CG;#lHDOM-bu zMo|w;pM-Po-8?fcG0!HF{dOZo6lxFGK948np%uYo0n)NNdME-)_vB$rCO*%MX~ZSJD@z;AY0D;riv8vC_-WlCs(Z6Mrlnbzxx|Ck z;-THH(_|T@GsaI>+2D)(_OU(Ms`1qet>#tyn4WSE&h}r6-zL06bj1Y>Zp?5?lAR%m z`J3weagxk~LFBuCd<<3C1EIh1dUG9uL^9;b7B{FkTO{`G`T-%q8Id_}0SSaeFkIAPS4BN1Bu zi9}6vv2?=~euUhXt*NUU4#$V46E)RfbE?wJUub0NRmL_6NWs$}JC<1JHp?Y`l*2&I zrPBM!WJ?zlk8m2~rc+hL>_pBTdSbY)jd@)j*Rq$ocWK0O5_dd4e5t;_ROfYW7-DdwF?1PGUpOCTL6?MPm5R9chu&Wsh+4O7{03 znu4tt9s|!f!a=@1EnS*gX&V6S(?j0Jv}tx^6+ToYl|QF_&%9KvRv8y611EXyX-qL% zqiuJ`d4HF7`3cS44tPPj!!>d>*C5V?9EzIewUqVW=2D%5kb4aF(L!`O< z)8bV8*cz%=o;59M+F5E?m>wX=xZ20hrt{5)Ks`LK;-D0%?0={TGl2#@cHNfsZZY7O zImTrys@=KjT6L_Gd3X;YW;x04?2&o0y!`v%f(zCBdwBzcYqoS_%Bv1;rIJVUOp4Pt zF07%M$j#LZAzoa`-Q2R0?t;+9UVC`g4r^A-u0msC;ulNcIzm9IS#bCrH~U=(zbg2% zC`jjC;0xUgHbEWnhr~sDbxK#$qHt$Rk+%l>3!9U5ViMI#KwhAsmJd6hec`!Wld-~Ql;K?DnK8fFnBX&9IkSvPzh5*2@o4?zXN3g+j+PBDLvxx!tod~c9 zfwkXq86)qR0;-f%Ya-UKneylH^*}wDw(HI;C)=^LGo%v_97d%7{ya2r)fMg@`@F*rM0FcKZv_+TSa%XZC_paw9kYYEX}w1yOk(?xWDZ8fDuouCUaX} zSCyZiHMe;|-#e0_EPvs9E_u9^?S)U0GHPRRrh(R;%46AlaMauZ{MVfU+8l7%#KaZ| zJJ`DeHC)j?J!WzU7zeV~;s<=uO#f_%4lm$4%JsyKBx|sf(gW#V-yz&|pMm{v#BXt( zf&oCJ+y$QwVIHZ%tOAH@i+WaG?>_oe%NO0p8tF8*+{! zFT#4y3(u~n)m{dRa~bvSz8DILkJL(EGIY|W9g;raq57^-#fB6}uRJc`_76&>|21PO zq)_3SO&YQOv7(Z@OMFm2$zpY)F}AqU_yTl#}VWhmLD zaU=&$x0)v^-(SHdm5>5udSbg`YSTdg{0het0RECL-#m$TPE`0vMWNgPW~IYG^k;QC z8-G2`dxW;~w9~?Uv;g{3A|6^XKmd$5i*o6}mH7I%v1vsKTRX4upUVw6WMA<{tK?2t z`oMa6E^fwu=NavP8r->k@5|yfQ!gI!ce1yt_ZEVI?RGb*&)TyROBl1?TwNt@kUh+g zvVb%=OgWO&jm^dRuosay*XX2+HMNYK1ogS>4frF)GSKnbrL$v76U~izsd<|u-!dY| zTSLShzw$;d^St%g_TjVH4oo=Of4SY#wrHb~8teGseZM6eX@XW_?uWO}N%xRYd8UX+X)(UXamOL@^k;Z4oP|K7ca2x&R7g+Jb_cl9KMj2dJoDgQ zob+jk^*E$|=_kU-uiCBk?|HaY80_!)9#kbZKw)B4ZfHezAq zVcCY4G^jY$v?kS=T$Zc1FYBWW;Z|Q^pe;76?|cBujU(DV>!Kg#E6K@ofe=vIdG)T0 z`3A9ki;c>RupX88R}rz^7j%BFGKs1-q94I-k2{;sOG$Y^b4UIk4L;#3 z0(Y-oO>>CN^l|kFX5)r_w` zW!Jl|qHviE3~5_6@kbSwIU@{8^q>Z$7^jL;D5_#Xkl4@qc19Mf}Z zD0%|_5|$yJ0iwnzxMj&ISGNx+$q@e+JK5~?L=_)Mf?f0qXvUe4c3BzaMj|+Nq$wVr z;uCuApRO=I>-zAPW?@nX<$y9?vu^$r_-~dT273^XTmfkm*&HUDzde`!#b8WtPcUmpPLI-mkj$rLXM?qGV7;V?uuj9*L4VCtAoPmfGbz)ZqHsxoq<`tzmJXHx8e`eB|HS z-TL>hPNn?jbR68Ylj2c%tAlTSU|SbY)+8s-wkAkb=Gahz&+-D0SKf!^`Nc!-vDMf5 zbE?Pc+*$CnEm~uad-m_zp>HK(su_tku+QBYNU*h~oo6Ueex}BsQu)!zf_K#{Mnla; zzbVVG;pI8}I6oO#jX#|Uo%U0MDig!uK|+Drf~zJY$j>qB&3}t>WQ#ZFyN#j}#Ql=! z=f4o0IsLh^%CP~5qiRArYY)i#y4)WMk`CT>FRMPR!ebkwjx10y09>!H%ID6bY?41f zh8E<%L-3x2k`Co!S(B)MXycGkp8o|_n4UdHCK~qoQv%3&))Y|H7j%-Z2lDZG(Hv1* z;bvu#-h0#^uiLDB=2weZ%%{hA#m=Ps+2N3@4L}rGQXxa1JG&yxrX?cXBc5Nl^-V1N z3phVzys0Z7RN0T$^2AD#ayeDDYNCuX*Jek2kQ4P<1gL(01=#BMihTIzDX$aDQ z_3`e!nb$@jIcDHu+6SoW*_-X3e(O{faR|c`+LFhwLcvm%mx6XUfYb2q-8Er^j>I6I z&x~u)pUkuNVD7;N)C(gamS!iD<~Z6ho2G4351Myi8T=ahn5iW$+>S+k2H?l z{1)XJ7hy2Dm;W4%!7Bo~o$XgWo*r#5pCbTwZmb3>s9s8HvVCPo`z0mpx7ZSXd}#Zq zYV+iOhqUs+GsqnCL=l@9pWsD`;xiHASBdmQZOj(=2dqgZ;W^#H4n9#pq7M7q!YQw; zSY6q}2a$!z7Z@{nz6G0|qwOn8gSyfviM7Ewww$ZwV$43Zd+b3=o)Lx9V!C|u*w34`HP{N3iv=r_i?^T&aPP5yS-jfrb9`EN2W%WVSILdSfnoH z>sl1QzeaDOW24iXuR5+~vz4GWhYRaF?;fA%yj*Ud+Pp+v!j?XiICrGNdg|1!%K<+Q zhBNHhuDTN=?|2-en;`lgXQ2Tq44vm`Y3gCWbhsT$H+;z=ZHxfm*@31Oi!|J3Wj{;t ze`5-1)-|55JnKlpt)U!^LiMzy)FxVRz7X9UltzTJyq530_V=ri6r>;a{M4zES~2J8 zwTxF;?KOT>>mSI#q?ALslEBJAg^oymYtK{RYC^)pw^3C9EEqBt6m$q(%aP!8>u)ax z?8C5%wNK}Gw@$2}tdvQ|aH}u#m5TH#WGB=$dQ}QHxmLUA+20Ii?e028pP3l%^1XPF zZe_ofnliT61VjJp3*iath`r)+02KZ~Ndp-2pEza^LE*wkBfrMy@FHV|PHgyQ;Q zS#ziUucVIuJ5N@|kIv4a9zB-2F`gzj+@Mj^U=7OV;&@3L(Bci2VZuHQ-5%WErA0$- z%;#d~Z-pYXbCgR1peh?xqt2P>O&0WXfHP_tx)Dy_g|%LQ4Ke|>BBQ*WUM3_`5Wz$# zP`*7`z(F>OGRWOh;@hb*E!7Nyd`Ojw2VWh1EvCr(N;z!vj-UsH)sQu+Pycf3_O7k<@xAY*5k>`dT{EHHdxT+_QgSRj z9NjBG6=?-OQiw;h04_v*!0&L+DCsQ#7{rSOA2P3yw|d9}iwaDT3dkHW+}cui?4<$Z zgI1P>1|^44DSndENy;$d4jSb~qe|Lke&)jR3t0P$W4J?i;tqoZxb4P>s?vl&;a>&_ zuUr+=fE4w7$>SypbjqWH8ob6DEFzWFrDcLX4^h5XcQZLML(@;a($J6N!5OaziktBx~KlVndk?!NlzMZ?706*`t-g{b%I4f+)b+zKSYO}*ymyUDGy?WTuB z&Y>mcJgR!8N1c>c1qB4*9B%3@T8ozLX{V_GlC=t{;lcGK!!kMyzeA01fkPD6*M0_= z2PK)A9l0JW2K^EPrsi+Y1&1o3E0?*1u3&8^GTnQDYe*Y_bCSr^@32aO@ z<<}YjqGO*cos<4)uDQP-H6^Ho^6>QXAI=3VkNC+JueliE zt7GN?nC5+bS1ek(?3!TK&AywTe6PIMuy~LR9CLY^R{^0r^xfslhkTV{W7OEks=PC2 zoqSSHy16iOe!NSO{IkmOr_9`{sm+BZWt^w%jjfC?Q;X{{Z9nXh^8Au~cA;242~rQ# zrSIIC9*FM^AOt*l!Ha8MPo<)`aF3dy4cA5R-QeIqfVA;m?ORh|KoCOmqke_7fDe5& zGWeoRAB1!%)&WaDYUyiAz7;b)y8emFa+3L5+_QOM?`=1aSVkThCfo`>7t8##6`~D> z7y>1o81TI`+S!leL<%g?FD!E)9P==q1;%oCV`RssX{Qs_8rgccJrQQJq8;SNR)*OE zupMWp@DaWsI$91GX5=ms9x?e=ZsaARkFrbFUo2?hM%HK9=%l}0_UZbh{HxX_XZhL* z<=+o^LwXI{f7vgGnD1AOPR=B=T^=R6CMC7@w%sOfei2@VLzcoEr6xapOmn_^wc*;Y z$~9pDJiMud_vhywXu3v~sy9D-rrKfS`K9Caa$u9~e!xER*bGa9hNd66H(fdG?=1PG zH>3)oFDDY)&pK6#N@v1bGW75K-cdcgU-xdCv(I0Yeel1$d)HNDnKfs$_GJ7^11FgS z-+X*y1;pQ)DLxr;gXE%Qvr*vAZjnieanS26ZTXMVwh}M`_xb1PwypHOb0QTUC<-&zWhBUurNoPY>DSc-3u73;p7im>5&aS}OEhtv$gzicy5 zQeW2t&O7fI-junXmp61AbCPm0SNMi`B*6>)byg2?UeD|N79F`J@c5GOBSL_@w`M+x zK42$uf5;$tBi3543NWKvOnCPB>BlR+^ZgkfuYx5bE>Qt+e=e@!ruHj;3)K8~m7fud zZ@c^2EF^XULr#E<%a_mSAfMz0--un$@N>CH#hn=O37WKPMK9t*<&bzY|AwXIw zU*ybWjl9MK;C@+}W+Dny0+6&Na}Fv=GRsfrqd{N5orJ%RZlG;s!-X=nRR?~Z6VXK! zEPF^H2_2I7TiWv?#Sy+%Oi?TKWDoi`E?O`0kF)+-+Vr?0zUrGguobft&3`)0qCd8~ zZI@Ez{qbK?hcMh<>wjhA_L9gA*sufwDdmKne3UuDhtqtpN_!p+Mpy|veh2L4z)zvqTO zY|)s^6WdPM&mO#>{hQx17G%?a}XE#+x<#CDevd>>z!>2(M599BzUP;^~p8Zo1eu2|t-ql5e z@-H$Bt>qcdca?Kz!dHWb4@dT{3y-3H>6<*p`ct%;k}QnE>Z=UXGXzUB|LItG`5K^m z z(pZ&5946XiIa?1;`Cr_O6%Mn!wn~$B_9-0NPIrEp2*p$+NxsC7gd*BIJqB8$Q}RfV zf;(aJc}C-@30f>6_I7dM4dQs>z1{fXEt_kSUegtjNpU~ud4rfhx--J%!`P4>)A@W0 zet6EWP%B|x=1kbtE#E7)?TUQd6>iVt$@XlVo^x=hTowV8DVC7vuTUw_lYrC#jBZ6hh`czkMt zUh1^FrKjaFdIetb{8MMnG-k5kjwZENc9pF^#xnrqye!)HVyWsr;kP7wh~sh@f-sqa zy3b>ZyGgOMj70yXr2YTy17t)ksd_h3Kx!ZF!na4pB?2b(wGp-~ptXsI2G4yXfm|_u zlA!R$xWL%#{7*pp(FJt??RWcM`*9$Z&&&FICI@G@AmE*vXL@J+>oULd2y@;>HM>nxhBm(P&p()}87)7K^0IpUrTN^=ziyttaiuSidkc`?fTEBbYkt|I zk*AKU1j;lnLZx)?rF|(+jb*fmQs+UrP^TI#9=+&4x@tf6>Q|9YjSc zB{Zpde$Thc_BJ`jryp@$wBEkP3C%aNW6)lfAb|26ic`h}EqRa-go(8x*vwryduUd2 zx|2u=lwo$l@40xfdb64Ujhu`(?p`*~I)%oKOK(D-T2f`0)Ut^Q<@V&_2D|cYMbFAu z$>qI6P?YBjN^FIwI>~u38B*2L^~2UKfDI8`wA%Ofufq0>6pAr=^J3x*2{SERIo!pieU<*DxfYvh zYC>{6sIPZ}B>Ktf<)V>uNUc8)+O=ZhoAp)Dny<=8J`363%f92}&ma7C!kR7i|9lb) z1sd@q7)V8mYHaejSBi=$_YQj4L?#!zn~ms!bM<_k5ePDm$PeR@x}++GquJg={U7~4v{ZboYR)MvJKPV9RnIXA5A)?eqkQV>2Y zN5Q-kLlc`T2^%F5Mtz((-7?Zwc;AM&6?q{`AG^m$#}3YzzEQ>q_9^MoH2AKGuFJQe4$-#c$@`AiVNtYh9f=Vo6T!7`U9hUXx*w(u=sBDI^o3II5rG4UwZt8^4{j zd>78?H2b1xOAzL5xQ$|M|1csAK2o;6(&+^jUf*zHj$SCs0|hIkLKATH=PFd#{pg~6 ziR9a_)Ei(M_}pRgCM?GoRQ1DihaHsi!#d}BMxuxDeEll+k>^q?ZCjqhx(Is3NkdIHkn7d}9!_t(WwH_`>8|`l`lC&_oUPtXj- z^E5<=Ma0uE)Bn)4=tF{V=;)8mN8LQ#FTEc(Z4T|0nf7=5S+McDt9_+5{iS9rbtuO` zOvGSkRT4<%tO*XNuwyRp1RU$7;-0r`b~WndY$~o>@r{RUIzY8RES_^m)w(})miql)XiaLTA{-b)#p@l=jtgpeSJ5rUbIKrOQGv`(<$M8Rg_LURa`fP*`+ z^95^tpDb004L|CH5#;a?W&Ze6^$M}l=f5o6NhVSTiJ=C7MFdTpEN3ewNs(+6#4PG{ zJLZVcSA3%>H88ThoTAuk%Cf>wsE7bYdzCy&*p2t~?jCa>^^p=<(oOm!-=m=1*-3_r z!$zg2k2Kt<*x&f5FcQ38ZR@=2EfVxz2?YqXxIvB6`Khs^*x_k6^Cn#ur~}a0hVA;03qJ zSs1kCj=}+2em>$gO(28Y9e((=ksDTXmlHmKIanUP#^*R-k`@bgKjNe%JBgDkR$Nbi z2MmAeKUYSXa3NTPM~EVt1(H!o%bb&zuI(~1v^XUdfEGG>SYmq4s14eXCV$rZm?Q|! z>Lm|W2R7%wdQa>Dhzrn3E@w&TUdmrIi1ouXC7ycDH3T#CP087><9%)Nq|6GJqZkSC&ij4)=-WZ668;fg91uD2Y zyt;E{e;4^jplb2X;|rmL#|D`=lmET-f6HAxXGJdBS+-CF2o=|ZU z4guT{J^#Amzks5=WZo@v95Sn(5 zY%LJdi1NHAHVGnwqe^lgU-y@Zfz&HKj;8f*r(_Xx>jbH!poq~z!!+lA_bPn3qs`bj zBcOT4u~GrNGNt{vET#fK+>do6aM`DAlM^J^IICt<$p_;H9gTn2%U9mNciQ_xTHN;~ z3(~5-wPpjwJJJ>+>e%sd>$QRc14&?g0_)vuor&8qN+}rAb3U%mrXsVvch#xGGXAal z*7q-sAKYnrfmLn7f3Do;xD^apXwD86l2XfloU2nh2hxeYGPcMh;!8rO7|JE7*({ZG zOLMk6-u8l}>?dX{;)5a1-bei#iOVhceuqwLZT~Dn@#SE5@4N<4F6C`x@o*aFU@i+< zcTvtLNYM-AGGR3AvGrsLH6{A7;WBI@@Y6-@GJ7LpTf*+bYvewVdQE%zhH*<-L4bwM zJj{My#-!`fnY>GjEV}Cmhcn@Z`a0B6uGKU#F=q5Y*OdhvagR*1Sw;St7*MA4XonS}Di;`6}*r!qUB>pYE=%yZXR*L|%H-r*G|Z`af^m33{-sA(tP@Ke=R zBuIew`N+tyj+2~H5ELM$(_nUiOk#fIY?2Yh-`dKwn+qi(%o8okwS#3_A~`nF{GbR! zKbZx={)qh%9@+?-vH$D1W)Y8qrSN@kiick@%(fU{itwl(<6-l}K~D}+e$DQx1$it5 zH>tB`1h*!SuUZkrs9Vy{$5aER%ptpHN2+VvpQlbWxQ2A^et^nvA(+bx>h1#N+zIgt zV3rqgH!TzdP_gbjon@Kg-mQpR)o$tOYJSa}3cIYQh@e}h@#-1vv-d-j3RA0_eCOD4 z(R6mr24PAwS+ONqiD3STHq#bcCQ!fAcid$SiYy z9hZF9Af&9n@SIZ`Imql%=Ka6(y0UY`zTVaBAA0lDZ8O&Q2idGRIGk_Phf>x^N|&eH zLtYV_8>+wbMW_9UYo5>{Ppn8f)EbGs9`Y^W&@nTj2~K-11d8phw>!)|b;oxyzg$b8ukaXbu}g zT4SA{h<{-rX!D|HuUbh5%62vgK9`a`yv8F3G?fbycOgH+a^Mp>W zw-s6?iZUY@(Ng!s@r_q8X$`uwcMN=onRK!dU>q4@2i;N)(c z!KATXSd=swkp|)fVqYA@h?;?NbW@?PGVI88)kQ2cOlG(7xtj+;J@2r~zBAu+dMGu7 z0!# z9i8(~S^cTf#X!g(3DID)0J;TVTz;dsNfTtc*r(G!_sD_m(vy_UUaOp$P%+on%au2U zaTqt3*QsP|WHGp+IGSP+ir#{v0m?Sdo&fmupo@b{rKjx}U3uvG-CE!V{JV9>F0L;7 zy=G(|^JR_$sglDf4MRW9az@>|UUn6UXnORoLKsPlvJu9^r4?_S->u^j3X^7x{56~b zvl>BWlO!tbF4}xlc2(WqQLZGaO;aq#@+M;Ji9LsY4tg*lQT5-LBy7S6ct^&>6+yc1?+6K~@ zT3b{Mz|wCd*svIZ(kngkYHcdyf9BDCbrT-(A2!X-0y^rt3i0w_GzVQWsNsjt$mMk{ z^tqlJX+2ejwK(8TJ8%Biny-7UBv`!cdS4u874cMqX0pzW{QtshT z#gcVzT(Aru44zS9SA-JB-7|(|WB0gm>q!{0L{vF@Dlc2qLvc+EYRVr`;z7b8yH`S`qI^z7vEKgLV<~p*lEd?^?Ee z*AQ7tN;iN{1B7nk+<6x$6a1DOr4s z+JxxothLhj1Ae4$mkZS@vO|WDDXJyNzSFy@ z#Mz+_Qv55lm+XQAAUbQ8jkr%2^+l;ara1R>)W+Ik>A4)lciBaAtjI%b<=yUtmbIR# zWZCi{FP-MvMXlPQa~2}nP4e><(l{)h2Di{XaKyl7Nb&D;veYa5@P@0$*Cp$K5#-Bd zPR@h$3abf+hE+VWlQmx$#NWgIPiby)Izk^Pm23=J3Vo6AOEpAWW*$b!Fdm6O=}@qo z%$Esu^F22x7P#vadlEM{rmb#KE$qU>hqsoLzV{SFQbPv`@;P= zj97iGm*)|`e{loj4y`9DZ3C|KE8*UqCdt~1i%&Q$1DDl$Y`hBfw3>wnwos+uUZ^Fm zcX+n3=n>V)xF&mZX^;RlcpNfYqOm1HUlLNOw-ihzNTTPpCf#Z&)sm8PpsbdoCxXku zM-~JEhH=8NfU6h1a104LSg18!ZaGS(0{$xF+L~NJg^{dbUcYW`(5(Y&g+0*tnQEyt zj=$I0xa3Y2C$e_#Sk_^jt9zJ4AKStf7!TugCBfeJ&h%+l-a5lPv?$;m$V8=^&5dVXZ zY3ktooLcyRPZg5-8{`HXr$=0RO`VDoMdd~ahO)(lR=SB(ATMSf+#fPot=`4(C^)DH zz!tqUZCd}Y>oyr$0xqj4P+zbXNqNvRkVU`u&s2tOnNyBm0-J@-__u%dZlaL_U+XSU>&M>Zhxi z($AoG5oofKH5@K6e?|Lh0I(?;x1j`DknieNKK`cAzuc(%XH|DE)}$b4lalkohCVO< zufxsfZqAfXK_yvGJk#E3rstj4{OAq1%bK!Ieepx>s$4C!(yaL-^TJKvVgT6{?bJ*- z-<5|GxFg?Yy{~t~%2gHsW3azHx0g0tGg*@;i%BF;fnPh;eYJ5gI%%q*U7zB2G;ki1F)zx3~)l2&o#SdoyhF^ zHs?N}=RJydJ6Iu3ZxJs?`g%ofivxY>;rHFB=eazBrxGOj)wIfZm)1tA=1$4m)LQw35KjoJL{KeSH6hSE%+3suoaF>Bz}vNR_eY*x%6G`K^Uc$l0 zYHSy9xSTG;T-Aqftu)x|eQ`Vhp-__nVrvRYw59hx8f5*5H09SD`?0fp24XDnK0sAi z@jp}w?Fjm3{fe z9Ywpx{$E+P@p@&MJ(!T%D6J8fhyyxr^S?s+@G4BP6w|8L@I6-^uicA_KV$J(80iIB zS!xj2yunQ+{#@{~$G827Xmwnp{4PjcXP>BgQR(}IA-TTdaVLg#lJ%9%6?vO8wxr?+ zp!^aPn46o^(gxr9zgxA;y*&UcdaQf{ut&ta?bBs=#)kd-p9lFQ z<^ruQ;FQL&i#515%gH(;J(%UBkVLdB`|EfaJ6wqIyjBThZhxI_Cz$L$v$XcGC%Np! zeziL9&f|7m%Nj+71*jRGTB0>H!MXaXyb=|0d8PQCPn$9e_O7Q_Fiab2idGf=*0#aE zh<{Rs1#x4fbSD(^vN&qqV@fgbyM6&2cV2BWw6|SWDdLOzrM(G9e581Ah!+IH5GWtN zo^g|qU%d3YRj$H=<7nfktoE}tTh416=~PI;dy zpQ{QZv3joD4cpF_(eJv-(=j7p1qmi;0H1aa`2HN|#^&AN@+g)K@oDL`d%PJJY9LDW z8*nvg*ED2xYx(u{ztnD=?zI;TWccZW--PP=qNB#I0CuHwhr@gW0q4+4_y?SyI{L^U zhcACfR&d{>O;2j5Y!yySU(x^BKyP%}v6#Sj(Oas&$gi8V(6au`v9UMvK_3(Rf_CNi zKl(8bYJXTfpvJrukNdHh{>)3F#df1g)8nA_s(gQhUM8d0%B^l^rHifKO;%IZfAJdU zA#7sm!LdB@S)}6nEK{<|zEud~Uu@-2$FOs_Np+W0bM!&iV*o~Qun5$CKnS|*Ipb$f z;#dBZB8(6i=!TzVJPQ$CW@)7UCHpKc9Pg@14d4FYP)z!TE4{~F?C-d{&v{6e#ga+Iv5CzxlDQjEZcGjUVb9wz;*Asd8tGE^a$$w zB(}oP!uVqO6|>HL^?g8)r5;9A{KGwgB2w=F@6g(yZzrUHRX)jv>9|#k?QWDcgWelY zopDe0`>y#LK*qr9lf@z&l~k~TC(8H3n9gK7Y=!%z4vYBTIbEZ)Lfor7(!h|V>p$>} zIkJZheCYI@9e!i0x`<1su1$w}@Yfxzv3KuE#Q0i2=ub+^Oq9;<#v3s`J9mGu3?0FN ze%7o<5YqHmv^?1L!=n^fg!N(&21CxhQ#||aQ_svcjw!4UwK)D7XoaiMopT&kP; zp)S89sIZ|Ae67qk>>zQ0`|#lN#|hzhls>=z@vwqI3Berw)$WSxs$^RljULYU;X=)X zAzs4{)c1RCA-=c+J8V8Q<7Jbvb3kQDc^wzKLYjZim*JA!P*Q{D*JYa8N}hAn15_8< z$@zAI;*;y!T@>4BCO5`WtczF__yXIP{Ve9Y?ub$W%@BaURXZLrk6^=veCTrlx|@F3 z6`MEP)Af|#Ig#gPFXfJWj2=6_s`^THg8G{{q-O0JI2YRa|7dy(wkW@^ZJ1^VVQ3H} zr8}g%1(BBSZj{bp5TwCEKpGT8x|4iK%dvyZC&LAk%i}Ar^KoAAiR7P<=QwHKUDyk~Cpdw%2MKqw5KeR!Sal5ER?n z!1M;|ll0${;X`E@MA^Bn;JBbQ9@ ztGxCQ1+|6Sd=>Z+17?dPi@)4uPJt5M)aj<`o|*P;b2wWRHvoVq)hFN0ITmLTbw}tT zTH@qy1n(vX0X;ZB-!6ZY*OMbK@p)k%`UlF7`CH_MiRpNUOb`Fbt#zcpbbtkv7QJ9M zljGnKMT?UI4@ambvt`A^6(*1m(0={IX_W4!QZH9*l?fQx;6=mcf&%F;>g|6p6MMeB zLE;&eW)rqTkv6uosPr#1R0uX-jpDN7(!Ty_X(7&*fPBiog=1KtvYvslp|Kv8ge|e* zM5PXTrPet^(xbv==IZ1ns<{WH*-9UI&1(Rtd{G(X6~O$!)Jf?B(CkTO!x z1bBJY5+o@=8yDaqTzdzdTPG!`d9~*cczr8U6Y{F2GZ6MEtk2|61|TSL+B;uR8Y+k_eym>>;@No!_U`nu0@0 z^hD<@?z>M5;LH7WLp{;{W(JcN)Of{%dtAc=49GRoOn z+|*d}h!KB(B|$Bif5JgNE%sTdNlqT#L(s_mm=evgu1s2nWm{)<8^^(nJgee~A-LOX z>HgAW@m@rRV=`o4_>!T(6!PYFi|IXMhJ?P7qNRN3v^4cwLf}-l`fJ_|oXREpy%NKQ zhMx-i%i1#MGdk7;9p_b@@M9hfs)EKxzEa4?OKTKV53NX=wI$9U-f`&mR@;&zxZ}gu z+P}#oFhwFSfmk&rqP78SPx`D6P>aBaJH}FC0;)OG2kYNTe zN8mfKy=e*dd>X1ZNYGzPn22L>o^L_`Jb3TYt*x$X`ZVpYx;qm#lD$4yYd%N1k)CKxIwJrg%M!NV?_kCts!`h z`C-*(yTE0|dfPrqz?4n*`K`j|h{XwC!moEhG}m0bJi{koytF$pBma8Kde5jFotc3r z3><-KipdWNVq4~s#^`!srvB~uI(8L)zwW-I_dzz^vgZHhw1H^Mr095BJQ>DTs)PL+ z#I?AjnwXHE@NQ#KrYLIH3pS;)NQa5d1zcaI6;E<7%s=sYbmMS9N2KX^PG4w`tp;^QKMEve^;>YxEpWrW4 z!GcmDIaHX?twJo9=FK|kuqV#zds!<&MnfDAcXpz9zw#F@t0pVAap6X_?z60w)GA1S zsvG|b2*s8#Urz9J+_4zWEX`b_+?Xl7(M}UPkHktG8n?(-$s3g0spLAVC)i;Z#N@hR zNu&^e0y{G1epNN4h8t!zn^)|6z(|b8TTTm-CAAJ=bl(fjig z@u{7BG}&0t(0sCmss`M_SqvDRytf{vf5Z{^SuNvYZ{tHcUkB|kxwfqKc7lZ>Zntjy zflb}AO`YxsiF=}rROr(b4xGJ@QhD+Dn(mqJlEnguOV2HUoXn#<72UrHhxuKTlRTJt zvK);PcOPcXm)#)CionK18FP*XG+q`;F+~$|!$wLMN+i2U(QC%=_AEk!Tq_R`1p7q;FK+@s z@^hG8+z`C1L?_SxdkEJVYxhBsHVU>(fBzsxvI%U37XPjq64Eo^g)z<@s3p!FByjrVviNk=>euZ2Jg^uIGvG+R3dxAF<<;syerXILvZ-QGBm7<-;nnwt%;n zO9rbEKpA*#u#_O%i+<@aad3!z=Q8(Yj|Z(3uQ`8fuX24sd-vfkP#d*Gf&G}Dk2t;I zoOdCykKfvCA_I{@^_4w`Zv}`>Z3|^jT)b#t^LaT9=G+7ufGXxL`W-D^*2?m#d@>tx zI_t@33RLT`KrWG4c=KxlT!zyzuZghU?|WqrkSnp$=q3$l`|a~5x*cv1-!`s2@>UDJ z^YYpTQlUfXSWK^M+}ax*fj4XtnU*ghyu`;jA-YsH3%u7Mm5uARb_etXjD-O$ri-c$ zVuD)zrqUWIN8mdnZB0xu=P^!y%902-c0hi-U4Jeiwo+CYFC}_Xr_l3qaYqdzx}!)Z_OQ}XvnNDpSXYeY?ND*I%S)v#1FVHi1`7h28ix> zuR~@7xRN~}f(Z$5W9ZL~3WDFD=R0rlmk?ay?xX1QkvH$C)&?o?U|20xiLSTEFvFp! zFt7e~8XdKBE7lsjn>YH)dg@!Y|8AYPAl)zS2jC?3Tqu|a!6!X}3ZY=jiA?w}yhYj3 zG-$W&cygT9G3ja-DHH+u=)Vej3R=rGv|#qD#N#4?>YzHBmjl{&1@f4l*i}zl7gQ=C z%FiwAfkyC2Mds0=uqaMZ_1PP*aNQ?+!d6s!y%MOBIDzh^3DI}J{g(I|{cd2>pAT~n z-a>b&=2+TS*oJ3^z$33eSae86G__BLg~0>|;huMo*IYh`MFW>QgD4Q{4ACdy+N`%- zC7hkY6_DYvhm>VE&uT3dWlmJ2%cnds#N1>#-sB5`rU8>T(c}GJFa2uY3ydd<$~VFt zatf7*Uk}2@nmWK8#Lw5aGy1Kh-rCie{Syn>wS1BetgpSxa5|JlxG;&;A0B0&t-BEz z2(zp%9tLkw4&4fnK?BB~@$YjHor3W;3w%HRg{-HiAVZ^0=2|BEu9m3QY=W;1w8_^B z8Du!OdhHTy73?9Asxh8id>nx~%GtofVZJ6)Zyr0PU8z<}DSnXkC%Vt8-&xvNsJ!|d zg3fuia_QAiZ2zrp|GVdoi*KJ!iD29;IP|wU z@nVVeGX=={v ztM>%wt{n+LqqD0rE81V)oIFbK+-fg@k5h1>9_do;4dj>u;;)HfVp{BiBaryaasH)G zaHT)L{W^r!S;NP$w2;RAb62co{^u^+;JyRj2YX4e9Ia9KJ_tGO>u)t(;u{Jn=f&9BwB!fbSRb(HsAhv4&l z%E@uvzRFAY8-sdcb4=-80bS%J-pY>KbtRsDOSz`fr|5{LUXNWmF29<+$o5?+h0>@M zz*oKLx34`R{CIb;aPb67tuE0}EDMA^%j>87ua~C0j(I<@>0~wpqv%gtvVSuoXoTxW z!yXd188_E*8;RvgVCe1DJV#e!Q<>JqJ`NVVaKvNM5($mkkNj+f1 zH9BoEsHY?W?!3KxYYL@GgqLGl-j~}g99urUa0MKQFIqM$_0JPwY#0|&9%;UD6v&F? z=7AXB?IS1tU-d>!<7|9Z12@K8jYdmIvodRyRES$%*9%_v2j4IK82{Ko^d9^EqR)vQ z;zSlraC?Z0>8-hm}zVXfk>pv2_{Yrw!Q!Hrx>dnem@xN&l z>V7}DT>Y)Po$tQPMiLSy{kw2@=kx*XEJIoE8C2QgD8h0PyMb^`wEa?D9@AY~LjpJA zAlTb^PfdQDt^VY-I`=l2Nn#C9ab!F5bCQ*ohU>2eVfc%j*~T{Rh;*~_-tJoVa7ls7 z?;qqoo2?R`081Ov^;D>!R{UFa`9~KgpGBr9X^qsk+OcoTj(Y!4T03tEa0Kq&;6A6S zn!8>-`lR_y9%5)7zpu%T6-rCQ&5!<0)WvJLM@g ziHHV2qP*XX{i)SwOUb5qQ4lanW*@O~hUP{yWw3v$z{y4Z?LrZAXyS!dZ5dtp5GBG+ z#@QZPsUwU@AzH?CSb6b~Rj9?JrDF9fHKmH^N{CfQj2l*-lPdabl3zoL@%0@L2HQxuVsUifS{h(E*0> zVF*9$h1TxL4}d9)0T5xf6Q*T8vWX*BGbP~K?^PlCJ0k!yAQzg>^om-gI-p%(iw^%= zO0YyaLDF(-wMf)i8Xry(Q)(p1G}O);2+@A@5)cvWQN9;) zx~r<)p~aFiIF1VVwG&L@_q+vloO`>AJgtU%ro9SD@11MY_T_3RVPxbE-H06oV<*ju zP8rEWQA&Tx4t&4u*pecOPEWSV%m>Ddu86CZUO{+V2%@SPTf0wa$iquTpM zmzRqp6A8_JQCe5m=XcPn4JPI0I2VxeIkkszlD@i|5GWfmKkVeSEmYc!8qP;(mWmQ? zc5c1?Ry)Lz4ABSyC?8t=0|M#}YUiQ1rcM&-Ta+KJ7pN-GtDgt{JpSb3koG>SYV5#!n-TyDf6l-I0Q0F3Z=lk=2jMd@=&274jF#U&F*Z*+ zJ*-MKt~_5fD5-X9FL%sPGCv*I94Dm3(cy}c9Vv(;y$*Mx4jd5Rx)omlMGTfhS9?~uNZp%?WCMtio+oV;eL z;qTOMVsxDU$*TKHd`9Mi&4LLA9$7R6?Dfa!x~0V!7cS_Xh)KrDJ$E$+z!0C^fgn4V zHjc-e0U|~PUn#W~b=Zr4(OG^j(uiBvxXpSPrY6yw`}N=oL08pgC$8hK^+fM%-7nG9 z;m8A6q%PB`Ydv`5-^ns6(Nu{?dF-PG_QWhlESCH3TP+<55cGKwPZV?`LTt%V9;K!P z1+BY|RX>Yp0;pfb+LgbJS9B%!jkj*E@3Fx1MURtJCt07*5Z!}@MW2k+E#*M#7 z84e@VH}*M*=M!@%n+c&7tish<7FJ}={(O(}tx)M5a9Ur#EH3hw%(lC{CM8XE=V1I| zSQ2(qhN|oAnS_9OM9X@Nq$le2fa~kH2W|Oh&f!R6%x!`n<429TzqQ^TnR3|9o6h7_ zsYo%OQLbz?;>HsnpQRd}J*_0_$3mha4<5MN24>mLsfY)Rr7(&co3F*)F<6Y zHO)Z8Q2A=cQd)M^y58uyE`P~4Nk=h}Mms;;3`GBDW;R^AsisG=D<+i-x0FLZVoSy= zdigcUkN@>{XNyT&4Dj%S`sD5*(-SS9@YWTZLLq&f;*Pc^C33En)(7EOBMxDLx;FD^ z3hQ;`@}jc%dH?3CzH86wcTOCqwLek+oaPNcsJ=imknR4q{GUdi5lT1{o=GI`W^eS6ne%aE;f@E9^-K8!lEJ6<>4zW z){K-HCYh}45|qoB8}Uirt0zvUs_GAA@nss@m9Q+&v>o8QzvkAPDce!uD%DWDqoU`4TJ6`N#f zY(pR%fZZ&fSiF(+wX~jFblWf743YLt0JK#Cca`pSUdd2OY2v5&eM|RSrt@78>MQ%m z8V(>U>@m4e-pGpcmcCr1mXP6ffj^*yjQNNEzrrNizZ}pdgG@mTaL@T@k<>Fp-NfRb zIez8lzi@Sy!@8@M5`0uKdXaG2OpE!bb|EU=4&Z3qKDa%&Wym7VyP(yi`dhgCL3Y?Z-XU*ISN@FTW{ZL!_VH7{9E0b@qC2y4QE2l*G_TNq;&j2ms?RSC273E zP%2>P&%e65x!4Vv@%i}$_+HypDh)tAFm-qqxp~`tt=o?_o<)9PsZfYXBuURtIK#|g z>bTBb@~7O}Wx$!rvZ*)*^UVZYV>#C%HL=sh8w1oL=51qob{(wc0CCDoi=!gmpA$r4 zoM;Dy8|S?rw~GJ_Dm*Z%qf}jIKuP|n*>;Fe>1Xh;*HL;Bu<&zHO*81m$cilsIaLpieQ-p&>|oJeU-E?z~qY)CqC<^7oF z!x6hzW0QRD(a0R)puvmJkv%?78!hEV*E*WM0&CYtmmD9FIiBZ56CykW{-5_RE??Y( zO9~M{cfd;_5;U(;mh8xbJ>J+1c~zAyD}biojRn6Epm84V>OE=>a`#s|U$BTB@q$N5 z9SOqxwjEa5-p?G37{Ude_FGgcH?;r#8ZZN`8RzcNf0SSKbKW}Hk4kAju+`IDWoBl; z8Ztco9oC!C#AwNtg^1sJX)u(ZwXX0X+%s9>(&*|gdUjsQ(b5=@ zXy3Imxypa5D^W|uC#Q~ZAcaf-rrGjMk*m~Ep`uJH()&}{HQQ;9AB&}8`2K?I73TNz z3eU1m0{Dn-Hoi5^RKXV9tOM|FJoOt5WL{22A#;${G9y>Q9Dvmv_ZChPllEXcM#1wanVhO z?-G;JkPW;YZW=?MT?BXn%~ON!{8YoR zw#5cXLmqO983ZobGM5KDZM4IbU&s?`ZuXN~ilR+oZk~bT^Rgi?G+=8z;4|akn|Fis zDy>6s4e55E<~Aos#KjxZz#R=Lm3F}QdUy+Y>%5g#+pnaJiN7QjKkv>gjddT+k9KrWqh=|KK5- z%kcPiL8HjD)F+%Z$_N0Mc05Bce)GlVa=h<5>`ei0YfPrHReJ+y42p*TL`2FD4Y*E` zI<&%Eii-TEvcg{sj!EwsvXVj;HC!%N(rXI17z7gF({Vpt=?mh{Grl*Olxx=?*<7=h zkxsj0498#0eW^R>&hcjsvHuI zQlL|9rh0#NZ?rO{2Mma{STZA4>T3am+&8Y*`C*F=Vuvn5xMEs;u5`Hzt`P$AxOXXl zUs9$xq~tefv+_g`&|p)fLP$tyl3fF2dMp-2{lRMtjENieOTAYQDh)M1oppzc1gApR zgCr){F}0K(Aw9xl&Hg$U&%ZR{fns=xzdBHl+qN&4mgJ;M_ECv((vrPfIMxow%Wv0_ zZ}PERjuKEGZu!O{I7^?Ods6H&Uyv+<8j8_APbp1%>ZQ)npnxZSuilEx0aso3jVbo# z_;4ft)Mmq=lD6LvU^s?KVZLRPMJ_6+^PPg{uJ-2`~ z02UvsOfR%yro0QfO@QACMja~#HSl&M=_!mH9=mUclWt*x@2JEZ0Ak7P({lBol$*Bz z+=-kH;DyLHR4^iau|~t|e)5xVvmZFqz#uOwNIjR^=`fkxrNQK%v|x79WLqS0qJAS( ziBIrM^Iqf8-l+qC1>+^LUgl5q>PQ4BB+S)Wybu}otm$5>bNX|C#`*j%9>D_R}475S+jFN`8n_{qJ1Ojg(#;GQE4_`I8{#}*~ijj-6QjLj+^8l(5_ z;1eP>t>sF)=61~`pc|uIy2G=tD`9-0H#fdSXR**V&F_7sjda+`U-DIdo7sQI!q{aI zN5AfypZc6r6C8c8^H0;rQ{nHWrRRJ!=x4Xe+r%&mf_BGvw;I10If?xZOD_i!)K_!C zHw&S7)cE_FEyepCAoZ;QO74U`laMcM940yLmz2K^i5KYci^rBOzy6y((dsuY1RViN zlNYG-%v_)@mlI)s{jOe6c=SNG7|j7#|tQq*NZL;(P$$X4FKyT61}Jo zgN#BCOhqNd#UjWZ8&CIT+d z=$kkmm`?GP^TUtPy_vjm{SEP+!HM$n#>@*}H#4HM;U5nRW_qzBdOmY>X`9lioIjE| zP{O$Epi?8S2~m)8iZY~6I z2Xq5Y$q!K>G|Dn4OZ!|@Mo#8`ykkmr=l&LM&DZ%9Lw&ElHI;3?=R<|CM{l;*<7mMM z`7njAKMULqBZwqW%1XIE|B+vHIcDaYANO@3rHaOtDIRP(z1ZIWo%YR0JPXNCKW;Sy z^JZRU6TqDf2xGsUQxC?LgWVjsI52DLGP2GwC6>8h4p*2lmjfRoOX68$^o@q|d{4)M zg8QnoO66dB6)7#=SYwx}*%yqiljh%{_s&Cdp&}zkpBG35C;CFmG}LSfsqhwCmXnu8 z9uW59f0ay|W%Bv)K@i4HwDB~=oYq?}&z~O89fAz-@bGmsp_7q5p89jSb6ZmS=5Do) z^*;KsR!`5}S(ojd8Q2CC?Xy$*+PJaP)uF1*l+R4SWB4u&#*Wm;5wol|a+Lli<4=oL zUVhYs2!uu}^fpN=5W?$orzl;8bITJLO%4K&lRAV1QFKp!bmDXCA2h=M`-aI}x79Ds z$e&nR89lE-Mw$JLROV>j+BUnG{rddVBcnNk1ZnY_v78#wyjkcYChYKYmA`%$EMkfm zXR@XRxA`-ET0e)Cr6ArZhcZCv$*J${{^=Vq7STDe9C9;kB6yIc{GF|}DS^wE3Fsf& zmS_J~vg2r;fXD^M6GD#j;B~A0>_a#$g*bMce2foAf~cCumB`fR^tuv^U+Rg9ia)E1 zwh})N723L{6TqNN8k%OVzxXdCp@H7P0NjAjA(OdanO9>BGU%Sm2-^#|(yK-6&_q@V_ ze+#Ra2|$4;FYei7b>U*gc3HNm1emZ0-W4Zw4A?#-z)6k%)?5Rqk{dM(Rg9VvSlRec zi7x?CahEaOCl-4NN8Yn1qDSp8$iu6K%J+d<#=3IGyJK>%2V@4apJIlD18Ou}ihzSl z-*%u?u}(gaB>jRASO5MX48fY2Y^azKWy{I^i!s{2;vB({S>y)f&ZGhV&eD`(&>-?< z!sLl#`L`|D+~!`1d@qMR6Ld@>!RKe@1-tD71!#5UlxcY+XluKNXomUF#_#66%JwC? zwd=C%8O*I$&W4$Wz=A}rI@Z#mB2I3k$*^oH{im6FL$1b)F%5GHvt&?Lyp0xU z?cxn4R;AA20ku#4yHZcU#x-B%PndPfnG~V8*gzG$7p<-CE3)kH^>_`%Xh@FwB|Cy? zMaOg@?3KJagQD)b_BR4jV@E{#0kzqxBps$rsT{>CPs8)7OgBoZD~5`ip#CAMRm9Z%VHBPzYSp+>UCZcJD3$Gz=HGdmGQ1C?^M|^ApR8E~QT-5#U$A8RBeYc3Yc=aRS}_1kX{vrrJBuk6r%-jrgzeN;cSe|?JfNUlDECfGwDgM&Sg>$+Q;_35pJ;Y z>hVY6iE-Rx-+Tb#2w;^LxVwlJ623KfEL61*pntzcs7WClrO2=sAF3OeMDp7b95Nrr zbviChxx~N|mNxQ<&l)B&?zE|{KWl)adj_SU!K)k&5w<|K_%pPD-Oqw5(12y;mc~7F ztoLLJ7`6Lo)Np^kM*T7Zi}+`b2y;S7iBp)wK8w%aJK*Mt2C4_ zrN6*8mB2%f*Z#8>N&q&@ESOXzP+cG079-w`OK}@gG7SIu@=GZ1RA1JFMz6D}K-iP$ zaF5Q7oHWYRv*q1{PV_EC3bg%d)uG*IjjNDUabYh`eG6Lf;8H`4Jld3D!cTXmEg!&3 z-G<p6~vmvVo}HdyS^OfvoAdTi6*GxPK*g5o3oikeu(6w+S;yr_qRFc6xqKgr?8#o&c_ z()z?fzVZ?khqM^k)t`(D#jIXhP?ph0Sm5IiQl(NQ=@a$)OuMqF>p+sM{5W7kNfLGM zjG?CE+d-8#4jo=nGKc4JGR{{Lkd%GmfoDGn*d-8QqGzw%7SIMmJ^Q68CVV0Kg7tUw zkrIECZ{tMLB8D6F;I#(u_m$NsM%azj&n?XWDFA>o`>HTGAPXAR%aO_P<#{>SLW zzvmX|EAa3;S8z0yqoU!X$| z%K!I7;YNkKIso)2L2(Am2CX+q9GN@n(VkwmGFS0*pnkwpPRD$Pyf(U{I@9NLc8id8 z+w^}SM=bt*C|As^lkGx1Hl$#P9($v9QBTq4);>b&B{Wuc;Al6gpXqi!ZBN=Z%+k{4 zvQ{~4J(af{#YfK5&PNHN#b5@E|Kz<$-y3}?DY!Ru42+yOi|<6onWOl>UU|qkFTBxU z!1vr7rmFdUls*4_tFijB#V`8nQp70$j zl5U`_56m3Jrz0k{0WIogRym`kz>Pj97GSQMQR@QA%e%&AYS>0^$04wnGx zWJ)jWSHMu#=S0{{NCl28r|l7sX_Jw&sF``0svE}fsn=)lvF3kud%goig8no@b%WE) zt&Pdk8q%K)8WFJkb8{zYlxK>mlI1>*z8ZVuvqkmyx)P}pKpW7F`gk?rO2UQp6ZLOT~vV#YpDKO0}!y(2WT z5O=m%?nWGc=v_5Mnwu}!cjQtD*dJ4pGKk)6VCfmKA*TUQFkZkWI;9V=w8<`X-Xh`^ z0x4`3Aawi>oEP&4<74dUzq?A$@YFhxj@Ag_+3&hld@)YEfsc)F=|;qF>6=IKr^NGP zvYoUq&I*TN3ZQn0^E&<;2x{@Z=#}QX@cEX z2(B=^#=k@tl1}q|KLVTa+riPYNm?A6h5n;MVr zyfhuYa`r|}2UiZ5j$UR1C#V%6ZBwbVhD->jnYDey5Foyg{NbHAy|KpqX^%(GK*L9L z&6$EN6NAx!PtRl90F78mKq5OW5`P~I*orro7YuvygC;*@(}-xR(1kP8nah(x!{V(* z{Wv7r2j6)hpzKzE#&2;%8#rn3()*ty(gE|VJ49Elf6N^ z!IeY>V}c~h%0EYx1`6WX2JUSB$TpmCs6>HXT%Hl)JLs?H=h9tvk<@H+?el2YZTa#T z1ytwbNhkg52pJdt@r@2sF(>u<2`}n1(Bb~ZI2ru?XH^^|>Bh?uGv1`eVOYC(F%mz6 zP8l1Xgp)yBZjSG7BfMkk#6QZgDc5{ppv9C)MCE^UAOs zcRH6QeNPn0tPqdzi931{Di>nd{ryltuSVo|2)ewjX{1pIA>FnQTye2Ty(#6<|}ac+J<>D)-$Sva|MVVd=rucaI2)E1sXI99wxvG za|&cn=OgZIC?yTTE7OFA{WR4ANhW>%N(~XJBCF>!XP&>loYg_zLGiZkzt&M!Z;E>; zoXng6pIOq`16r@F=Qx{CgnHJp@}wzp^*dn9`rdKv-09B`nAg}9zl{66;cE7LG2gg9W+_XC}v{=1ak+`l@>T1&OjM`uV8(<^i z_Ffat5BSp~AcR~58+~_pBZgFH4?%)Hsw(~6#G2l6FjhK?n3DD90oPmUZeRvNhZG5a ze&6PI{_v=f4S$i%H<&aSOs29m$(iw@f7 z0W%i<=d@hVK)q)-RO+q=2l|%*@?{5$+2=dmF@%7>(iVq1u#5Wq#WMZX(o*T;9X;{M zv?u?b`r5P;V+B`-cvX&Evfha@_RY2COy2w2g?aS!*;9Jw6vz=s6f+d8H7u(Z6>?xwD-bU^xl})@Xdp5CF>y-$Lqkf@VdE}Xq&&64N3MmHqt zSEXABqEa=_!njdt3@c!Y4&pzNIzfIqYdH);9diEGqUC z*OE0JM*ntrEFf@cQPGdqj(pRh>3Ja6!kadKT?+4OgB zW8%OnM7Nvr%&!QDt3u*=^bhV5{u{VMw?t62fdiyqnP?|)k?Ll8NEV#;Q9z%pJeSj9 zyN$TclyOTgCsHyS31np<$jjUQ7Sd2x-zL&w=~>z*$pFTiD%-ws%G~f^>c;bz%bLR} zqV#>2r1e?vPYZ3EVqM<5(xUhJkHm9bC$sX3fNHY?TKsg;#loML)?Yk?pcMM3KNCEl$uU_ESb4 zj>|%@BEjvhd_EMw40%y8ga0+&Pym;uVz)p!f@3?~u~Xmh?o6UL64gdr*5o!Bs?Zp$ zXU~b(0JeIul^wa=iMvsaS>IhCIFgDUo4-&#rDqPgJ2E*h9B}CWd!5qCw3fu@_t?EO zbj`_~n#o&&wSm%e}Y;~wC5*Wj)~F3*fZ+r~k4 zYqt3;m#k4d09N9%Att!Kcxu^-K2rk%RGEi^FxH5sShaKMn%A@R2OoaS@CDrcdvwdU zwvL5wnQhha$e&!kp;hn03>$KD1P-xs*Y?bg?JrJZ0$@=j3}xIztPIr^u^fSKsk&3i z@>N3li27ujB!BaRHZEyPv)xBEmhm`mYujsmXVtC*JxrH2{Jk5vU2)I#dJE$m-v^KT zsXKGbc`Vv&yKb$K#K10|v)V)x>1mB0cZuub$9Mdi5&^S}VP%Ep0iuM-ig56g`&pi% zrYg4ff&h=Ho_*-%AkFagGllELPiwQB-cg0d@fR`DGPWr^nH-i)k z@#_hVjZ1|xXB+}6lm#2V7^c6~TLTei%~q6hV_p zhid-J+u!8nE~JY5WU#z8)Op3-sQ&L+Zy7AP24mls5nRv(j_r5+qg=e^#gLD;Zo|u7hwd7tU(%gd?FcMa8SLcN(|;3m z%U@=Gczu)LP&OL((JsUGfw0F%gZM32*zu0A3qOdS&gb-o$t*1l7%a?h{5@BQ-caGn ztcG8?06uv)zY$CRgxGH1dnH~9pBH6h?DIdKQHKuw-7Dm&_XouGWF+DZ?{#n42~Nd? zMAulej8FC6u&k3}yCpNbIA@t3SKa1L=ErHmuG_Nxp4p3?9*Juo3~attioq2-)K$Y% z7Z>Hw#2Hei=w;Hmmm2E?iopWAN^;8Q%_qZ-8K6B1^0cfI6+>K4OUvSv5kkr@9b3_K zQ}KruIy`>C!Z^ZhAWV2sav}%jp4ozdiycPq7skpir>6M&A9Z!i-u<0&KNKrrr*N{e zFV=pAU_b&^BbYZ%*d~hv=wZ{JuQC2jD7`gs)UyJ4932z95Ul2sW zL9}rq`Gx-M6l?O&Z0j&`<2dIv9bV;oDInr)>5S?bc~5Wb2{uHf)7Zq`R^H!-nHCQc z6LGH=o;<(rOZ<#HTBLMjgJC+h!3`U<$h%GLK3V>s8m+N*PmVT-_DXA@p9x!(lv zH&H6$gB-?qyF6veoGWQu>Lz;bXx7H571e1`a_H%Ei|B&N^Y)jixyxa0C9eox5aJU( z{5-|d)#Ra?Vi)3Nef}EdTEP*XmUfNn8+#+^&(*TDhi){mEJ88Y))Lh*%@J$>Y7=qnk>$GR*m|fSR5o@j`BRoIToX_=4}~Tt^(vpMZ{ZSaq(V1e zwVOKY);=svfvTu)T^*j0IjHav)ipn&uk4w~awBZ}1`|ooEY+V~M$w`vmU?kSfOpCv z;C1hZ=NRg`okyVdH$Yl=)iY+hFOKt^F^i=6`XrR^Hj(qYl6Y3{<^O9ml8&dyAky#7 zJLsQ1G6kR|BPqIv(r+BTP^dIBfuPgdXHkr+c_Ij0Gmk?+CT!7q#J|IEM7!C2;vrg$%$EX~xp8$reqGR6e#i z%k}UdOs!w6eacPWoF-9yG}7qjCQ?~BvBvwge~raxRcZ#-Of)YlwMEdMgE)@L8n!Vv z{S+Zm4(v<18vdC%25TYm@OZT?p@PiBn@sLD5(gKqmyN0+H15M>vkBjt%}se}gPHkS5f&n&RNx zy?&a$$6UAMJS$H-@)f91Oabi}?Ez|l*qgPzDgBHAGfFgoP?-izMgP@HkQr7XxN%aGod7lOY`f6AzBaZ62jRiRyrV{9CgfTI(hH+&~K61}* zaP$aYTXOR>F9t2#YSmb17Ee2p1KBC4*r#)=n)U{(HXEZbC$)^Hy^RNf%+T z%=WARZoo@0a(V$jOMQ!UmD)xiQ##=(A^oiwtnI*dF1A8E(|Ic>#bu}fNMLQI!K-{Y z&oDg9UnQ)Kbl$3Fku77FwTZ2`-`-bZKwu5d4ZhCHwE+xAWYRX2HK?NS1~w_NiKn^` zJF^nr?NYY?xl?aESI5bCaEt&VwG#2az*=^86cb?&02g-RTm@NIyk@wPYP7OIOG#$j zN}6^9<1d&XjPk>ZWcE)1CF|&7^t9pAvwg=@h>q+YaUYVQlDzZ9;T_)(+m_*!AiH_ZqCjfBc{;Zdv9ddXtWTk)lS2;v!l;N|31 z4@Np_l!&5k0Z-Efn)OVk#lJ_38@BOVO6`cqIg%!7^!yMYFj}tbP<5dM7o1xdU3K$9 z@WgQ8UI$v?sV45Y!UNO*?s=T!(vR~%X9;mua=<|Sv(GH)f1m4LunbJ(-cm`Nh*N{T zW6^##z7p}1t&f$*C8P3%bE!!7>BWZzMOj2Eq{4kb<4~D(2AKRF0?$IyIWRG&9gWf- z2C1=;2!warDwg}zmyx0j{kd}nV#Iq8_In#2vTW=90O;jBUeY3`XPg@zW2D1*)?iNv zER*tbp*2%%Dp5;zPn1NfUZ)~`#7imkhx}=7Yi#pE8XOXi|15mXsN!?-4hi3zq!*pK zoIErRZDF0=1E+-j;)C#cKo`jNtoZk8pg;qlzJX~J}vsN|8^D73ThZpNpAYzTlfNe z!p5M&QjG~jpVqjjvfNDEYpqfDLYd-9E5K|?6Gb0PgUBTw}$b6*PcVZ+*nX*Jfdac z=Ky4#UrGyhT_b$EzWNErl5qDIfnQ6A`?On-bDWvKn$W>h3I7IImTJGKRO#K9|GnyP zgi(aPMyff19VC;k2vBka3vE{#|AcN2;U7K`qQ#Pq{UEKV(xHwGw%&(VzA~wh&&Y`^ zATQ#Xp9??cnl)@~WKT~7hx*nW3>9CIh%R)#fS zT&;?nqyu^%b+Ex_Ty(Fv6e%N7=B&kDYE><`U57uUp0Ru+>w;E23@#t>Zs+#+@%~G! zL;u>tI4Xx_506oKuM|aph#(_H!Xs81wZOdxQC89P`sB7P%MFyD4$T}XIRf|X=^t~P zPe0wSg0DW$at{^{43eXy@J@m5uENmUDh@=Ur_>a*8OLA8fW8mJ>5 zhdvhD3(>jUX#4@$jEE<*JQp`X?~B{(I)ojbqF{2h09rD@)hj2-)q? zcWa8w=lXH^OOo2AaFnkovd?$9xCIyd6hrdT~LL5|Kg#xg^HR+lBD32uj`8B(D(C-#105V7{)-9f|qKLE%1 zq*LqiPv?s(Dx`5~AWBn~>yIUq>8iLJkY$JO45YCdILZ}@K+-1wz?|UE3A3=?Z2Qmu z9~S^ms=pWiFov@P#E9wbvK-%AX&}m8jA{~16?@BCy3UU&tn85mMip$n0ZRW@K+$0b zJNa88Ark|2`faZwruxP9@O1I9%tXX1;|CJ0x#iAI$ucvRfd&KfJ5mm4e$)gM6TLKS z>r*B1e&1yaW}ReR!cA|;Y zE^=FO)ji?XBH%UIl<&CaO zdgl@JC5u}*vz&1C&%fM7+!RKBzDmlcs>wKVPdEAK(FMQFJiVL4LR-nd-q}A}LWTgwN}dW)!e2JZnb_3UZ=vNT}zWD<}t*K^MuuHr$k%*;~PC<4lFhx=ttW?d9V{f^B)(KgD+k^3$=w`WCu0 z1LwWIE($*OB@JDo^umn>c!&VIi#90Tb4O^ruLq)#qF8%ImbtFP_umEWHd3I8Cj-5s z_}DS>Q+)9dfW5pK>BmPm#oare41F{NyY$w+emC0FR^k*`aN|?Cz`*XUdx|df2U@WB z?mzLutfbzm_YAhy%*xa$kwc_WB?vQkwDY2O5Eb+w{8UL)atG^?0%Yc6m!{3buuXD# zDCSx`A?dNl1d!dHuSL-P@4ll4uLk7cN= zx%GEE*7r1;PK2k4j=qr+rS!iE!}i%ba+%Tx-~cr5z(7s(1Lrc!TC3cZFA|_ zUqOxH9e_RE;qI5z7%CHG#F__%0#;9ZV2iOY&v`7Vk>!$}&Vvj1a*Pc1?h%y-W4cpc zw{TuowWegHZe`W6>NWkSCZXs{eTR-cAY0|b9vPhBO1KcIki}XVHp1>eb&IP=SGg2S zQ$wZc$*b_k8A+SqW+Xh=wt^UhbVrY!*{tb7V=Jv0nws6{faU{bc-`T6 zuG7hq6K?20KX$|x#fO72X!QtZ4zA9DT+IrBB-_ZAh zCnVc%W2@Gq+-0y;#f>F*1c*xJ64I&n!BLxnD!r|R)eMnpo>%AMtR5-v6g{X1{&)nDx!7;r>8NvIMY2TU9bx3$-*|BLXjQ9~>}xBRkE5pI zKGaYk&#bronD=gb%pCa&xX*j{WM=LIwUMH8BZjqIv&VvVP_ZuLwU z0xPH#Xay5LxUS0fXN@C1R2~?QJ2Cx%uGi!snYeI4QZ+bWXn0mG~Cg zy{kbSOoR^z@)-liRT9AY-z(-{ez>+D3%IQ92xxTup5+#4jN0Ohu-WhaCq;&AS%*Je zI^KILww(^8-x%_tIm(owT3!gPrkE&Jo_|~^8a??MQmo-2{PjfxS(L@edoG5y$t{Ty z6>%b!O^c6*UOJ@-kgbXg?4r)Mwg#0_qETOkKdZ5S46iozI`I0UivB{M1O4eov$b(N z^L<}->@w>4p|eN&*6i^O5gO$r+5LD=0+oqDKszNx`bwxi8Q0kh3oAxLa~8kMv!oz7 z?N2KC)u|+)^leZGR*dCve;&aOV2{%;jTb}irFq_n@mHsgY2%n|EtzbeU!!9P!Mjap zfz9B?4_QZKq4>UosUK+cWP4)F142hF2!uY`t+myoy#>=73{L?Hk-SZO?u0(Fx&(!@ zm4sFH;}-RPmD(FmlPw1gOzX6AJ;f+fPNK#2bI~#**r&BU?&cGOLYIM(k7^g*(m|0+ z;08VA>rj=;)68W{77G++8Xc|(Cx%L)w*$sq$6!6gq6}0vAMw~#f>9y9EE8Q8jJrXq zp6=FQ*v86f)?8_;HcQteoGiY`CT0h1ft|Rqlgbg0+e)%k^b%2rlfF2+saI;wOs?q6rB8P4e2{z>aV(g za}rI@0hC^U3SLiEP~9&_Bj#W*&I&uo6(KME`6Jfb1`k3;C(eAtK!Qz7x}&-1;BLAm z8p))wxOuD&czqx$I%TVfvbE$ZDKTbK)P$HJgfQ6c$vdFA{6!M5o28O?apMjn(z ziXEJv-$?ZCe8H9qGQlEH)&12zeVcRjRet@pxa}mqOmcM6lNMmi2>o5C4m;+C1^zsq zR$Rus8AuZzJa$w}N5EE7Qxo!>`U%3DabwN>CIxbXq0NO+&mM$#gqg8)bHds~1ieZl39ek^HKAj_ex@F{m>1SVC&n z3lfU`P1v(4&~Q)LE|V%YZxOfH1W-1INt=g1nE5}27u zEs!b`3M&s{(VEG0K2N|kfI9v1-G30K$MGG$F0>L`3qJ^V+8Jf~AFcP!iY`&s7V*Mr9q5{4^FJ%n0SYV)D8K?tTN~$jmImON+L{V{eFd&YA>X z^vY6*?iVZmb^??H&TeOuu<6VZ+X%R3p0H;LNBVp+7BehMP}`Ma4j zBECRS&)w73SA19v9pg`Z?fbWpqcKU-4-6k%PbE{B5XGycgSN{36EiCk#hGH=tr|Ou zyxzm04BPNWbSY-c1Ia=TLvC1nEsIm%kVdo$K7>WAX$1W04B%3uhbGe&Ev%|qmjXOb z72yB0(>Ga`nkc5cgt_%E3PJnG@z!4kvgJz{ulAJ-1xaptJ8ojx^NM_!d8g(X%JfR1 z$wy;G^y=r!{M!NUf1t$%ic|^-yZ!%wEA(|?B)41m!3e#fi*yjLtVjQ?NotEhXhpZ5 zlP~_Ww*L8QmclG4+VV&&+2pF7=A*BF_9L+Z#dz|@k?aPp?vT!QK^3&f_e-1Q{iea- zhHPT+*pt+=1E6ip?{xS*QO{2R>+|BR``t{_6qJJ0=@wtj1M@4z#X92Y^zzwUn(zt8 z*52-t3}p25e$fI@s}h~CV0aOQY9s;wz1<5JKA#>R@3<-9^t_mzPIl`~`(_4xvP!RY z34h{@zmNEBab2vZA=nyP-*O(z@dsM=GTb%HCp-C3ouTyFri}O#lC%*yUB$lRH-R^s zf-;1Ng2WBwwHp#;(;;33zz@Zv1qDkH^^2fB|6z(kb>j-^i=0kk_}Ran-#MRU)nO~z z(7II7@jP>JjHgt9;~%rk#nu=0u4lqWPkatoFY>&gd(DTT+&sm~!1eyo!mI@&^hmZt zh%03=eNwU6Ul-UGV5oX-fVf>bl0zr~Jp2J+*ru&)ntE){;0r)wbT@g!xiIz#s33)H z(t;f{O5wRe#kVe@XZTXy`)bwC;_WA{zPgu}oXO|R!xjuS;b9*ZiKohLuRQuGELKlj z{sN7dB9PeD%eT{dzyuh-)-u4Wu+0rc~i1?iV|mZKN)pj!s))?GvE5Az?O1lYA?b&c=b_ zs4{v6A1V6VMcLTaBsk=7BoDwkwn4b}{ZepB=J6Zcm)eN$mBJ^-i$SZRQqeeDfaKDZ zt(JkAyPTe-@8}6|%Ue+R7`O!`U4N43@+p}_4x2$j@(uRUr6yKK@j_HQBJIw5&6QgQ z`?|%U1<;CTa^cCOP`Ao5=+1HRq%+bM)_~h#U)0<(8xwD1q%veDh{y}8Ql!G*~G{N(Q-N^ETHbK*bWFmsSFCaPAWi2-VrOs`%S`;l8 zDEX!{(*w^t${Y-{-VRz7uP#i@p1SoMCp z*WQBJME2jWD`FayRd>=~*9MS8LJb+M-~1@v;J+lFS#!cXIccv1(!c>)*zy@On=Nq_ zcx&k$cre;=BMiByZMZd4JfzNs5-1I`6^Z?PT}N)s#_{2Pbzxid@{T-O^2lpoqmMi; z5?B>OFD0t^e%c`^S08D_I)n>8P0Ez&o5cB&(3OGNUk(}f{rsb|wL@kFXA2dpRwlXC zF&qhcJIVU;2r82^DH)~Lo}N!H*M+wV>f?47aIi6(`i`T0d{i_yT|u*j$C>0TTtqL+ zpN!amFr^Zsr|AY*Yw=tZzIRpJug2WL(-@vl!Ft^}&fk0MIJCX=YUToH!tL(o8>{&}j>8H~4iz>LFOy@~Fk#vY>Y?5LW?RXI zck26l!61|y{fIxW%LLBEF$>Py-eP*qdUK0__P)HLZx?9=alxbD=kn=1RbyCrHncf9 zjY9(OAF)3cW(LtT@lsW9DE!}HZ7Te(lSq*I07E(3QV!SWB;gSEOJhIoyMU}(A-YE1 zR}O4};WMsQW*Mr0MvYguKf%>5UQ2)^1~8fV1EnK8q7+V)(QkUkX|szyCBhW!?cLX~ zX#yr0=fj`zN3!L_7{VD4qGn#w!6;!ivebcj4unHhGMa8P7H*>+MtYqa@o1O5siA^v z+=cjjb0JcN28^p%bU;Sn8&8kYwEXKTx!AaT*s&=gi=WS3@3z?HZ+k*@1HSGrl%b)g zz3Ofa;-b6tmA%yyUxIkfAy)(|B8?7fV=Y#REducny)eqzB1aK&r?(D}?F~H)_-_tW zMsVPZAcbP1kyP;9-7$;q`YhMM_wSb@zcgldj44zV!bUWu^e4IK8Y zWM-^IKW6FULfJP;<78w2=Olef{~y{Ve$(5%-k*oePPHE>83Sui!fi@;5JHJLXn1)W z6oZZ(u~UvpXq|moS1O|i9&-yBw*fh4;g$2ysd{&ofa5dS;?3}}Ld8atF!7m6wGA(E zS@MpH2byFNvDE%m!qyTTnJh_s>U%0*ChBFRXpW!1OSaga=TCHg*a+{fPjdKH;ZX&G1!0Wk> zp2*yA0u+8Y2I4tl`XTwv2ub#5b@$^z428GyY2f zjw`Z09s?B2|3&W05Kuu&=dqMsD^dq`IuJgiLhIkuqsDJ(K&@&#Q|7jahj)dAx^p63s`A`c)deMKEiN9m+$j^UU#7{SNO$>!u zZa#fa(yDh+1Kas_Z?`UHnZcz{hOqiw+cb5Z39^xb8oXxT@x}2?h|DpJY!I#eEq>X> z=+Q+;9cKBtXWn9sw@!s#(~{C&7hA$3-%(chBRMdO7TipxaMrBVt3OJyzTI5w?{S0+V_xNaxrz01AV;Je zlFxDr6!NO)>!7UoQ$|UsZj+o(&{Ceo`{t=2l5@|e5i9;x(L6g@(G0=;@b7iMQ1$4J z(hQf<9V}Z%-L$SQW1qJJ=H)KF!Blg;Jg9ZMeBrlSn03{vyP(Ei7KzXjFdzY9mJw(A z3|DKTukSiHf8u+rNF|E+&dZJnHJ?-3e?LW;88mgU&L+(_p0P5X@CxsI`#v<7hfNUK zdZGc|ylI?^THS8-?_s#H;X&G#(U3)+<$H@Vl#bvv?7YGHXxHhQg(%q=j?!wM<%pP4 zo06GdoWkJ!I9d3yw%p{w5Jm5b_Zt1Wqu6e=Uv}%Z(@TSC2Pfj^N(2pZ0jgWE-e=Oo z0wXH$c#54;4uZe#*it-#T})^wrTWI)IQz&~wj`n4A@>UOFB42>9|BPXFsC7l*dsGm zJ$G(9nZ+mnR;<5ZMLpkbSa1Cq{p}}UVGqli%uGM8D9$=X@S^epI&4LPzz{3NC80`qj^j~%M(IHFhiWn$d$1W3&~OfVFZhEvu{ zhh^Ao=bV1oKS;enEYSDyHFq@&vE66S^9HTli-#Tf+C( zD@w*Ctx~>2VIKmjol7MDx+igdCsi!#=x&%ut0+@DwmkGTRlvCo(@9j0*#eQ>2WG#4 zzvh^*T73oa1W%0|-jxA=UB0F_>RS~+sNGAprW$>$^Hsp#`YJWfr>-Jso(og`$;n(~ zU~MsbM~9a92en*E?mO{rJfv+7xI5dYy)TlcK-{s-E6#;jP`f`#G+6G^LSK(M4`k>C zEsEQFSE_#Mi3|8~O%`WE&TS~MuuTO}Yn0Vq1@smG%k5=Zt&Gj7JIFAZ?~ih30+$O$ zW!4X!_iLjDsyFlyJQGQ4bEl6K(a-Ej>JmAb@=Mej+}IeR%xE}T_3^XbOkD7ER0M1~ zu=x@1+`9EQxB|$>>lOyz3P+_1s0GE+csB?XwCg)Nt~Mp_bm8*@-`=-QR#D5lc}#$N z85!(%6JsHh1my~fW*uglM?pRlgG)AYYAl@S#*Ao}f=t5BJ%2jUBx0>OA(xy?O?Nf& z<639>o`gZA7l&hMcX$!`wL91f*hDLwXnE1*zy@>td|n}it+r#yyI*5foBLgz@%rxb z8REJ!58_j)e+cf)5R5A#aiV?3YWU?#Bge&#dN&fL!oC1VG!aldpRcu78(0WUnresl zk66bdj;Z})5*RecxMLTD+Yi4SVk)7gh)c85z?N~rX0C+fnj@Y(SQQ9tD=;a27W|k^ z{%DlaJVu$5%6+Ea+*@Y&u8?LdPcO5EmGat2XLUf-y0|;A<5KY6$(wYele(30+J^IG z;tt*N!59QJ`(XSFwm3HjM^Sd+QY?5Cu!rr6yl>LB{$8Hclp6V2Gudk}ERV=Zp4bXZ{1y$oxHfrT zHNnn<`f^tc0*Hi4XB%RzPxJ#0v9Jb`V(P$n5ilq3@6Lbi=!;k1WA#0a9`Auw=89tN zd`csG(LxA5)IO)Af?I_$P=pfhe-9k7%JO?G(QjgKFteeTq|jDe(_*+>Q1;jk{3yUo z0gEkVgj^Lzl6te>D1y`Rcy_k5w5oh#AL%eP`mDg>PcjSkR)LVLhQK0w`xX%C(ogV* zXXavr^Bg;T|=sk{8=Qy1hr&>K)Q0Z`( zFDXgZ?ea8Ld-(5E)NGh^X~Azr9~&cLicRgY6E^>D=d_me6pI}UBw{Ceoj1_HXL z-RDYMo|24cf)8D*B{|UaF}zX&AC=!B&gN_8`@>?;L^<0m?buD%S#;icxRyIg+3iyr zC)KsUUv;EgN(QNM3BLkhT086Ce%83Egt;pwGQg0JZZK5=Vl<0BZ6?PBU$K?GwDk6q z)99y)mDx>$y#J?4BOT^Re8apK*%vI16!kLX7TJ~!b5BcSqmk~TxN2VqRl=kn*?;&5 zIB=mhA^ScjGy$^WyB}!7YYu+Vj|$4kG>$Brd99c+bX)8cJ>(CTbw>0zkfwk?Gd28K z`Ta3V`?SnqOEnu{h{c9x-d(+Qw$3BM#14^A7BJuG$@$%bw=Y3vI*(H?!<2iPw0syt ze_1!hFkNUNQD$WhySo+S(4Hy9y14t5fhWVR=rv)_V$il%`);DY-0Mo)no4j)m9J$< z@ZW?rNiC}8-m)P^-~D+9UW68sAx6V!ELn^>OOH(zgfMFta@>QN6{Wf93SJFS1ey=Q z1gC~j4p_6u#Abm)2#4-wx{`)?M0_O_cMWw|po$ClEL<{MEaQ|)&-tU~e`dVcqhR@Z zd}ufU*t+_N@z;S)gvK^%`>}q#kufD9%DCBb8kK_)jLYytzmkUGhGxaJ<548FHKk5z}+- zdzbnK1Lm(YSObGh<=;4e3I9Ix@mL091try}RVvWC?67x6cz7kh(Pi0<;E z94Qk!t=3ppCQzK^T+AE5$T($=yYN)7!m@3I0Z)DALR&2%_)fepyrA^yIkXFoO#c?~ zGd4e(ylS{1Jg)Km{0|Od#wW{zMWfe;?XnF&?s=(N#Qz?m*ll;YY9}5Ru?( zZE7qT^Nnm^3mg&bHxsON^qWp%j#!6#I3ah?S`>&IMqu_t$}Sh&f%UwO7;!tIo^Un# z%q}b0QQ8+3(lL`?O@LP%XFq@#&HFao+Utz^Ky%HoPcBK;na2}PDD@J9Isz4>J5T&E z18TinC)G^nuf2!qBi z&bpF5gXblyL$30!*M<2hc(ASI{1rtK@dUn+IvAWNH9@*iE#mdLVB@MX>BBPWr5N*cCH3O8A08&_i%p8%7Pxoza|>_aXRO z6h|N5oB-qoHGYTxW*>aZvhSVRdf=+`;h9qV5@)b_ZJ*(~Hl6Bh%fmk=Qm-+*GyhG4 zk^Kx)7-S)JJ!z2t2i?U&CeCSO2!^zD(j_Row|k;rojQ|}IAW|phD)vAD==E;!OTHm zmBa?-rx*IA^xd3Zfz*vB?@Pmib4|4k&>4Lv4iZG&Azzxl`kDt&wFN)PK1 zk}GC2s_<6JUQ>&!h#hN~{zzZbE@pyLw^Ke~e}%S3OHcpnQ^Ukj-Et3@Jc%tgzI>b) z3&eprM&i6$4KdkOOqd0scLXY31m{Z}Yi+ibS*~MZ=)&V;MH=aNlL|g+p-it?=}uBG zZxCN5B`B2!vIk3omf>#ClRp$9A5thDg++we^s!e;xBvHq(+gw!T}{PR$sk-I0o!;b zI2Odf{maixR2t*`s{SpVSty~L>d5*1oVS8&) z=#Mgy1fm{9E~-b!N#De7LDNekj;;rB3k)=y_@LV%MfuUYZ%&7}9FP?@woF*2ZY;_yaES9@a$ zzuMZ}=U6Qm4U%u3P6eLhT+xgdWjqEW#@;31WQ(n5(!3yf&>W)-!jKciz zj`bcoO{YL4N0;SH+h> z8NBi0Pq!Rt7#e+im%f}R8P)O|Sw@-ZyA6Q5n|jNd1uVhuu+ofsB8{?dn^!?RpuSbuj?VXGjg5D{vTu!H@`Y`?r%`q8~*DK*k^<_ zmP&)$6vG)6@&QAwV>efmlfRE2o+IVDnW)~NsPy;J!kqeL8QGAYk4YZnZX)>e-uY9y z+iB&15-&DT_(NTPK{FaFy8A8)3#w+7|K)V7aq2|`Ram<{UDvfKaI*X|REB&FNo@3Q zS}&HM7dcPEk||((FaZb?(i>=Etw)_ekLlIZ?6PVCx_iU`E{MSVnzj)ja=xkQFLEvy zVsNFafrMSx!b*$$sK0{bu(ju5uqGIZ&XKKSQ(Fg%2ejd7WaeHGZ}S1Q$K9+*+4rg98^^Y7aI3F+^O;cv;tGki zIDjN(?9T{vm zG2QGUu0Ww!spW{{Q;T*jtcad7<$A_J5`4~&`MVz!?Zhii258CzsokYf`JQm3L<9z_ zctlXEFMsij$rS|k^jH_eTgGqJx*GT!64fH9vFpQ3jo_!SOA|Ah%?9+Oz@UW*d{t73j%DPGZG8WM!vn5*alq~P|f7eU_>%IA2Dd_6r zT-ng55x)4Q05I3`zThtn0G(wp?VjRq@>BL98^k89()xxD+>Uiu@Wv7$9q@uQ98neg z2r~M!R_B3wsW}-GGhr^Sefp#~D&n*IfQ|phM+FT&>MBEi&++F0R${L{vN}>m93yWn z@iBSv6>1FGcXqVYwi|a+s4j-Uu0(>UgUwG9C6V*JRQm_1D7QNJ-Dnr49u{1P8{_lF zn1WeB5(?*YzT!nN+d^nXDY{J+u_K00rN12a8?2uw=hy1Zv5OA~Bz?cAPE`}x*rPhR z;-m3cb>=vC7HnXQY={wnq+f@*e-{kPsk*1q&yS8=+3kFz_B`@Rup7=6ng~M9@Egkq zJX2Up6komay`TiGJkM#sZzup+dw0|oi+@ddLebiof8T!qB>4#n}SHg*M|Bfi*u=u&K(^{RRwx zekx28YSE@o;?`A9Z~u&nlu*GQf6Z~AnuWS<6o_O4@#9RXFPg3p!&|>!yQ+fg-0<&2 z78=h3s|4H<--u2)Q49RU6GWAtmQ98{eX@W}5uWm<8$$~RwAsGU*#j+SMLd;)m?1m1 z=i8Cs{3vwP)%px5=AR6to~a~cKCZhWZ033-E!()I=+y`AXB>pi{}}QwqbLsE^@>>M zPQXUGN3}{fvS@saPnX8?*R)sc*i@~SnV0do1@c8ui}YX`ya(gEEtf#c>kZ|Mc|xZ@ zZi|tY*|pn+Gx*h*F>6-Q#A@HiI7EWq4T)Q_kP0w6ry7? zVQt3DDgc-zXA8|f;ZgAJ=~kQGmq_txtY99U*W z4IUr)Rc=BY0>AO-?}qG<)?qpK=|G3@rpOb0jbI$31KQ(p zaG^_DebS|O(1o}eBR<$G-Dva8PF>gCFRW=}vrDBJx`fV++s$uxM>qe-6wmi&h_AHA zDW-VIN37ME7XJ-tGv58skZ!jzr?ls-aNH@>B&MQHG$iaoy6gA6jh*zbNAn&uX>9(9 z3-KZn90V$gG!> z1+(YFmezC?IQxk8>%-v57blSz)PAASzE~|a8KeYJX62$n)Z$r?5OdXr9@7)AP5uIK zOHe?Byk{2w3y4cuH1HM#+e*@fcS9T+WJks!nKI&t~GB%8Vr{x z9HPl^=^Y0z_o}C>oXxW(Kk019*v~QUoX;#TZ1$;lKKcMVQ1rQmRSA9Zv%<7;eo7GSP|Nw*!%lXjkKXc!%}_PubjARcZhKkhfVRVp0&A3$mUPd zT!5ocUX0+d?kVNC>=^VvZIxgnwDqVeZYw1{e_t9$$SBTlH|x6I(J8$~75c}Y{nZv} zj#xlr5u@r&2M36^&#%zsM>*jAe=vne3NPv0^S{-8q)+`vq%HI%?OwVs9gx?E(zty- z-1+n#i^COE7MJPl_YR3HDsSm8@0lM?%Z0*^R*cv@@1>v23{`%J9-w?!&QFaS7rDJ6 zsLwwDJ#lVN=)QfIHvT$$e>UJophU`kA<7qnvqoyPH3zV}(%CIAHN2tMTqaN+miEEo zqLhtCLnmq!@MJGE=AHdP=2v-Nc$io%x+bwpg^B z^7dpbIx{M|sfd|H3xXYVDfEuohHvHg{|3C0j0CP>EPI5)+PViNLoC=&WtMhgo=~aFsgN2Ef3w<+9>~w(W$!$|B zLh{lB52#iJ=F0_F=YZ}PqO(GpKek5=DTMEL&&?w}=nJ-6tT%OdW}*2^D2;QC+i)S% zQWs+x#U!BzPUMNc3B>GC@(ltm)I9IC0fn=l(!$ou$NwVSdU%C?-!vWT1+fIu2ZMrx zeKS`v*uB>uGLQAarKm7h!0}@n&5xB`w~URAgIjx~Mthz)!?9TWPob|=1Y|AqO=(e$ z+1e37C-pMa$_xqeOx;sGsQ|T3C_lyx9JU+7Pn@S0s`_q~us|5j8Z@$$i9%N{2~7=#wWJYw&zyk1$lR)_4l^|m)aMx#UbT*(+RN4GyT?z zN3tDiMJvBTEtJe?V$j`JRD9LD{6KvG0$uB5_ghzgC$vbFt0+ojUYz=xaCM3HNea<9 zoE{0O#InGwvKlUxsmO`0MJA?rn{32!4U^j;lsuM@u@1IRsc>ldcfH!ZKK<&jj~9@g zDwk1MG2cP#!2RLO{;nJ+f)RR-Je1?_xFs{*ADe74v2NyCGW$0>hF%Lh-;1$T?jM=S zU4RXLQwY}rbM)F_{|1ENKQ@5&;kVjlpJdmrOL_j-SXjeCZq)vk{4gFnoafB2&j!tA zo6&xW1BW@%M=&;1+2_rS;-5ug4X}T-lRN&o_7gw*6a$bYBFVXA`rpfdc;Xhbc#~op zcvNiArQBad`0@r-&+2byDD7AICEl@Dp$u#bDfHHG(GTtd@O+Z(sss0mhM)PbU!&+r zXBl?Ni+02>MB%lUFlX2#4P5Fqj-h(#DNjoeVES8T@3+&DC>{If)ijom7`bj+c^tFP z;3`F4{t@y*iZfO#AQI8fambE-mEAOxrD|4G^3Tq2NBdUHIYuaVGF@_UdM!kh>O!?Op($zj|B)-avB4qR-i^flMYH`N?x$?%U6^q$gLQQsn zlw#aj4I1Xa&bcMG82;h#^2 zpf;aWScg+P3oNAJ$$X4XB>JAGCF+UKeNTFQo?~F|O|Ie7n>t4p!Au=Ox+A!dOJwm> zQ%>~#BZXqu$0RPq(4QO+F}2gbxZ7e(L$`^oO!O|#oQIGn5^+l0vnURTVeAniBF&h~(u?WimF&KEOadEh@ zzl623Pm7u)?mgakVJZI2B9C?cWMiSO&b_YJxW+xe;5|{m;>_5suUY)e-o zcD}1Dv)<4PfbQbac$o=i){W6iBNC;y2HF{{$c|4I(c`dVc^52IG)O!MW9xF3zaG7Nm4wX{aOC)Eq%KsL9o4aa5^^ZHk_( zRS~VbZ=o^ub0D-U-U#uOOF<5Stz$Hr)3DOTP6P$j_=_Lkj`a*2aZ{}(smZF8dtiN3 zG{!4So~oy3Y^;KWGD{%r!AgQZ;ja6Q)Fy7t#|nYxQ<|)5?^6>jpT{j9{;ZJk%V(gG z0N;lY^@T+UQQa8{u{OwA*ib{W)f`iDjWJC`-4}rGKCUh(7v1m*>N_mEN|fQkq+qH1 zmhBOk!%OxwUqsI9D-KN72l(iIBPd_C97=(;)urp!U3qccRS+%a5OnH$K_h?6l??CU zOZ71xkkZXN+ySt{t@;VPO13Ps%BHTRH_JQ+VS9EPa$EbnphFg&m!O4r9H(p(zg(KB zDnT?(mm5YIUHd$ZTGA@&;(@fUMc}K?7;}+ea-p&*+Dtm*7D($R1J~#e@f=RwAfAa5 zU6bcHJ8G>?1`n>;&w)P66#k(M{(i>tYphl(x>FY@_@d&r&;RWvKG>EMEv{SgmlNc= zX3(&SVeDA7NMyOYp@OF20UsB(sJX*0ipYw=>m7{6Im8`FM$Zp{FDR^$#(VP(68-c6<^tar=2 zuf8G_ZcJNr>(BAsp#J$&ICaR00R(KKxJxdt5Qr6t2ssTVi{LN{*L=VH81{IZL#f;k zwE~l3?2RwaFH#@;5ikzV5yyxRObE|(RzvDq_~!~#qWFtc9}TgBllH?`yid1rP#VvF zC*ATfHE|w!yrZ#2CAGt^w$jr;@WYIeAm8heM>b4!U~k!+{!PE{BOcp1HbzlF`%1{X zJ3{iuFZ}GceCF=;hT)Sde!Un%IUG3s{dY9QB}f&V8q_OV&#HwMhi3WJ#6Ls&+5N0SK6Qr%3a8gGbj2eT6&Kd`34q|-q= z$>xI22A5$y$egrcD2QAB%B*{=Ra=!tM_s`krE%9%M`#4XtKv5j<%d7bJ#fl@{ERfk z_vcFc)@C}F48TbIg=Hg9dc@k`Qwq4cF>?L^&%8Q?V4Eo6rwc0qiI6Lsxi#xfOuko{ zE0;_`wP)I2GtS;Xaq~qnXMB|{3rZ`!^HZzoD!T9wg#4)BD0}Q&a#apk)Ds&Tug6yC zDK3lJfRf_5*tom}x1lA5mzJ_B;A zUqtr@3#(so2ycfuf&~izVo$_>mn6!YA~75-gdiLKUSvSTl7bQ{QeeQk;ET`#m!!CP zRp!SJTMHK<53K2v`qIei{c4fp(t=%)$6W)x6OrA(?n!~)@ziKHX@Tt>&!jn{9i21o zstnfcFWf3(50p1j$B}7E$ax=492%s)HUs&H2RiEVOnSd@w%6UE(=m7CF68Tn+Kdz7 z3JeyHdMfPGa~!&MhlCu*2?d!!)U;6<~aw6x-dsTN=J6rVR za*@pUoTarT2ex@_WiEs*f&;oB~58hw7N4|7rOcv$^8N*D*o5zW9?n~IH1*dKu?g4n;LC-m?l zDuB-3_zX12-#5AS%7L}bY&EqEG!O;yTp zWvrz9xblN>*|A70%%x+BNdvzv%UO%bJZv=(SWd|PgATU&mCST?8H%u!ja2l>$FyqB zW#uXSkq;0Qs-t}Ql&{xgR7wW;lZ+^RWBx6)h5FNYmpf$9+QrnwN?}eA9Ip&Ieb4cj z^~k+s+9#Ft&Wt{(#Td5gxJe5oi*5PcVBAA_XbGh^Jq7g;yfAYY9;P(sh@5jS(e7Ux zJcO)b?a$S=#zD&emibr3$CL4~pjnUiS3|DV@tf|+YPqwZA*zU6dr@Uqw#8`mt~zh& zMq;+ReD6U7nJyxJ0~|m`qC^2GE?dt1U|gw$R7OPsJKdiQd$qFFIDoyZXj{OijiC6G z-MdqT+%7@hj62dqAbl~%jUNI@wGxob{Jyl0H|~6zJ?-Hz zh=GoJpNkgNoF58)y%kNLJOrnBueYS7vc9lbSc4tWVOfp4ZMv^7qc)`KtfZ6aWFxum z$(a-f{*Mc=`xFE7^Wj#4dSYXj5m`)Fo@&ZR@1V!qST;Jdyev?F7++ZaH5VZw@{y{a zDfYj}q)Ex!?aG_%LvEm95J4-jZl*Yi-gXGp9blJxT64J++&Vx1$B9ZDV_p2Zd9ok0 zVFK0W`zrH`b#-sQ?}iI)hBItX^IV_uRl6R?@5BBB#6F3UzS2l0u+`3L12*Bs=uwt1MokdjUn;kqCTV=QApB0c8P97mM3so!|C&~i0_Br=D@vXdPLXUSCO$k++9;j zt;~4)EzM1pGppk09&J+f9@az({+G_N(+7or;QTQJr&ujP|k|EqMq&wW4C;|LzPlo^eLgcwW7AK%Tz70! zs{chV>VMEHds-LKfwclJp=$KX^mXH>H@}Ks&;xqP94@^U!LZ{lvht{9%dyxPq02&d z1>P4L-;uGjRFgyUxqY$&*0RNga*-JLn~uTz|Hso?#zpmg@xn-_ba!_O(hS`tNJ$JL zAV^C{4-L|dfV6;0cQc@LH%NDP$INig?|+~Byg#qj=d8Wg`qt*HzOhq31*|W@j#X%TrI@A4n^6)bCy~;y)+-VIR==3E?(Ph ze7K?yWoO$K#5vRCjnka^UW@wu*Kf`Dy-7QE(7sH3y#9-y+&b5RtLKyvNgB$QJ$5NIepAHV`M5E#)*`4|C5lA6bRSO4pM2ex@QVljI>7R9E5Qu2iv(hhvBO^1b!wS4~DRqy|Mph7odS3a~s>h#1c>+ zU)&6GyHxu_hyT$&$W6kP^JdY{9AVVc+KF;jKx<+ZcSuQ=I_K&333vCniw8P4<|0u^+bzO?v&j4?jmVmaGaAn85XkH3Q3jIK63AL#$o7+3+n znB;w0i802DZ<|$E_gfhr-RQGn$$X4qG?=XLbfQfON`@E*U3<*)v6q030y7%gNU5M3!}2&dI$gnDLYZ<%H{ z+7C^ViRYg96(FBI_Rk>d?xN0$LvL{7STKqu$@}QvHJLT`|99hGrbJ!qTgoA4 zIHZInP5hOOdINIf)o~5IBsxU#Txj$vGJOWe4;yWmo(?bOIHJ%E`5zrL${l}MHC=Z7 zd>cRiS_l}Gd+Z=>QdY5pwle?1ofS7Elrr{w2bdOZKBZvVd`(nAr8?yF6KPE4SEv29 zt?%l16Y(Ykl0>yQRoyE0G4J>h?Q{Qgmi7^Wrp{__a&Yl5l|Gwe2GF<_3?!%eMmPbP z5%mO8?h@yhLg!nN2wIujJk?IR6w=s=v_5m+()zGhsGr4O0ulq0gD>aYe=iU!7e<(4 zbnDf@wgn>^n2Zsyv6h;2b2&Z|x!TM;?^1Yr@|H{^u6ta#M*dGy{qRpvJZEen42!{0g-h4iV^8D z-w!@D(RKV?epbKkF@Gt@))0m7gPZr#5oUUNzhEBL%8I#ulWK70v{cUF%0<5QJ1j1c z_5o%QGj*E^p*GgSB;l#@n|*_P$|UdEa>uEYk5lFS`*4$CCP|U5J?wz;p@|cuj3<0d zj@+T86__`&@39^SEEsVd3tEF+-939{3zzmY#q0eZq`j6-K6>pZD*uU6vdWJ;J(Gj1O!amAMcMbYa6`GfVCWLSUWL>`u&!v{g@=X^`x5c$rd2bH)@e`+m zMqwb!NnK`#u3os%H?`*4ZkwO-VN%Hs6HEBr^(s|G)P1!T=dch<_-NSS<0-(qeL~U1 z4k^~Ne=;FW zxr3@)Q43gJEy_#3oWVupEu#)V&X^wESgEtiJtx=gUIF>{F#yg@$CLoR@ybpON_tE) zv*_dQDXZ#Df%IP_z1%7$RO2d!Nh$<%P92-dlp?HPcHb(Ee#F>X2^n0uo1FIb`P6?l zWx8Xw3tS(_J(NOO^O-%HZwu+C`y+fsH?`D1FNHk{; z4F$jX>dBAvVfB4I<6k?n(6kM-VvEm8JqJF*bKB3<3h3f5$IES+t0V}|b{gbO z4|uY5L_FxNrGc6o9jIS4p^3<+gk_+%x{88E4YMyJ7~)O)>7pDn#Y`+AD|_4M)RP1< zNVXzz31w0`MDg^g@WL%dYOT#X2-lbh#--zywlN zXhMeOVL}btZ}w7!-anA9UyF#mrtEmP>Ro=g8!+Gp7%!VvY}y}c>sh$@i4aRYf0Ba} z237kzHB@9O95|af1G;fPX&lxG_5#dSpf-kuIeH*${lUXBegkn$H%&BTNg`@Q!KXsYRJ(AkA&Hz;N+lPj2MUC*QREB zS3xu+*=R8|v7ITQeoHB)LT)~v9I_j42tym_@>AHNam|JhFV^oiT+|eil=~FO3{TB{ z9Xx})K-Hfmo0838ysU;G02>(KVzMay{^sTEijA~-N#4NJS#4_Q&sQ^A6Hgf%{$XZ# z9oK2SItV=Q9yzrh$K_=6+c|c?^|0#Sa#>7jv+g2A$pilWb8Y_YF00~)r4!?V7COS; zp8G!x7&O!+$t8boh#nX_|8)wQM2`Y z*pfngjidK_zkh7(Sn}YzLzjO2#^b35_Wo~(Zs!j)jFnFGaZIyg{ZjMXJK$gS%&3jb za)hd)Mq5<@Z2JeIav6EUO!wtINO$aFs#XsZLqOjlB&~6Ms83BxRT#aWt5ETl^#hyA zS3^DK4ijIkT{^+TEZ~;r@0o5;NFGG>a->7}GS!lbzxNTHUt^6h(W9ex(ENO88_e+W zdUM2qiD?j-h+*%0rmsE-r97&&QBWUHqOo-xKQ;j^$Vj=(ij*R8p4Bxo%~0kKtmPq+1*w&z?s7cwbB zB?~;d;6%jtJYjbk`!)MouD1OoU@NlEAJND)w#gdlgE2d@NF!fCU=NH7N&?1S?pH6R zk-T{m9okbx&CCw+_Ai^d19BAU$DL2+fzj>^9H4mS(qWwe`3F6T67Uk(0h`t@4Qjv) zTregg&_~Izg2%YY{piNn7VZbSU+Y!xqIe|tNYdU%-i@Ms=?SF(FtB6J%Oj6vO6Qx# zz>rOTHjYadbs44CzpX{roCV&CffCtY@MF&1gi>@1GKDCSHvZVSEc}<&yT(lwS5YQW zlP>%OSPH|ApeHgrHFCLqQU=#xD6ZLHY~%4BYvIxD%~QZ`zeLVYlKsvWtkTI6OQ+l2d>_~)c<(k4?=dm zUE7#=%A3f;kR>t27lLp`5ibP zRwh?m&JAQI*`N+afGD|;J8(_H+@@kpzFeQ0GJQDXK+UP4TkR-)UPVp5R}GX9U9iHm zP%lM+bWRw9IOI2F=59UK0lS=NP;X$#UhXdoaGn@z^KHQkMvC7qV}Smb-wAND4*7k? zkyk+X`ntn|3bK_G=N-M)oWkx@tr{uOn57v|slCKa`=Q0hA z{!Ye!V^63Ch{}FzbD|9sX#gi>g*kRF_|k^;qAArI{z3~8X9($NUwgus%IwvTfH>A>$@R*SE z(KUQCAP1mLMOIH2bJK-Vus+i<9R<~tslTBh&c@IHvKL-MT(>uSwZ13<3ynBghMp_6 zY#l}K+WYOwL|OO-a-&bqETGY`x<$*D+DiD~zG#-T(5~@tm;BsoeMsn=*U5>tqY+T@ zIE3xa;tIsO^?RzWw_<9V5(CQOxoM{}4JBI&qTP2C0;A=(b&GX#URVw!9wSwhp`~Gwu~PLG)mrkUl%}?0&@q2^%}@PN;d(2Fp4o48%&}Nz1^1c& zu2ih!!A4cEMr4J*Tgj#L9&$~8J3$^o_|)(AR%wABa*AUl(lL}qUR{c3YoA8u2b@#T8f(7_?p%&X^-VA*ty)TO!m%#2;|`ttJZM6%DLI1S!tZ-;#tr9 z%m;W6^^tiEnq?FrS`yYPj=N;`a~FC-tKpMx-g^Yb1jc@+Sb=UYbKxY%=(@S+CSL-J z@2PRtF}#;cQHG#=F!e4wAH@Nkh|c*?vz#VyhU?)%05Xec?A_>*m(sTnhyGWZ4^8Z} zDBtM~nXK^ywDCHNK9;+C3PvJASufd#eWmiJH0l9$H)Vk3_2JT_?6DFx@cb2!YVg&+ zqvzYdqFW5b2T^ib8>8el%kMRPv0d9ueaHanF#}chlx>1=n>?z$vnuEQaY1XO>RAb8 zd*f5^sq5U?SiS22#C}Etid0 z-C6-xjKopNWvRF@a_$;j9-^}nsQ>f9+C^S;BZ(s`szb?avKQVjSU%tT)2nb+#86D@ zRL!n)Ne@ZT%ANSit9*1c@MnyvIb_D)6l38PTc2h-oW~@MP@$F>23-8@ZX(OU#Ch|x~JnCnGWIAPcy`@_vcaHH=u3?9@o7_ZD$SHnNRbBz+SFJWgk2bq*ABSH{frSO%DHf0h}Vk<`2EqAVLRocNro!o~fOjd_c2q!0E=nS<}y@21kBa^;m?14%EBT zKg>B;v@&f8u_RwhUWnWngD%3@s))3ZZs{@+lmx-a{J#i~ya-It$BZDVv2SAf*TpjI zlB@+-IF*gHQG|^`EkTE6;j87@Zu-bEw--&err(d)|57AOq*tBLe>P{6uRVL^n8;xl z@9Fp;x@)>#oHSf?dH_w@0h3&a%0otm)IIqP=0pq$1p%(mcQG*THh?XeKBL zCs4vy_!JF>ha)539qYBf(VeTrQr8+gFjXJ$`4#Np)E5Oj0$a(?yeNv6V0YG z>?HtF4(c8g%OQeo{GP4Q;hZA~`KW`ToN5NdkgV}T)gJ~Ie&E8euE>3vOeH=TbJ#|b znCU3kx;e8R7GiZ1+PD3VKU0wDqc@(;?3l3SNdJD_20x-eu71Mw81Et=2^dT_ZVHH^ z`c9r6aV1NVj5lN5i>2bZzW0fw{we5je{45qm0FNx;1{%V8g&PJiB_;GbPc7mK59S7 zN;|m*Un+#vg!;ddeZ{u3b`d5XIndo&Z}X$`>X>GmDAeIP3Z0t}P-%!=C?pREon!p# z3|dg{6E=KNbu&L=9&B|ZcN;2A=f|h2c!oc4>2lq=@=AQ1m3Z4r=7;V-sWJ|&D^y<9 z3C9#nAfN&C4^zNJqk!YNk_+CbTb8YI;QTpM-GTm8{Pa7nS%OLHp@OfA&W9>je$;1C zdU9QCzFwICJjP~m+Yc&}iDsNAOTE8)zsLJ|I#r?uaIb)i2x1kUK6BmKL#Hn4d)Dw5 zfSRbfkINDRHHq|Y^7+28z!=t?;=!c;u3UhJ0f37R-mDmMAo?Op5i)hZVKIU#d6y4d zcqY@sPpw<)k+Z{9a;7O!|0>mg(xqS!0j8KaT$zRvtnx@O7Gf3{l%Tz!Ka#S=m zVZ0B3VeIvZ#Yf=Y@pGbsU4J4~51pUMgxJ;ta1Pf=}CuNGR{OU_m zjR5--6Lu~$#al5)dX_+*70%6yn0`vLr-GY=7nvJ^KbFEzm!2Ol1^f}&SXz436Kq-V zuiuP?T>tiGPb6Uh=?)Nbd#eivy$vN~!>wM0*QqkJ_pdGfVoU<7dGyFZ*I8W99epLx zu;VPZN1Gr~tmElq;?N3<^el61I#Y=_paV-po6}P)kcZTJS^;fM7jcle3f^2|@o^iQ zo6DM6SD+@QNr)1An^FwkUwL4g5kEz1`cTKD*!rB3(RtDAmF<7THSDc3o%<3$gLx+B zBgi9d1-GXBL(HXp$px`#Aj8m(_#92Vf2i!$H5gBL2YlBepw29uTrS2URskn;`SQU@ zyg9W!#2S^+_^2Lh%g%Jz+{Af@o^eAK)woB=!293ZCNOr z0$eDEcjB|iG{cKX4y!0li=gjc?9`;js7Bj;@Sfg&5lU+>@OsAAdB}#}ePjbW^YJ{t z`wGoK?st9UW$!)#ZAcGGSoiJ+lO5ugt%9m6=GtHg0Nf19eT`Cm_9d!J2 zSgy`Mrg7o<;%COs6s)M+QEAS<^4)iM{f< z^YJ!7ynX(G*Hns%mM{*n&;)K&8RRcEf&@p&>gTN-2*Jo zJ=PMzD+~Z5N%5+iz5&isez{ksKhg-l zM(=6ez0TcL8R7nky2#FMY zoG}`fUEB%f7!QZy)0yTla12(kQ=6myK>dzX>|mVUnS|W(I$l^a@X|NH$(L(b+c@U! zx!%yVh)H$()ci@QSMTO`9TM?oU-jyB^t47ANp2Kyzr#cSlW`o_UfvWFQBvToelA{f z1#u>trNemVw{qpwa5g+@e!dY(C3Nn=186P3NSs4H3!PhHrhNMX2*~eQJk*cgU?V2J zd=eN6AcEQC6<#mF7;CC1dsEW_=@GxMATJhd!X9uPu%RtM9e95Ol`$D;zOfJ-SBmif zAtsz7tP27hYqiuLW{gVQ=zp2FUHK*l?Nlix9qNP{3?%?bhb0B1rp%Q& z)>)#t$|I_mRb}^*X)i4B&)mc_x)`-Wv>mF>|2dgx5XAGLIY@;We>@JeY=gzsY#wyI zmpv8;&cAOXOAWlUKE#)>*>F+jkdHRT$4%ul6|v?{;4E+V3OZEhqTcK!{K=g7g+#>e z|7iiZEOOJm_Is!&0Lr)?OUd^gq>hxvLg}rzX4t@&{oj(^DyIJ{SQ&TCYe5Pn%-fI7&u{b}b6~&a zr2bQo++%eimExGl9*DjcXfj_&z|0H_jY>2XQ*<@Hu3y7%p|kJ!;}t%bZEc7ueRCJO z71JUV_k{2ol`g#t5#kfN86@*Kq_q`gB^46uPW#<=mBaxJFnBZUO)(Q86c--`fie1nn7mCd-wlFcE`8{ne- zJo`kx+JjZDK z*q!>00Z-sl9fA9t+cIpcC}OrI*%nB4`85?O1XHl$XHsac@agwd39lS^0Ed*7g01-f$pMf`7N7_V8Qqbf45ys|srT~KqL-X97Y`A*}sQvI6QX^hMw zIM;9vEYmddm#}iquTZVK5kK)d?BxgH*>cf>gz!G_`2Hqrz$@HcLYbR=RnF{bTV_<~^IH%Vd3*@^RMr2C#}*1D zX?K`6%9Js8C;k)}?R%GJbk2PI*eupFPFd z0#w7f`hOHn!{Ff4?Fl+>O-bh|*%EI~mY?)@OQ)BQ=WAwmUvTrLRk`8mLOcj6b*Skv z+WL=6{$jA1rb}rxebAo>#xNe-Qd!L`a*h^ifxjKgACKuzH>5?lIiAN@zT3kT8c*=1 z9}E(MPL2qU9;qtucYXjNtd30_KI#4nrH<`l3+5kd{@WA2^vdkVx#Tq6W;~c#RoD%X zQq;P}>xVIS6t5UIpAd&k0%#WpYIe}#{kks9Jf@{~?|Vz_4aN}EX}^+$c25mWZFI%Y zeWc4{3P`O>RPsD)Cto%+gn7=9{B%N>y`FA{*YZO^#q8U=z99?+CN30D=ucBRJirh?D7sbG(GhBd5Tsnx{iFHuz9qj`5QOVCry0 zv%G2$>0L|HZ3+K#>lu^=815BZA7fttCWYd47|&ezri%qp6f_=|;TTWt0?zZbgtXhn zIZTsxbh-w>hrJ%F*pe=xiwm4eAGR!Rv+^g|ZiK2Bp5vReez?V|BP9F}!Q&zV`YJ7k zJ3e+!`VY5l+0$-Sw{OBMXZ;Pq6El3MDv7}w1q3`VKYs|VExb1!!ak~bb!9Uqu3&S7 zlLR#G3V{Eav=US$?sF` z(^vhYv>9NOn*vhNU@6u@kOj;xEFF09{ZZ(^bzh@?1gRz_BbTdh9FEQt9OW+Q4W~cd zshUp;X0mmuf`q1cDunn=z<|Hh%uu-=!qEX~)GMZj6A{|i?tEi7Qhp&kF;H|w@k!mk z+(pGshu>I~c?9QA^4eHKaza7{2aU?hcpyAwyG9E$UJp{Nib{f&)5R$Agf7LC&x*-w$yrx@ocM@k*db|Ji)#t~m zhIkB$eJCG`HKaAX#A#& za8_Vr?J3%O8$cK$@%__$_|zHJvx;;BFw5n2)=(9i$Cl|FLpDx`L1#l5^)3aAfNz)#AXiv-S^veFSY4$W4(jyZM+sSIk2bQ+i9~ zQdD*nzQ%=YZg)eRo(HV1txJEVgZX7$#0U&YAsQwwcoh006YLJ4L>a*z+QXzf({N2n_BuT-V(>K4FV?IID|JEIJw3&;*ziRpn zLsxHpeXR_`VnM}$Nu{h_E%v8K)84c1?nm}?z7C6n?D3;P5r~f|@%aSD{3Fgb5<^`H zHGzeWh`R=Oq?SChTO?E_HNrrGP2Tl{UYJNl-f}YZi71CEbR0W421^^E(*ff8I9|{@e^)THj zR4bBum}HD>u{GmFLroqH(my8>I_ls#7qA*suKFiIEUOU==^}x(PLk&Md|I&AlG6wV zcB>BB0s=ED;nY|E-``XYX8?{h_0`*ZWSInQb%$Z^;Kh8bydnxu%t7nbGeOP-)oC%K z&r{u{MR7vHHV%}&dztY5{&^zGLvM82wF8UK2BaaP4rum(s`%e@Fst>t`$z=-N}%qx z!{7brLwf(>^$G$QIfRK3@4c7Q+z(v;dt}3Zfgd;ryVgLxgdr7EZp0xD&p*?!aF8*f zm-e{1w|-ZwGatWspsoWcc)e?aeDf3K;~2(rVTsnR@0kA;+?%rg4Ono1(Vv^ZZNu=? zdjHpZ4AXPBo`tI_O7y}_;ib=qp^!&@Z7S!_+enmq_w2f&ccA<{1hqK=uWogTKybW= zdQCs{ET1Lz>v0_cLQkM|<}e%jE_z9&tr8SI@LAq9HNvehpk&Y}31Q@I+BcLP7@@j? z-<%Pnp7?N`qLq(MdHWu3NA}`JDvPB%_%oASYYz3qkMl0}Wp!e%@vj)O`Zbl$0rKhl zBcYnhH4TbWw&ZeN31^7n&kfL|ceI@^=P?01IRSnjaKXPNcoV)JU!`4;SD8Qpm}=hN zdRSH<#Q9O4VZS)Xl>QjoJjF3{{7+@BV`PQhZEG(a=hu^+8VrdXC{1~)U(;{Th(Mw- z1J0_YF?+0@R_=0Cc~#DE{TGZT1=oH!Q}EX&F#5}lQA{T?Z-w#=kLw(q&!fTb7ax&6 zb-uX@SE>|L^p6sno7j2R;Vrbatc~c6nx`?6MZ^h2Fl{F(Vi@7BPGwP7R$nLi*-hwR zH~PxjrVdA@Yl6o-0`p%L0z_?x(Zd-!HsLSESQ8T%FWL!LC6M4Hk@+P178rGxPeK$k zp3;;^V*G#C)LnBL-r5EH;)Gt!58KVkOB^_^lRk!A$B6R&+6}0l^woaOY00aV&zn+I zj_{YcnUlu^;Gw$<_waplUZ^19fY12*S)HDoXN`cC|&0guGK`6se63E#< zUZ?b5Wj5IAs(fM|Sd7WIPRNxagl}N8tm_C_1~LMOMgfdF$jonPF2)`t5-?$go{Qif zeP|t=hOk;~;qiF}Xn~d)2|C2LvJd5H+#DEs zN(D!LFPL2-=G4ZDH#|Tu=L2Fh{KL~Dfn)tRz_QanaErdiY1`*qi~m)n1i0Cs@- zzv#PH0G}wo;?=1!k<_xklqzam1z?VC)b;%TI#B|mk@5B><+niCLf3l*OcO$NsMdBz zQ^Z9g{=IbTIuD?pwR$abvKMN0^}hMF==;hz!b1;{hxt&kqp)VCbz&-?_=(DXYAd0O z?Zo&Ne6PYW#qB!TY2i;uf|fQ8hZ8>3`+Li&`{mg0le> z%y=*wFvxvIOD}+yPZXKN9tSW0mIZah?SourJa0hLU7L>a;b6A1INt~KL{$DkhCt=A zXS;`+AWu}4aWmSu{z9!Nyt?Pg?tQ+HcNXBG3;wA#SXs=c8jIQZvy+BFAi$TDa}5&t zt-2ItZ2+S023_9uv?9LdDm8@bt6<*}hh$^~^Aly1e|b~mO{^&oFtnev?-9cn!0q+A zhyL-CC}r4sn{a~nm>=E#&Ij6yrk%UkSR~B{QK@J3i`8j57V8o$>|>cQ0(lu+m;H(_ zf?oq&Zm4200(1it_gFgX7h*SN6d#&Mms;HpsTk_9w9NyrJz+^6T}19+?HP_o6FIHafwoS3c=~0 z6%*4^IMP2Z{N$8=X`6f)cV{QGAUE?P zu0qy(z=iy+wiE@dbRfZce~XiHfW@5Wl}%92hJugYpB5~6-5JwUGjvO>AqUjYKc^hK zJMCG@zgaM@vdXi_2mh}EX5f&5vSC_a@zzcIfSmbl1MQf4a!0`258!n=`5aoK(*)4L0M^r5;sQrvq)kFN`@XLnQ^!m&HB}qqN zeWV$SA$Ad-VTNF(Wdk*^$4>PxVxJFR&FX#>~uU8#&_1WPB#0~aV zEjn^Aw_5`Tw?I;mRzxl=hbg{7H^;kiQNI%h0n{gV4D^{{_+=(16JB;EfjlO*ezv=V z#e~qZN=2yqG*_<{su*gZB=+_nnjt9DKvRb~oZ${gr?iQ~r z0*-b8L};F7u;oExbuC*gc1CclYG>K%oG|*&$%ypN4Q5p425RTd+m@ujpvjmrx)Pyz zCXt_vse$7?^x{syu3jg<^bt5qyPdg5ry=@@O1Ju4k-j&}s$C{oCA38s;l?%3tIKbr zQFZBkhaz-d2h9Jn^ZcAjy(9z5WK(^9yVJK^o7hTKcX`e~j>pQkgboOB_H=4#eL2RF z4XZq%sXBKin1+(HKz=zNik;0x(|$E~03D|#y>U97bNf&M#98Lk8vEcjo&F=zMBtgv=k#QW4kYE?UOl9l zQ!gFG3Pk_;$b{Lwi=QHl;8Orb@PD8#Z@*7+x~IO26U)(aLDAO`RH=Q<%N+`+yO1v{J0~<)ueh*M;BS-w!bu>1ht*)ICnl9%u-!y=4 z-SoFD^D;j)T|8z`>2ew?pm!!LsRm64L#*h))ur61&p!k&cH)tcEiMRz0uI_Scvn=) zgwACxh2P(LQamZZwceoT#u*GfNc`ePoljezX2(EpE3PgRJmo}%)VyOZ&;Yoq9~Kg? z*pT!Qz1vN(h$cb9pU2kKgP4qA)*(}8B)~(2a~EJndJ}|gh*%7u$v&R}%gHxBqi4es z8vL$XS;GcG+7IX$b5DF}@2}SwE?wpvEXUU3ti$Fy^PkK7E2cwC?E<1e%z!92)k`+8 ztN3XqWWD}cqJ2eMx=)!=4}Xq*9PJF8`sm4bC4VNZKj%)00ml@*)?^+CoCr_75G@8L@$UxwJl7ZN1SW+%vR9pK3h z^+ylO{{~oIMsMQ=U)3#5BMEG)>a=Q^+_}c-fxMUPF(QN%TIj3XClo@}9_4ycVe40U zzw=IM9JB7Ic}{JN$9Z!XK$3#GDfpQrq@JuF)X@E)!$%_S$kmjo5SM?cqi3&`cd=jM zW``5V52#1+gn3_#+!2VbhRU>OFyQrqoeafpnn)^SERA$r1MUshTL&TWl!p#^c2|pc z@2HQi!E66hd6;jY5pak4GH<`OxSB2t1(PD5E-tHeu0`}vgEHf+&S}3iBpyVA?vUa; z|2uGXfIlrY74-e;_S{uZ-b?zTAo$!%^=Kr4uRiya!f7r7rFTu5yZ#}P2T(XWG?=~| z3)r7J8)iTRXKV=hNnw3U6vMsoY(Elb`k+71cFeKFw9{8xn^=^~ zS|v`|OjnmM|6V%8SK|CZ%90i^{9PKnbPO?$_Pc@~AUpuJ!U%Jq3z{hlD0OPcLo|Gn zLqyjODI6!m*WXDj9@wv6T)7)R!UJ3G@_wWoCa{tof9ZlExFM9sYs+N3#0-9^{UDIq9+{SX=6Oh$;ZrZD%4lO zbE&%=*LyXt&upDBI!}N(^YYALcbK>4h23D}0``gA?GzdR+1=Qq&H5I*kp%5Mhwe~c zCG!*r9Z!mz)7b0z0W^7AiVORW_1`oW02o|XGx%vbXT=tTFuRQoXls^PyG^sp-2ptm zcJu7W;5YQk6RPD96w&+@YQjx|X($Mk<}=_5a??GH91MQQ#~;E!x*v#NNj%x)LQvUu zVXnv|mQ@yR`E*?Q`B_=;43%aon;s*?6`9AUKCt_(IevgW2DN*MwhSWkJr~}&Y$Fs@ z@n0tk=->r1{WTo}DH4T59^Q#O_C6)j6D+mEy5 z{yjDA@~tk$oA~2y#%CrqCanA-#Y0JmkNFmr=5dq|YN4QhmCn<(o>K|mvwYMl#n00{ zX~$|4HH#^sb8%bHVkt@nlR;j8N_Xi@1z*qOt}Fu%r?)e|0pP*Zplp66&I4}Ob%M=$ z)?!Hykjj#Pn~+k$WAZP~W%~Y|-1z#cwb>3vJ6{Z7h@B?i0b?B>Vz+{z$*1Fqc%b>U zZ%5c(W4PbelhQ+z3{CRQNE5j)F?oizfo`@xRN z9NiSHI#o= zCASyb`Oplk;+VYrIg*&&#mi}1o8V6|;iD=BNBa^cQ-hs+HabtU#-ZH+2zzj6kOi4< z#Og|gzy-)5bq4uD<$Us(jEXNWdSCL-sOX*s3L!wSo_M#DzK*jVB z8#?4k!jQJhTi?eZTta~1_C4eaB8fGdoc_UQCTc0IgBA@1l~2rx2z>=SKMnwA{|6V_ znaW~0u^NX-!0U=TSa~#%b4TdP)h1+^;NnLycfLnPseieb3ub|Nz4mijq9DOxKlP+^ zN2C@r@Mf4Yx{NZ_#?2x|niy>}NyTG3S;)?mx3Z>jUTTQQBZrM8+!!F{9CKe5C~f9! zQUleBO)c`06SMUa_M#^VSrSj6F#)nY@`_WA64-&KP8^4%aez_*Hj5+tGGL~_oDBa{ zMcG1!*&jF&DT-`sVg~cf>f?A;x4NFQPIk=Lh;sE%e@fjlN3osB@!{(- z&5#;Y$IT{`EU>dq^`_V|6C>^x-&QS{ZLM%;FTOL< zuM*+8askA?>Rh}J&sDm(izHoaMehYe4AUVhG<~~gut0%wc1n>gRrYQPf`)&J#_cCx zNd&7tQjH8v@#>)#!rG2$7J~QY%|7=!m344K5wzI)? z1JJPY=-&2tM%>#`Rw|#}1L(VpzDnZclS#w5Mo-Zlu;1ci$c=B$7x=4rIx#3k*5|2j z=1pWK9-PY(D)S%bO4a`!6p<;W0Dl(JB#8FD1Flhu9d}zDI}oZitNJJ3Xq&g-l}jJC zQSg({<{JJtoAB423J!TaF;OQiwJ^T~-AocEP2zdM-&$1WsBwB{Z!QmBsITO2Z()Aw zG`lxB`(&UZ%{Sor1b620)>)Z>V^cQp|_ zbna5ZFao?2K9O`>;I6PCO)q=`F8Y>j@IC@BV((_6D93RcU`{&ZHdC%18(30OGEY$S zAEm|{9v(Z*%{4kdE`vri#gZ&$vRpg)mU_N%_#2rxz__AV(1xWPS@=;MpjZ&p9;p?^ zTgxe@nGr=h8y>@bS^!v#*mPlgT(WCAjkIjkrguS{p_|j9uOFb2tAY`pH%3Z!%6=Cs|FBlG(;0+T) zdVxT(++bY)hm6n~^q{0*(aeXZThqn_(}AC4rKsag|DI@mw)f~*SGvuXy40SkXus~ z$r8~+FRyRn<}W~(p1fAEj%!t4R7WpJ-xEKf01;HtA0dxb?&XzTdo?un=*W^fg*#5@Fiwy8vVKu3BBPSWk!c< zup&6lA!_c2>-HKX0$zX9q@T^XZz(wEuU>zWcNbR@of=z==xUGC`hns8{XS zI{#C(`>X^)1&H72Vm!yj!8E{=MY58V-d7MNYl4uSq4QNVzcjs}rv|u@L9XxDe(fRS zadVwVUZr&}gyEyKS?R}r5x@UC+nfZ_AfZNv=f}jrHBcZJa2i4mf5Wu)7e@4739YH# zGhUFpa&7&BW-ZLnn}IOcR}Y{me%AVHr|kW$q1Q=Q?}B5;#p=ux^bsp5?>jC7XU_hg z7NGIkcc<~3_k_IY_MN-<%!iIVMI6Q9806EB*A(!Ia69>PGel#B1SjBYr7l=y0t^Lq zvo<;;qZc&4ST~bD0ek>6e|uXLW6=q{Qa1blaZ+xN{%v;3dJ9|2hV$5I0Y6vb>?$T>AQmGzSfhjW4Nf z7cd?SQw=>JJS7x&nY2lKP@M9fMh9Jsv6&>tw9cS%_a!r+kjKm@xxS;!UA4yP&b zl5mx$yl0$*PIsjtOJ5Pj1tzw&7ht)leBvTCog2uY-Hq4;~g(u zSQz?tUN$C4#fMmS2|rpj-5JG60a~n4?@sq5YZHS$oP3yrr*urK;or7Z>O#Z&(#Cj$ zqY8Xq9gH3tCW89*xA~pFV`k^$8KNspw=YG#CC8&772 zDfa@qILhkJh{taTTwcbkHl{*o-H29ulJPi>!!zWV=fochX9ACjJWJ>ojZmGWrSuK- zXJLV&4aBXmC-p1S62o}7Qk@|a~U1C*%{cTV0l2@gVi@(#E0 zIB(^^+|ldP?Kr~tW;%G*dOd#K4q!;jT~KR)l{Tc9AVec6C8YNXT2pl=e{O9W5ejUe z%7D5}45y3D&odRGF^Qlg&re3SP9msfFuAp_H!cV)cSf$z&5-oo$Y8sK57BSpg`@>; zj;FkZ;R&ZTj1mT8&&Vl1h{9m*7l}T~Qj0?pqxTL3$qD|%xQAlIwXP}%*3I-9JI zO;(`uGJbk~VtbCa7JqdavzwORPQIMKN9u;a+>Xt?CzH1ykW{`Vfw*NZ-6h#K@py{k z{h0WtI@3;#Q?NP9LL>0$RkGZ|`h3v*sQDa0T>!VfYA(V75a%)@Rxe=_rX zJ=X7bAvQpUsTAdJp#7Ng>bW2pTG+Xt%3}ES(dlCUS07U#X)AzZy(NZY_=!wj;P{{` zvTH5F$7%1T)Qmyk4RQRRDnp56;K~gIGIXnu92>_aa&?U#=C^0ST|+NMh!_nFpK}0V z!ryZ%7p&IQ3(XN6zD*quDL|KiRZ@2=&LsDqdm&*K6`mXQYSn_+&*twM4Kud@X(UR_z?vQRoy1SH=PC-h#o25~Zl#)h7RJxl51ZfbEMs{iGh6Oh6 z``!E8KVj!N?{CkUGiQdugyJQx(rW8!QVPM z?Vxijf`(Vq#;*gFk7#&KQcZ~sJl6F>dhSzf#uE)G^S+T!oHQm3Qy+Z!1K|5qME)2Nu=7_eF2 zaTtEjchsa-n)Im+ly{WnqW6+0jRPCFS>Aef?#}QHbVqL3qwWQ^eU{@C=;I=1!Gi?0 zS9TFRC=3b&5=P$(K$6T#XtC#&0cGe5=n_sWx|Nc9|thzqN7Hk&x54?6T^5~Zjlu9G58aBwlx_Ruv>=zj*TNVovz1SvJkKkIIM-drH z5CZxkKvP7S?f%u0g#Jz~R%s)>2hoeC<{N)8_c+)am$=AB#gy3Je{wBL6ZuF3mitRY zsuG(NbAEGy9MH^swPm?*`S#)jIIN*bdS>=Pm3XFE+<9pqOYH4o+vg&pwf6zV)gt+d ztq$0p?o`=)D?enzf*%jA_0f?FDEjr#suo}tk z=jLG$j;{Qk6YFfQ%T2GIi6&m0;LEj@4iK?KaReg2Jyt0}7MdVam#Ni~;CJU*1X6Cp z1D|Wja_d(cW?b0zdcVO^;;5Y8`(kLN6TXa*yUDv09(X#xMn>MiQ|L_pws4U^)Ui&s z{d#JOe{9Srl)`#P8^ST$fAq$)BS>=VK!Z=l$YRN+wvHPIbs>{|`I+w$`H;o^neu~x z{dh{$085BFTaCR|Rbs%z=K{&i_!xWfn%o4r&^xtxy{Md3 z3cuUO!zwa(M{^vGRho~X0mmMCtN3HBu~@Qu_4O=o@zxn>Ht0fW%zyI8_4Gn#(UEhY zE%jFPR5r<`{y=>d$}=;S@Z_f^GN<%zJN=_O^F(gvIp(!#(hF~E1ERi=rf-!)*7r6P zFA36EyCh1zE@1YiZ39hMM|Ug)IWgO(gCOG3_SE5I1|Dt!cL$5BZ0yi{TI zp*Msv)<~s(R%v<7Bc-p6CiW%)XW=*wRj-D4`-<`Qm_qOoEO>t;`16=BHSuV&sfk$M z(Np&a2!yZE5dn+6R+ta6%>rV}woYdY5X_bK!$UWf_BL!GQqH?6x)c4x@5{#fAt7s_ z(EMaI_!)~{C^b*~Dm)U8@ge|f^4t2dh8<};{ERG`7nO|D&gH<6A?Cgw_w=QY0nksg zUw9qwT3Gk5Lt`;sz;`c!@K@oeZSmkz{F2d|I2qed zF*eJyD)!&hu7aaZo7`w*LsFgJ8{X%5@(U}Fa2kp@hEft&!N}{J4$2uL5e<+^q?DSz zUolOr;o&#R_1i*D_s-w_`3W9?ephJ!VN|T*jfeX3Wa*Vd`cw!r!^r4WNchH= zeUa;sofxy5bR#ylEsw@5P{r-`_XthFfM=Ek<+XXj>^S-gOiG5Z0z^cLFjhs&tY=;k zvREQGmQaT&a`eF`ebC=(B35*M`BEpq4w_80c7vY`zMx%WS@2$}xv3o-j4dJL@%x8& z%+G;u?TxkhS%jTk1Jr~e`UrwN-&g0E&vF7YnwY)kDgGM5(q)HJSGmbb3-?pTMNbyjVvL zjf*(|R=f>Wh}$7CDfAAOac~aQRITRmIKHFwSDGpS)HT_Wt;4%vEt>CMZ7;Stkbd_e zx)8=p@H1Z2lctfbdhbag{#ibLqUHw&XwssxLjP1m4&&IWlG4@e7XRG+=4t|D*-=R6GRpNN)CY$tFz0xW z3SIchl6Id3n`7bCAIKXuD%py?!Y2(RTA?ZHztr*)75E^j?M=p@0>pi2-(oe9N%=g; z%5@5L=N~zvC_cfme*>gSn>||2%-?1 zCxCzrux13Dc_seSk25vO{ASc$Qt=VoU3o6Si|-}memvk_OkzD=@OYT3cxL(pr0Kv* z(7)1skq3IKUJ2{QYS1H=#RfP6_Lnu`x(zAWuMJMc9PC>b!4rNIpk4X z|0EU_UpraIb$NMjrenYi?~o3@4~Il*DHCiY$+cNP=VSQovi{w^Wet;xq)_|* zmi*&sU`-h05t|99(Pj*gobp8@1{=N(f9?7LtHByj^LNB+-bJsfP|V)cq_}e-l8qjS zmR2j~doyuiEo@FQIl^jueZrs?=4QgdQ5BJ*7Y|wCzmH1Vk|h6=KBEDF-(QnrD9B;S z&j6oWliBd+jB%5m8{pE6>Qu3IPhQSC%HYxVmXMl(NB;+l*oQ<6UT-<<4)ptQr6*JM ze-muQW;zM?o>E~{p@4&&=IczWa_xbjw=}UM`nU=sCoVi2Q_guFNQujNwys~o82SfO z4=wi6Y#o5R_Q<+eYiZa0B>|unC#}Mi9qWH`QL;S&4r#Z*+dw#iJid3$0us!;=_zpN z*>BbwgqFa3u%JaVG zbxW^8uF?68?F0}<`JsCpI3e}5qd~C~7EwmDHW*SZp8Zy23VB=VhYm2uNpgX&%Jw4I zsjj5^YA7SD65ls|13uf&{6L!q7$TC00tS_>0DU(Ac+fUdVnG{i^#OGJ0CZfW*4Jqz z82=;jh&u{vxi9~_V19ghKe6**81nJsF(4Ei0j^1qh}Xpmnx~D{6VSAz1-C-d2&^?m zf0KfF5dV93?TZc9aqxzJx%R_G0*9{8sq@)52>b9u*`6b{Xoze*syp<2oL(~X+C+b{ zjbVdupiK3%&X=CI^RflckNAI6DFKIT{8z@@oi3G=C(O$5)C3y@(L}bP;N-V^E*m+C zW&=esd@+v+La^&vxHaCcauqEiP(FOFMo`iHyjzYKv8KzmcMEwNj>;=knE{+FE)8-E z1^z~8*dd1xU82mj2X5rW0G^4#zoU#`h0=xa zQ3E+1qydpNge+_@zRJex4M#d0g6}56wkkf(f4)G>48uZ+OlutFUZaPkGV9$3qrZrx zl^_DZ%fk1#kZiwxe0@TEo7P%6_$=V03j`3jOdq0}^&)knXPp)8?Sh?@f84!uT`V>A zNbTTH{bba$vtzVnZ8i-i?K*nl>!Y2JoBYubS$Un3)5{~K8E{%jll}~*JdULG>RcHBiU&xQy&xZS zWqQT|X^85WV#HXpR=ZoU^JEL7;iIqxbC6Xi$KfAqWG`%l=kb06jMnu97)V3(01v=y zg{fxg5+GdsPYmal;&!GpFOyNjx0;Q?W}bfNWBX3$wq?Z=rp48QGS0CDm=2KH0<(s7|p zpSZ}VJcBU*c`;7FPUsu1vz|Ha3*(RbZ4I*c<%HoB{nZ(~Q;3V*6ej#6P*a}1AJdYm;1Phkf_ttRk*jG^2ZqIEc%y7J9AWL3pS zKGpJvr&;+|crdk5vmOstsUdlkBHUEu^1qYj5(j*O{y6V8(mw~PGp2=o6N_2k z{U05--{7`XeLzHmKB~u!)Bg#v=yL9DpI4BqxeLdrI5R*pq4T2hm+Y8oj^wTWvfo%e zq1lPz$Z4;W8mEdih0I*Bx4{e5AJmU%w5}JY!oW(-D@)5a;dk|Yua%SvMG7c;da2>Z zUH60oZ%Lba9^&qU2CjGqG85xR;KzeZFXR;bTI1sxSMI(K3C%Uo6lJMVpf7<|QqC6FB(P{MG zX2%apKg|O0gTeMTUdM?keulnS^C-cC+=!bE=0RooE~mYjum*LMq&$D1+gJ_EZj&x@ zG|7CA8_M;wd+5CYN`n$49pvd+yDtuEy!J6s6^6*9y-{F($F5SMk1K@z67RM~78P-P zr&Y;(*)#}7YFQuN;WpLRH|5m>k<*>DeKXKy;)2y7&=_T5H2d!3-`i-Bq7cT0I`Wum z4VZB>v6Oi7l^7RIG1d>rhs!R6{tc+`YpB1w-^FZ(o~~(>!c$??=fCym{nlMIm7IK7 z-ocmu1q}80e%+EL7-)UIH+S$8nB}Qso5%a>?s+RaM*BxdZ6nMdOYqXjB5s72%tpU< z6l4F{2nRo$FqjaT=0&#mK==S^u4442<%1`5wkn<{8!Rs_X9aK(Y&wnYqa-C)%N#2uxEi9XxCQwmgF$ zx_a1o$}zGM(z`H3yMV=#QT)?z7m|IoVILd%E5eJ1Al=XGX?-DzJ|#rg=i~3I%|_;F zK)T>}LzYW5{}M%y`0S%Fw5+gWqC?3hl}xGM^B<#mwtL7P9@;%*S4Q~Lr@I4hK#59n zQ280&rr4lGS-24A?)!*vs!o#*3EUo1GK+`8Fer8k>HEn5$@@C`{ZA!UE3nhyvS5@% zrt<_Cr08!q^E7tY!){dW#3pCzg#ZOb?0;lu&*t&yFMsmbyIHf$*!C+(DOA#M%+YQb z2u|chxtvWdT5AUKe7IXWLyhM2X;p5;7`mEc)Ta1{nK`h<_hVfZP7GvP4ffv&(+DjS z;t53-fF}Zm!^(W7T7%z+EMMPk<37B^e`vAu3OBJzjip7iw_FUBLfmn44wNvSpJijf zh!a$J)!Wr`mxZ0#y32n@`!JV1glhHI3MR%bZ7WW;s;_fXLcMKh?;UACA0C!=ge84X zM=qPDN+b6fX{>Jkg2Ly*lf;prXh+An^f`k7J7CD|^!I39Sk6ppnlO3lC2 zc_f5&-DEEMUcZp~eW_;tT*VCU{qoU)IR{$<(Mg&467H>~7zc-~J904? zA(b7bTXfzNrE~do=cRWYOTtwr-_Zs-tJBB99plFzb-XqRHgRI}Vq^4i+7e>UXefm& ziSd|cw!0IQ3o#R{YI;@sdbE{6;kXzNOhO({&`4l;U!y_V4iNt?zXp|>-Wwm7(V68r;R z7a>zjY0o;oQRJm=LdJhJZH@fi8dn5~FHsWqbS1d@_@E^9I0e+m!!Tm6sxYg*NGFy( zmrrJKVOpUcG^d)zm%mdrA~+BB#)ftONDeMEyI?UevU(;(Iex{Fo>8S)YTSgY!8X*O zKj8kDBxG5RFWVAoN$)8>{-kb7flI?25tU8@elc|DRkES zH{dWQrkz6JX1lpvK&0PCQ-gyE5>)E%=f;%n@BiB-ffnm_d*rCyJ{2?Qcv5T!`d#1u z1wRxu_bJ5Lu5(y&X$g`q(izjhn;lY{| z7qB&(0b|(RD|**v_Pl$y`zKjvU3wo1J(N@gMbwhJ?4;7&&&L?^6;HC(*1a^;JW*9w z%)Ytd1tm7G{P3-mC)=joGJ2#NIBZT?I5NxI&pVlPzmZWqZ(ph zCcQbiV8J=S7SJ1%T-(nhD$&=HgnRe0M)*qyF!j3y%JIjfH%hS4aY zBTma*3k-O6UKZ8+6Le-yNz|c5%~*bYd_F=}G&cK8l*T9;?76v<;b{dOdTpz4_#|@X zW5muY8>7IC26vPSgI?=nmuJ)h!heOj7~Q7a4zz=gY()p%;gE(bj90w#(L={u8p6b_ zsu;bO)K#Xw{6+L-KBn5&C_36dinVoNzJ8rvXxf8RJgwXiD8Deocyed3&e0OWPA65F z9)u<7{&cR}_!aJm#ds{U z|I~Dp#g~2+0F91GKxp&&-bFU)qbW7Kq4N*A+8#Bi!Ne|+?G{kZ*xj`1r8o3PWwrg4S$ljQ| z-X%j~Y7*T~+EmNaMXly=d57m&TK4w7F=1iIp!w6;TIUUcu*i8c7aN8f8`VpBV8ILd zKh&qH^g6^!OB$mMa*|&iTp2n#npI<|m3vM8lVy_PBxGIY)4)^Md38%jL7I;OVnSKbW)UJtXtLGm<6HhJJR?V{HyUU$<1bqz=X0{(dMXM_zEZH z`@IW?klK%qmGRFf-#)PWJ$P47*3BG&i@!kaEVR_#_7q;NI=nO>>Y7~P5H5nRAHOak znRJ#cgL;In110Bn7yzw&4Yhm9|FfSLo6NdNw>h-;up^WYA1ippPAM;paPafL@a(<2 z^?*}|wlOzaeI+>K{f+y9fP&m=3*6F0yd4LzFd3E+q?N}EBw@MiA8E57_LIh#~!8g&vEw<)uO1(V4;7*#V`PPHsyaV|b*K6+`K zFj_()cbt}JgFz{0!pur3kd?O|YUIWnqDc!|8XX5PomBGq6)i#bLELM15t zgROYz|AoWi={17-rPU<#OcM(&e^G0+3WWoA2e1*PEGJCJCHD)~u!H`!v-MI;Uay%4yVh4k&oJMH#@|Uk47M*| zV%^eg^Rf+=h@;;>hE*bs)nyTh-)(e3 zb*+@*&h}+LxY@TgCQ9?w<$F@1TeN(qP9Z-wGaet$0)Y*Z+Y`tT}$O>@Yyi(xA_u&S-} z!w|WQ%8UjPQ$p+O*wxC(T7nKf_e`j<(T?@78rU@T>neeJ{j!9HVi??8f+^ge*0zxU zhiv?;gt@5OcVXvuflXm_-9Z9mj%V7ii=VXZaBWGi?a-Zin>A8zE)O0)s9l|(EiJJO ztIKI}HFLVzrXBe(`He@KtzA{)meFRP^(79ru6I=V4?y^u&G9HjAeFqOskhztQfYul zC2cp1;QX#;;V9VT^h;*%t^!Ufx_|3Faoy?>I)*og_n)tlAjQi=$z+2qmrw!`9inVb zVwE;kOQCsP{~bj3C#yfUAATd|;zts`q<1L@M~$E%BW?G6k$G2i6a=~EKf`N2W)R*> zuY8P&>GVimIb+>`m31`sEKI)Cqm`d@btC(8g0DAqUTI3ldve_`>NTtGL2K;;)AUTB;&$a(a3M z6sq2|dynai-X{b;cyCLlyk+f%l)CfC!pxpZoINAZ4~W4!F0hJpv;=wDO)`%BDXg9t zx@oG8MG|P~8;G!zStrIAKe32WEO9pMH>6bb`@BEhYZB;u|E}}YZhMBrv=kF~0je?J zQ)5nyGPpxjrIH;U^;gs0rBqrwMHe{KVOMug4ZzJ_`1b_#7&!M#_1)^Oa=ka>S{193IY$ z>cCA;PBLe>Z3&T)KCUe@j$V!?jV1C+_GuL+n06^-lB;M7UR8 z9|`{D@%@WZ2*m8~3RfDTQ{wj;$|SR8-fSVY^#~cV6#lw5erHx>ef}fD8Zqr%*U4}% zD%9H!d7552+UNV-<>?1p-;NJ>6S|Vv&tQam)4%w7XDl5F*B&gNP$FL)ZazQxLMCh= zLhoal6l3gQ6*HsMFI~+OZc4VgC)5Q}w8I3^jL$g#-hR)&>V34ZuUfryR_)@wQgs^G z`5x1^KRj(5si~JO!Em*mgW`5{f)0$t#`Q+|gY;)IdRCT>u&n#J2en=MKHoQYl$75- zGQQ&@{Edd)@l#vbj?dHQ2IlhSr{ zXNXY_5n_TpZ8EF=H`t_Aa>{t0)T%WvfsnpzrIs}WSkPfioQf>U;uY6ET+cvcvqqq_SP%AOLJqV*(VAWbOOWMW3f^Gv)cOP^rrx$WD~c)9)3nx+;eJJHMm&(9sczo ztz^fGp!Reu`}MVzuKZpS2eXPpl&?am!qwA%DWWJqA73M#I}s>lx0{E^z!R#+Kiz`M z=I?rYd{W7uwEg|@V<@WqC7x2WQyxDi62nAr$3_wVia3UiPMSq34UCdbQP>a3mqElZ zTuwbI_?+w{7@Z4q!(=Hc+{DKP(FbP~uj(YVf7&xjG~XuDgkOsI-0d>WSg24G{M=(EE}Sdo`FT=I_A&0g|!3l`OL-zpy_0&x26v>`I+ z_LizoOOOob^;sD3lliR$!h{-18+XBzTOy%XvmCT99^DxGg{z)?jp5a zXQp+?I2i77=5$5PprG&ILj3uZMxP~ zRClCaLQg%l^i}cb!*`4F){!s2ehfm|PA(^$*u~>yCPhB~IspG^T3sU7LzyIj-WOp5 z&LXeQn~8BAF=Ew^iDe_F??4XjWd-il4hB9yrFyNcSo7y?X^7T&;x{zwuvLEcQ~ZLB zkZA&a1JqZHPt=($4Z*pl|5!Wc%#9-fE^YZL_GEW52HaGI*y9Mo5Rro)X-7BKBy;}W z;QL#ST}??~!P_-oLO>?<>Xl=!k*x-sUd3t?cG7 zp81QZJaFmuuEwaT!o$~@o`embL4h}rz2Un;7X`iB$e8VGJJR#Br8;7GcTg!o>jG{N z4yyqFJd7l!-zC+Xgz~SJ1TTkqCn=8JL7y^zwKATR%T!ltMnq@zCrQ$3Q6L<LG(4}1Hzwr@hes9~6L4|&bR*YVg$;G%BxR1v2z#^1!i;Eyf>3w(fl zMOV34SE5ats_A8`suwvw-^HA>wYtH^o{zETFlY>W@N{9D80_bEv=%v!|5P}2BvnRO zJHRldW_H0%s+{zsbVJf z3L`*h%Q9F00wsiv#f3(!dX_%%i()H5R=b$DnePNuX$5_l#Ri$V7iPrk_|N;@VgW$s zz_OH~1vHKZB1R=;F!i_?<1NM$Lx;>Kxx&&H4^{p;=V40c@a6=YJz(Gx>xbkfZf|-- zY2oVJ}`hOU=CQf8I}XdPp2vmf%f8&qHColh*+lU@Z3@SejtSz2VPzFS05309LDpd z_MZ?Ni6t_~yW;j|S4h;;vuAde-6i)QY`Ul89xPZq%n_e3 z-(KC^5C3Maj_a?Ju#h^nYnS?&$h0Vmb+K>9|EIY$-8~|0;wbKvkWk)@QRmzKkwHiy zp@;BI=f?2?81MXyj^iVBD{X7Hm$M<1dEV?|LST4v?J4HK%zR8?9>sH#@z^|BG;Ce8 z0d!0V_yi57M1-fY*y;ghDciQEWh1$wds+4LAFo* z1VD18#=5(YO1x`i{QN9W$p5}4iQ^Cq&f!3sg(E6 zu!7haCER8kmV3(=8TwgDjYq(}zB_}PC<5H$7W>Vn%wC3U9T&6Rb1{JcGyQ%W4F`!J z)uRm=d@*neP>R}q@@52hU*SX(`S8_3N!-Vx{xD{Rr`nMHemm)Z!Hc%oXkRNi<_^Fs zrG_;~Y`826KB4VY+(Ad+#?z&Wr;Rs*rb2&M=+l6BAxIpM>GAS=g4V8ceCSBZ^BVqs zNYv);lc4a;;S{^$z#%UqEw??oGg-x>rXxj|HV-+&RGT{4FIdrx_;j0n(#urLV5K{K zNPi~|JZ1Lm*Y3hu_OD3I)7KGOkrh^FiMIx&U6OW8t)$W|)MUpvfY3EOoovg8x|i;TZ}MZq&6GKKb>EYY3MywIgQk$!JE!`YLTncIoxy1TLr46Bndf5h+)8P88`CdVy6sDO8#tCYEb(?UdkJq!3+2u{uj|AEv|=l%O47pY*|??{ zH2M-XT45Su-q5}$x%^F;q$gZAFDr!hkC#D5@Ss*}7tlY@*a~g7)7VaiEwEVa$XE`3 z=Wih?|xdiB8w`Itla8&n=_B=`W`NR_VJ#` z-yMrnl${zG_(%wcpV(csSK;A7TX8T+DO+TSA{y17^AYE4ltZf#_pR2%toal;dc4v0 zZrU@R9pw(bChGT8r34B&s&I4IL+#gv38aHX zCFd;aI`W)I(|LLCH%RVe`^9-vGZ#vJ641#gsYvIZD>V7sr6xs4^Eco>UmgMkf1`wUj>h3BG9?8!QC#etI|-wbrNmFsxcUTKz_{qut3j zeYmq;e^>^$XlmIp>jUX7zDHY6#YO1R!`_{Y{n2|R)|QI+q3D?j_K|xzXj~=HX`s^k zKy?{1YXzo`w^mx8&tdkRMF!`-V&-j3BIg~7%OdB)i@wd+q*ztibNauK>pSLeh~)NJ z;|#yI`nT-sSk4tJ`NV<0{XYB4yoTR@elA=MLPyPEn`(;$JGU5^G|_)&xh8dpNwn-e zx%(J5g>O{fO*eO?IZRI~VvvxRcRph+ffi@+!y$@7EV%4jf|0r!I`WoKI4`1w&URhn zIrX-dmti6P?71;02-_an|-+FV{1^p?= zXdt01nlHF`^GCEvIoawt>vC5wnMCF*eVn=@e1 z5xPyg?Uh5ad!oUdR&;2~-t^c&6JY|iV>RRPJMHUey5PkkzDWvb5p8l1!zk3CK+L_q zIuSt$pgGAl#4nE7EY-f62>(+!_mV?$)62t$1Tm&fpZ_+m{cMInI1dise5~(#agC2LBZJHz)MlC5(X3 zk#!Y;1%7?Kqm2e}6jc6mj2(>Gk|5*5+m-8ci*#S&fp0l7^Q9GnlLXnKQEs@|GUg$G zGsoc83w`M?`9vj1*|L(O%1yh8a_T_h=s?etndP-{h8}osKmHZlYW1oI^`Ziklna-; zjuM`MNN3Mu3PFLA4+~KQ>JJr>HSY%o9OmYqo4QqkT-y&yK05c|H!xwkOwseAq>mcn zr-iM|X#w?mV_qb2BnZDX_Z47iL%Vqm3Cy6juSG+}c8Ky-d0lCBTw0AR_B!l9^op5o z11Dd6Wv|cJrH7vw>ZdU%2Jlm#?Ik83xytE#y5|u~H4jd3+MOiQfXUJO!F>g?90Cx; zf#7$UkoT!HinBxa-3isiX|P(^ze29zlK@4XJ*8PLzVOy@{W}K9F?#Mvt3R61dGes`s;3R&?4v_qrO*qQt*DrnZZtVBmJaIkP8 zhZed=Kh9TD4}bgCDZw`JOejwN{+!8*>7)rgNj2ntr~2f4OOid>T&%lczSmCd&NQXE zK8k-$-^_h2H=`_9hPXMdq*(2*p^sFn zO<1pI{1-Z_-uf$v&=VCsY1YTKFLBs=nk|)Zoe->9nCW=FNC(^P$audy4=yhQCOr1f~LNpdM39ygHk zN&-70G9~Ci_!&F}Ey_JxP+oT%Q+TFj_a@sQsEl;dcI>qDgzx2Au#AtH^x&L89w+Ej z_!%t*K<#+xGUJpqer(P=N$-cg{fmSx&$5J1TzE7w`N_glj(bN526GWeUqgTtL+7X=1uh$hEZ0&!N}EMv;GpB`?T7$ z|Lrvt?%&Gxz*67JZA2X%^SAe19tQKYBuR~^4b6iLaS#@g29m9=t0AkKF`!mQ!mKQ| zq)YUs+hf~-tn?1#4@|5+(9P5PuNF}e z8_d1ur8>%+FwbW}mhbSG>UcIpaF$ zVQ&aH;ZdKS1B6YA(NlZa4ZV;5Pa^ia;uA_lbWg8+M>!k25qq^<^~K_!327ZO>PDF}?a&kD#(X zsEx#h>wbKVEk7jD>3hXbo`kspC<6T06)6dnXjRZrt7E~*jx!ArBc`hL{~j?1C%BK1 zc@(xpn%EeqXOg`)Qcy+VZ(EO%UMxTFzqHiH)rwFz%%1W8L-w}L<9y6Iyra4gB7!Y} zND?CO7~a(8r2SQ`k#I6GLDRL$D@s7as))|{9QAxPnFhdZ@Zo{x|8Q$bh?Jzyp*W{; zEgYggUp<@NlDb){fSt)4i#~LWI@3ZMh=t$pj4h@Aj?}o*f3+HUW>a$KbB8%}50j`5 zZn#}BrmYti4uZ9Xq&}gAFZN^Ik0M=;s+me9FI$@Znomw5t)+A^dnR+lh_T{INd%ml z-MW{{u8kF{ov}G>xb*clkXI(nR3hj3iVF77?%tG_UzPi*@$}qo<9*vM?xArp!a?^h zx|Yu2Umr18pl8{&^TS|ZTU#lhkMh*JsmPn0cnUxI^0)kNQ4q;LZ4+Q=rag96B2Uwl z7!{N^Lz!4&Q<>fK%fuKRnT97^dj4py7vjsfP;f4+q&)Gq)pyaI<@QiAi#-t&13!0v zN{E&1O%iAc7>)MvGx-Dfw*N(gOax znEteSm%i$hZeGo_*Rq~xA;|e%{Qj=X(+!*+f5vg%IRnDG`EsBN1-`0X(=Ej6YVD^0`6EUN0e0A;}4fdal zHyiN;*NvTT*^p-b=;j)_Yk**5r_Y!#ER~2k`DG6~Ty?C3zz5-t$w z$h_^xF5h+r;X{KT;`U=kNUU#yxR_Ph!F-UUnzc=!MSWop|MuH~a-8r=NST}rcI28e ztOxbhIr<5%esyM%j(y5r$`|6zfr0gQJT-`t+4?BjAU0uZ98W)+rX$M@!l+Nk;)@JZL zbK;$%8d?7<&~L~q{W?9gQ%gygiSuaCNTs#(wK*3iO*dh{H66IrT^tt)Iv6z`!!6KC(>6lA){f$&SSJJ@(Gk0+p zbb8XHFMXtRix9@!W-n0Wef>bG(oJaKgol*ba3KG$JimugpVz;IYZX!koE5#KNszF- zE?`13pa06JasQ;)R0ORNfHshh?$?-*LUVW_eBR#-+%B5qz(OP2ia2$2yj20SM<&l* z3A%&m=_h(4P>M3ZO<^H!NPpj&AY zvb)5^_OFk@CbDj9<{_H&tag5UU0PnToIbU!B;p>FGq#ZydJptoXY@Wc3Ub;Tst9DQn-Ms@1uYr;V{;=g^`Fqf7arV;u&O;9vVcuHXg zPHH^~@-*+LEkz9-|7uhy4d%^KwBdaz%9{O-o?-itlkpSE4+B#SW3{OY1Crw}10kvO zc0cUV?&%`eGhFPXSE1kiemKFn7$(&8qDc-`NcYb)5oA_ffDL#5Of{D%>+wFy2F_J0q zL1gf2t%Jhc*a_TOz`ehzu$$VI#)cO5)LP_G;5BmzhgzvA^)DWUr`YGgv$a&fC{;;S zZ3>_2{$aZO4O&Z*3{0y;+jXxaY@XK=ayzwXw2EyFLQ1?364c6Fm*7XTs|^YRg;UNw#OAPdMk8 z{86%YuDa0Z!$zHuoktY;@)M=jL_1G=Xg1l})=UgdGz%TuLrWHXrZ|59lG~OF!x)BDQ}FaAFr$tKEJ4%if2M{Fck`U>Rb@1S*jX z&BOP>TT6MTuOgqUtaIel6b)Q%z{Bywv-D*&K$>G5PH6VU>0R?(lAFDBlK4v-vS|Vo zVZAU=g!2~Y1K_~}a>v9P_CDG{rou%!)J;5UkRmN&d&c66^~b9O#oPLI787_z^8`^q zJXZp42oCF{FfxB@f69>}UwP{vX4(v~MTSU&QTXyeKkqJI$i}IYbQ)W1`#Xiu9Mt{% zj-2ndC#7sGn75V~Rc9&g4x?eO8zLqIme)}m3IS3MXGis1Ol;@g{`A*o+|vvY>l}`i zLu?V>n&~@BSJ=DMPm3AA*;&(iRzqwr?~-Pf=W4AMRtt+5b;Gd;a2%ulW2+_ zlFbnlD|F;E9(QTP?MRl-mP~ad)UH2Pl}$4F(d!?3Lt)u9PE r4lBZ_bNKvu-{6 z?>&ugJ)PEc-pzn}Q@p{pr)v`Tm&--3vCu(pfMvXVbZkt{+D~d6}ke6U)2ArdcO_ySoS&t{Al0IQy+yJdeAl)S(J$m$eKfmjG|An)&bD#66FF^3PuA7)* zJS06o`13i$H3+Z&GfznZT)Fg$&Yc2VUewOtF@Fg95auJ z{(b@Ug6)}6VF#z1Eq6+uVF@)(Af=oM=!f?%#4%0C;1KQWSN97PQ9J0fW3Y4VtMHV> zaL>!alJSCKqTRM!!FlrAxArDzpK*u66t`7a3zdwS;_~e6_j@m{$NHr>;TIITw{)28 z63<-k>l`Z$VVxX)yZ=Pq5=pLn$#7ubjla4*-0X2SuBz`app?d{E=sc(9q+SOq) z%Upk|3dTbjMNqOTUFF<1_huu)|CnY@-D-uQ=PARU?@(HTq=>Dk0w2+X(e`|-MnM0- zza%#H#A{BFx%9ZG%bZ+Szq?o0kCAhX{u6t!9)FE4%_2P62q5x|&2}l9vt0wvcfs+W z11HFqbG&qlrybu*Ja}#D2P5|E#~tnlT+$f%(wa_*K72S?Nv|>z&l5t+IE0ekHqz$81*MJkjU&x!wy@5J zTGvd7vb6aDF(LDCF&1QdFp0O?)CCJC2p(buqi0QT^u(~OkHmx)U1^(E7tfUsF_FY# zfs1v1T)s&#@3{2;CAh^XZDrms?y@SllXjglA;iN9XYTlj}P>1+-5W=ZkR2gIxbj>U&X}LvB!T;{p~4#>hgJPA*@GB{i);vtY9& zt#nL(y&e(Z2dgoNJ?4_9XmZjVROg7h-_6AcK0^~E?JZ`FpFA`VJTi$1?WB-88Wr}| zKpuX-D>@*u6}#IEmLYe1e_^(UOo^a$?2liWDyoP@{IW>&jCpkZhB^x#vhu)X>Rm{P2@TrAUsnr0X%^ESRDVypF1OpZc;e}!I*KF) zsAuu=>KcHEAq9rWos<$LeCe0a{?3RGBOJ!J?0&;mct$MH^ile4xq#js^Vf(~toO5p zB;*X0A(`!;kN&0Ouo``JTstk2{K8k$6Dds8aPHuOZoXa`in>b0LCB*zq#ydG@z~gP z-hh%9miY;c-F``O&uSOFZ+*)kcE^MzhsW9sWdK9fdIMG?LRKhVTppV*&|zLfO_jhW3*Rj~E zU*^dY2C=I9b)>Pn>G%w-wZ-I$sO?~LX8rHJ*t#b%3)rTTqZf)h{_H`%iPC?K>bB}P zF(11)(&5<*#^F(Y!jzuBI+jS~!2wgwgIMm_`B6f2a)B1VuvPt_p(cyxMi_)BA7zYt zD0Or;_o}t9iXfm+mcbfceN3D! zCrW0JpxLU&nv`=VFNqWcOvx*|i*KDJL*DjU^1WA(((6%AgMIqBhwL#iKq23Qi}WTQ z40kyf+tX0RL#JPcg5V>N6wCb2G@92VnOy4m(f8+fyu@#RNmn>7zdG26E&#z>t+KQo zFDB}zck0bhN7tobwhH5TVLW^DMjsqaZE?&DvtZsFoz9&#v@^C!1&o>$$413tS;t{8piq$N9&44C?E79Nr z5^rrlLt9C{wt`ijLjLS_PriB^{y~-cS&2h;bEnn^TIrtzjN^(i0+5%LTL+FoM(=(P zM*%VttMAxXyA}4yu&Y$}P$H;0HAg0U1@K5QV(REF5S{#RDl!P};vlRbe@t=MGIQ;; zFD&9r4eG*DPYVs*lSLu6)1jx2FpU4VkWoOT#gQ8m60)e8B}Gu;wcOC*jQ7r`u)jp6 zOT|yAJ)gS#OYdhLjrpqO076n1KO||f2JKCRKXv*lLhHeTgwbGZs<4v{mJ}yYSLz%z z%d(d5k46WF7+OFs72v585`k&el>nX%=xPQBI;92Ds>>S}raO-S zR|{b+q1Yke-lFFnJCI}?DH{o|JmEN@Qm+(Q^BeM0e-l&)HrgnIZ}cJGvQ!7>l2@$$@O><2H$fA|oEmc%Iq2Wdyo<~2S?OMa%uxW6VB zM8~W^BU-*_)Dk>CYnyrBjBf&i3^>*YfR?sje~juse7+$>jO1c)N995XlcbsSzV8V_ zXU)7vzO2e4*;6{sEW$8gYv+! z6&u<=w+CH>_Z~-itI-iVxX7kb_UFzZ!y7-G))jDX#X>3wz6nVo&ewRYQQ3Lujuj;2 z=0Pwms@8z3DM?|#*3PJEI^402!>78a^;%Z(qbR+iuX5{F7Tm$af#|~1OcSdjO z1#(-1Z0NXJ^Ii7mht=@00Gdqk;etn6)|ZbRU6sRN?#|!~dNpE5M1?*a`OKJJtBy+y zWp#y+^TiK~eR$`Vo)V?26e1i%H5*9S~cS<_YHzx=m3b@s)epF_t57<87Jt9?;i8N3fjOc{m5PG#+iD$`Kms9?<3O z7bjUgYQelsouLj)ZyqtQu*g>YSo{zv_vfVMiQw}p-EH;hOIQM*eCF|$pR+k-gzQ{< zl3$qf8?kdDM*F8EMC@Y4sjFrp48EAJcnp_tq0+8T{&c*PQUTWUO7Evu6i4DB;7DjM z?f$?<<~nao+oL>%@LK~yU<1gLN@(N-zXg@ad~&3X;g30nO#eWgM{KjT$@q6z^$gnb zwrCdYi>IDO(f(!83-@@!C5E(%b=mck(HxDzMK|kv;bc+Xp5IF{Z9kw#W3G3Q9KzFh zxK^~Hv23-Gx|i-|cg3>n%3XC3{mH=%*DL~p0KOJYcD%DeLNaV%IruyCgq8t)1IxZs z?Y_)!5)2Lz-`Cs>$aG7DoDEs(AMWT6m{Ne!r0>#i-C}zA@(1&)+@JkKFbLqIedHLN zser|nqmY%V{g0L2I}4gc8RsVV4L5{1``L6K$9XvjUidxlo&Wi<*EKKIE&gZ45>&Oq zZ}ZJ7hdoNr09`1#-pV`eG=bbN3y0Y>zla+S=Ua2+PItlK8*yR6eoqQu|t>%gYk(CuXPk&vC{sG_PUyR%J)|#EVF-zZFxgT ztp+_++poS}Pj_zopN{j6hG|5u%Na0r^j$;DkGsLo^_o-+9tO@IV!xHY?5bO}zy>tN zWLO^*B0>xUzBGDzlG5PZ8~vEyHlbZLm~Il5?Zs^Y!a`3+DJxC8si|7r_^Fi}Y; zS36^dw_W%TRZZ>}te-{xLlMk3`>J~>e~J}i;u5tRxR9Ug3%MYf=9vRIcZbsd!@#rN z-JIV5rGziM?S(R@YOKKw=VsnIR=|oMt{=e`2LF~`tT*K%`+P63$&%{mNypEe>W3%h z^7q68s8We;WAaw44MPcK#t$NOT+1XYW;-oJ?Op2D$7U5{CW@7mcX}5truo0WAP6`z z?>~*fj5qARW1^xGJMRmj#Idp2yCi2g%hFop&^GebzJC=2LGNiVBUe(S8VCi77?2xv zWj(+)5iez?LuB`vuUbh;`uJgx!~~qpA4K*L0#5Wc5n8>`5bv2yv`=8U$DA1 z-ds=P%l?m`*(i9~wE?)0nui%l-YtGk=OK~0TrGP~m4C)ZPWb0^xzlm7FWTn2;Er0#qSr5-oV zjse3+MmD zCwsu8=HGaES+pJo5qLP zshqvT^7V@>n?f;5p^r3?`eRMIe4lWGb-E%>gcqH2!{SPs1QnSr#KB(gej+kG>&6SX z;r$6Y-{%09XwsmVf!o5Z+W&Rsx4$#2Y%r+40dtdqQROJ`L!?ZEXv&&uQlTy0 zTT-D%XAklU0ENpXWz-u`7vN>|XM4X20`yrZX8Od=32i?^`{^tV)FY z@Qn{hR%mz8sUs4F*0DERKYm^22(0X%8q#?Ja!TED41AXJX(8FQ_GrEU$%A>b)iUED zFxg_`z&deeiiv7d=(F0vDU%u{3{4(&XiqKFJlw6XD#jk{^ ztv@lkY}Lf*y_z~{V;d@;4%sqWzmvJ->iovPPrvh4#qg8GPO=bh!R!HEMw%J{o5Yw* zI@x3hCj8b^mDiD*hs&BocFT1xDc=^@7_@N-?z#+mS`5CN4O*}@C|`i!r8(~9Ndd$5 zy(lm|&IYN^iNVDUm?YWm7PDJRxk;7EwrK&mHP1-6C5n9@cOJ9;*&yyh1(Jbcy?>e< zg~4#8PE_J)1=KzPs9zF=UtI$u$uKdl;F6QHO?G35kdKM|(JU0rRSB$Jn+W2e#uW`G zKI$OOz-JpNkODKe^9k>^Hl(73Ztv*!0-%qaYeRle;=@`7;l@L00Z)cN{csnE2}UqBH4zlfUBf$GK4s$+y7}Tylzw- zy&_aRqo^I^yB^EBA(6KtblzqBZsPin0Kqg_@M;Qg{9r6?b(ZsWhB*|h&->YQlve@& zR6k{XQQm4LmH<6uzeoJP0k9iF76U8U;bGo3F8kgT2^Zai0+3fvRd2{DoX&+zP1elq z(%5ljHvW7R1h>aS>6_l))HvOE_4dEPWBiFY;hcF?PAq0TQ{oV{*iE^MiEdxMYTSJ~ zBrz?tIoj~at7GL4ZJXFCjKi?8-@yzs8uRg?hIv%qcx{`j*J~%(ZG)04`ftRyH;irIJe`*unfMH+7_;n0Pvh2bt5x+D22X!q?)q)w>IM7@X77l zftWo^AHf7r30GdC4gKp*tF!J-Q3_K;;l2XGS5Evs27{cgPr1^=*pCrbv>hAAm)vy| zyQHOQggQN^mR?=Pyx*i!uf2Y2k}0cAFRKLj9XQ*iP{$bKbecb8`RNz+h4KlpzBQ`= zCyO_o;>|QC3-B#Fw@s$OQR5)i>g0XsFK`u*vW$cfEIRk&KzUm=l2vJ_2OgabIUiZ7 z+(OK54#GoCuzh&UH1NnVK2D_pvWi83>H4Krko@+`3*+$a?Y|zRZT9;^m>$;R2Q1l zo*#I1FvLY77C|hgMfu12P)t$C-_n$Z&ugqnRHxt%@oy(Xb+2~`?j_Q_$yeoUa3(J( z?$D-da$+J>zw=|I&}c3;7ovdzwGxJd1#fIkX058+x3y(Yr{G$us-H-=0%Nw%U>;Yg z_;U*jB=;uH*&|a?w5Bh}1@Qr#(6E_-m-S6Wm|cbA(pu*cT)^6%2(ObOUGTvw8L-*n zfhqA`Vfg8XhqOB1&82`swXZ$(@Nt6X8x3Vx=Qz%IQnqmqw{f41xhiYxg@ACe2?Z?79L6Y!73~`BT6oRO!|ZU0iVUpV^9~{MWlewpGDqAS10i8RFYGC z?{_Jd(L00UySiidY>D&ZU+%qfLk=r9pgPxfxpv~WS2}?$YgS8tTA7!b%Nc*HI3f`w zvY~0jDIOqKd<>iworT)OIojEI{(rP2igVA8HEC5xK0O>n(sRw%YVci(P9MA#lW_gq z5UF*Six+?Z!WLxQbza+jR?1K_w8wgV@@(sANQR@3L+!3{BMCYyskjMv(d3i-SIl|> zzSS~H8F{x*HJVV*0u(CcxLeb46z&c0^G|&7S|gf|P1Vt~e+XfkI=VGfW-5d6pml?B zX28TSaE=s_QUY{0WuPtymG7#cP}`M9)wE&$YAgp2dxn3UGCA~+odoMIz>$qrQIKS7 zdGFnRze<=pYgm-A$pG?O@YN~5y;umHLM{dwOJ7J^Ip5uDo&lZAqcqMluVrBOd|D6a z;&%D`&nX3A34`zRRczsp3{|>A2O0Ry>Uj$TH)vL?)BbvJAI{KU9rS;2_Jxt1^Ae+~ zSK1f#$8GAmqpKI?B%}0ld75XPe_RWUkgxKY{SJM=H{Oz>FGfJTCk8gi3#IgV!ZS~f6!h=SM!Iw zuIyAEZ0&f_QW{YhC(8{usb@)+Mki zrFrQPu9K_5btjv4$aZTt@5Qvqh{~agHQ4t~^HSrdvkVQKQvdlXbqr+~c`JOeLlM?X z`DR=DdXb^68*JEM%9AEis7MIM7iX#c;4b9T3*M$eV1R2$2zCn1j`oK&MLH3ISNNo# z1p78c6foW7#ah76!{a+tF&^IJ+)H+l1!s4abP{6IHa-iOhu)hYIOG}S6|hg)OL}?v zseB8u0}OHdX};p7Pv;)fB1XAa60iWMAwJ;3S^?$L_5K+2u=`8Jq-#cu;`6Axo7&#= zoC>08{Kvs>zQI0L|6>`PFf6!k$V%IXLFg5^K@88V+mm3ovZFe?eO~UseJlbIuz*n8 z*S>%?EZy{o5Uv^r*xZRMKOVvUk#l|+JJ_$Yju*om>Z7F@`rJmC@_#{|xWqKlAb@h4B> zXyFgZSN^(p2<7dKDdL6Ezb~&mF#}`_>=Qe=%_rS5$ibHCk>bEdP)%A*jIWXP8Lr{> zkbl)&ZF(^d7E^b=tE3DY%?3X|M3rMlg&f)mZ@bke14%i)dyLaLHyZib;`D5#dKmr! zA#4#fL|+h+oLCub=DsRg=m~kWbuHh-iS;oX6bsxxIVb9jhfB|0LU~qKM*c`Ov^`ss z4-5^GJ$+*dW_#Hby&EmCJm$A)eA5T)bIxx%X}QnRM(?>7BU5`(x_`0mO$06gH5qSD z(C8+q#gaD(Y>^x$CD)m>qO{Xa3w@-TzoID~98TNS#ev13DlXh|As|TQRA*iQDv5W+ zTl1e-^Wb;G!ldJSM}gA>(T-BXI{av#;QMklo24Vpn3LK|!yE`$ zhaouTn&u4V&V$(Xh+UtTQ^H}cB%oq(Q8NOy~QLOABrzjZv=zjAkk5Pz9uiO32wl({=Y}R#&y4>Cl6S z@jy#?C}J3l>1uqyWFLezKs*3 zGcj$%awBGPh%({hbD^Azo3y!%1KX#0>N6g+h10@~Q3SOobjUg1&anU*t|+1j>C;3~ z>8gvy=&mn|4wa{Xj&I^B$~QsSm@5q$`oDI*e=Al+2vJFKZw}%)6$|Vxkt|`wfnXC1 zyDB|}-V0R_gSVAW@F2Ed9HKiazSIf_eaik)r|WjfP8EJThM$)ZWGj*B;0bI#Q0f|$ zjd?qjSS>xW7#SYd$2CBDTRs6b@JgG;^XrhK)zfKEQ84Sm@GNHNtesN|^ot;RC<{UK z(A#8)pH86m3=Q371=-jp$|}_!u?Bb1eKp&O6YL1yeM%6}%+HE1mee?mfsHxhW>l}XgDCLtaByUB$~{zgv9Yu98&e-zmI3C z?6VzMbZ3HP zzImVqK*Ew#7ChzdTiBpCOgOd~B2EWffOsTQt;Gtvzbl&m!fz^>u^@=JyoaL~d7DBv z0`?BYGysMFQJ)?I77SGWQ&sS)5b%l^YGv4_?-F;j5hm(t}@TdR^pGbmcYIqq_$JRp@-0bxI4FjbmI#sf`r1 ztN|xbR-!^{wyWn9Sya|z-9{)p=XqYRL+vfJf=&8wqSqq;mSKBsU(M{Mu5Ee=03Y!JH1ayNt^^*dGPU3I_JL8*ksJ?SiErzvhsb0sT zwJ<9kqnlbb@@i*zErPh$;+f9t>#p~xP}RX?LBCWmyXpZHgZzP&cE&hzhNGMaQlI9B zaODSe`J$YV$hVTZROtJN6POQnXu<;AN?zQd+@avkSOE{ZRnr{ffWX??=bUAtNNS5E z1ofe>=yz78e+b~AeH3sZ7$u+N8NK7SE}wm$`?F^NcH4b6Qd*?+8Vs?S$~FH!`mW&N zHy08{d-ZRjN91n+(^~fl^kLV2=0lW+QQ*_hk6h@Z{it)f=X>5Eif(Q)+jDebc}E*K)um9Cz=?7dex=h~J|iLosT?dsO=$z!c zu%*ifnQq(U+rm*NhdernnnsVj)TN2<2!0NXxgWJa4K3cdNH&E$s;i?(L{a zmLYi3LkAq);Qxv%)%YX~L#NP{_sctUcvQ$2MzbVhh2ySS&RQ9*Yah~8%JR^x8mMW8x0IGz3yD~L zrbG3;R4%_#XU`|{Y+iAcr}IY$5`*~SQ#KbNO5$ufckN47gTl(DW-vmc`)DJ_xugcy z*LteI@}CmVK@uCIc<-XQ>iG8Vys$LI`GxM5O48yqeeBpOMe4N*7Z^Fd2+;dbMeF&c*f=x^ zQYXA`9z7;gk8QNz3w~S&_Liybp7=cIjV&|c(-Fz{URSWSU3UV2eL>)Ib!D} z*Uw;m1us8pO&VM3+OoXNWG2J&vU3@wGi;Mlx$?icKMX1PDE$1CnHZO3`*ETYI>h{ft+Xh@<9nYr^ z?f8pk@VoCG$(cA}Y|gs}Fdst0dAylJ@TiHraUedfC=!rvrMcNb4dq@r2tzcGih>Y_ zBEnk8eG(EP!~4CMX6#3U@hwC&QBp(exCoGM1M(BE`JkXf4Vj%wX=zAhUmSPOH;=)A z3r5k6=ygSR>9)-#QgBSFmrkE-bl(2}&?D>yG4d_yM!|5JaL-ZfscDj@(gv?brQ%6X zaz&ZEY#8&%r`sY|=lL&kTeomIv??2(d7C%5uCbe$t>DO}G zlcj(T?D!Lp_coTE-W2PWW{_i@M#6C^V3lU0#UlK%Bbm&YaNEm|g~Kl9U4Q-*-_vpQ zCOj8iho71WbOgy{_{pQAInR}Z_%lEd`Jc$pubjldGRLgD)lO&4C5Kd?FM7UAlv%Uy zM>Z`*K07t`bQCeQiI<|&DPBo*U-TF4;{YsiEQ=TAHws7nCFiNrB>t*Df_XhOqos-L z$EuI?k6HNx);cccT>c%wHtXlT$_ASkG;gESX<4ZMU5#Fil8GMIKOd=n6n7<0PNl{n z+@FZc-t@tKO}6AbtlF0P@(fbnf_$jWKX+06b8+`V*7}magY(FDw7T$5@TN z?+A4xhe%Gpx5opS-k-sAdUp^97T|kfy+R9+IdO!X;*U#sH+2u@-XAO7pX6p`Ro8I! zwwd**@{hJj6#j!(K!jPm+f6_|A))B$AwxB)x~gWq=1*X8HNw1iCCbgRX@P2pZ8Acn z!uaPezKV=RVHze;)RD62P$kRdR@cTcJ=YiCDcKG=k z{52uyz^~4zb+M4|)~`-=%)*-v9`BL`YPMpsfN!nS7dWBlEUlCIpfR7X()n`bh#xJs z>s-n--_YY2KT3Vq-i$U`V(YL8Tc%^0-v{oq8Uioh9<)Th%$BWGo-?_=5E35y`Q)}7 z|L)@BeRpf-tFLA+J>vaMHpG5!Ovy~=Wl!<*W1Es49&#t^eJpbp|2qL_^Z)g7PbY8?t{}W-p}of z7SX>3gl^j`{Q>5%+Jc~DNJ4sgGhwhBb|>h5xR-=FN=#aycgPeENhTy4c-aO2;oO9A z)rwhYETb0@iXCD`MP-12$(#0q*_I!b_{W`-1Ouw}>1V<{p=qA_^W7?3%;N9wnn{Wl zLCjFmED-#q?f{nP)iC=R=f+E+VTa(x>a&R@#r0TTu^OiXdJntrjh;)|b>U%LmqPg- z#39Gc2Frm5w$rBPna3Z*gr$BzY9jY!IINizm;DtngdA+>%eBS5qgGRH}?WyKs1EQdj zU;gak+g$Uk6oY$vT#loM5VOBdug(b%LJ~Ez%X&ouF>#(b1SP&NBapR|&mXh6rqz#U za=tu^bmm&e)Yw&WDO=^c3+||4!0Vv)FwVNo~})CS+}_c`%Lf1b-A|uV=cBKRKu-bEi%`4tw&ky zGAIEDl9fXg5X#eNygK(iX=QR+yUO>45QvMKV0cfygQsCVh|W+rC{C`y{&t@tl}1Al z2@_~7w+Tj2`jwqb%tYA!Gi5g-k%@5$2DIHZ>Nl!ZB}ls!Tg#0I#LdgiWf6074gzdX z82gO#?Q%hF)H*vE1fPJCH|bzIVl;ns<*GFX*Ut0L-WkGD|4)D!Mkv52UN%S=ls7LDusi~A|7 zcqC3ABv5=c4j9jkkVww+VOeC^rYQ5ayr1Qa#+Ov|xm}EQ$i|n}4C7z{Mc24lEC30e zd)k&r%kJTRawWC5AjX^UZaRaxT{@h92nGIO+ip-cxtsmU9nK~4sD->U~ zy$B&5_;g0t?NeUUQZO&mKsgXqHXmVMSyd1mk{3}h88x9cU^DJQit{_r9x45D(OcYX zRp~~y3u(ImEBCvZ^#4BMs#)oWBX}lhF}ej=-B~12<((8JYlu=*bmydqnRl`EL)Df7 z8rb~L@ntcV@#fP>lNaA5KGC-LZ(x4B@envj8-{QrVWx50+mA^dyDvx$uRs~?^3f{~0O zt-$~YO`cv}21Va|?&pLDrtPfM2(%&_YZ+s|SAsT!7y)!mrQ!vH$cSf&)cxC+onXq- z?kdZ@Ga${Ib!4WRApCN6_udI4a-=zPu8lfEw_}wbopb5Cewyi0s~*AO6e5q6Kc zQmR$`xWa!h5#&h?4Nf=RdO7^QF0G6pELLbH(DOe9cf{G`9f%B6mYq7+=P@=L()yEc zvxSd-w8Dzb1S1UP$gRGlUiKCuOwmsFV9r@GOU1DYi@x4?EFM`JxX`PVXZps@?6gAT z)~)zA^5qMZR+0~TMj}WO4@_bs#be;kl%XL|riC3Usg6xyjle^e!KlzdjTi)r7#J}( z{D88l#c0`V-@%9o62HA&5gNrz2(zPF<@+jef+1au^|x{G4~nmy0W__+-y7KDaO0Jy zBGjHzB}vRWNbLfuxP8M>8(a)a-D8{LX;gp62@Qyg(3< z?G9oQb#z*OyeJ_WMI)(HJ#*hdR`6(R0c+*)>5G+ffFXfmn6PH*yZPnL{>1<%%w>dy zurMs!+og`{4Y*8sU&I_x1}LAgsAZM#qgD%lQup#V3{H?poJl&WKLCBpjd5Gc>Q| zzSZDv+EGU$-edh&+xH4a+50O(5SEYFA|QsEZ>$^1W{b_S#obo;1qj|EKvaMwMAshu zz)z~`M9_!{EK?2Eh;^kvcCvYGs!QCt8_vpj0vaB+>g{kiUr{)`-Tbdk3A3bZ1}>i7 zGeZ54u(u(rm_SGhbqw`bq1Y_Dk&XYU#vy6BRO3Y#9yG0@oE#@RsruN3vP(Y6eZD%= zSVtVWQX!>(b>P29%g?YH2@TY#d~9?(cB}bVl8W=(aPw!=$Sr{pQBPq|OW&Ov9)V3n z&9?JML!lk8uPqm=`1NWPsU-<68e90YtN8!*KCz z)}yn$Z=9e6QZ|;(R2e_%2E3cJ|8@qFJzxo41nq;mkjd$F_NjiMfcnkts#*;8RuBio z*J0vT>eXJznXH9}o>AmGMFA^UM^7CJAJotU!F^2KL)h}^tOrtkM5)q&OJN1~0wM~% ztR#4?vIxKNT+;BJ0;rK<&^i-KT#FKnP_yT*?`=RF&%EI!*WQWJ<_Ij>X1Ao-odSHn z#7OU*$je|nxbpi|>f(}sMuo?*wggyfD2HebKdvV zQ0#J^D7}u#B0X6IC;PD_!G_^=!)pF#5Pa%y!63%H&1T0S#zXFTJn`y={Y&-hx8e`AM0dwL+<@+wbkWllD9 zY%xZw&l_E1>uo#ee5reIQ}G;;QVLS)*!T5tF4=3g24S+{98nCg%B%q~G_6LzZmB^A z2g~v-KQu>uS)D2|Gz2%@mBR^0fOG-iKA+{?T#!`GCz>L`dHHXIS;5@RwRkAN*tw(p z_a!?6&ORoy&PN)JWHWpIi<_QtJI}Z`rHC6t7zL1Xj@q8sO8}gwrRySl6X`*_frFap?a9?J(Y^l#v?%5)mDaV*T>3DaHCv59ifSzzTx#Ph(SfuyEtp@Q5z^^-~;)#?d$Zoy-4 z*9?$Fq#dgLCnEG9|95amzf%B^OAz%@%^Xn1XkXM*{++ozxY6i?PIx|5116XFc#p?= zCQJbKfmG%!>yNN{8^&s(AF}X6k5=j%j*)#9(P5+J5fYRuJK3L9beIN+WOl-4Q%0cQ zIp5a!gtI3ofofj;tMP?C_U;hu=Hin3T%cgySj@S#e|D~T3JJ?<+Vp$p4MZBmvG*lu zyluG603X?U{sG_8-0`MpbMbB2PJ+$&$Fv^??z9}_#Aq|DNpUfZOu*32cNU=`PZ-VW zh%v2)Qg7PaH(zsfSecutkcbtAeCQSOO8Sa1Aauh)NY3*Ye9McF82?EJg=1Q zfKwH%U%V?Yq^RK$9SMOI5f)o*-H~Q ztzoK%+jpcn`9E|ET(2$u;)wzoGI=w7qS|C!+l{8F6aK()YobQCWh#hrmGo(m3!}5R z^6IZ{6v~9UD;NIhrsE?q&LwFL`|reD%H}|bCDI~u_YDobUREnY9wFsC)mKgiv5UR8_4WAQK~MN)lFVnnW}QB);9-T@ICE> zs{H`x<&XN$_ywE{x!43f}x4jxSU5wwe%>OiO@T;*9SW1iA=v9(-TEz z;uODFB1l#?0@T(V^BG0xE_%H4-Mop~MuB>B+x{{zk_Z@;`PJhYn~ zE_fbO_C@hYqd$vYbEC|iK2~<+ok@2HAb=>We*P*7)|QVNlG##w*c`*T9a{VSneg!X z)cttThEFg4-J315%xCAq`Z_o7S5*u_8g8N_#&?2n(n<(e1zFF9L_V2t3dIhEjg}v7 zgR`~=s}tu0O8>=xNTlr5bbe0Y%Kl5A*_wT-y$vi16)#mJv4C!#ufe_0Kq4IGJBSTu z=pE199J{1Q$T2z7vGHi!zeP-Z2(Hn8;j(QKY(mNJFw$h$nMeI!TYq{F_oz2(WE&&{ zD_}f$I7pc$CM2DFK`OE0x9%@cySk0!V?sZ7L6dzZ{tCm=~ z&No}t(BmHkA4N|DjX-EaL)wE!oG~hObtTa=Q6wVqJl;_(d6?~WRwBwwWi%4c?<*=j z5GfAwQxkB&R+YYHxbfeI?on=S1L5Ru9$l3%b{0pGpL3Ku54w5JNJZj~$wGOkLNfQr zQjnj2E|-x+N^g-0&=IvBsoXWtm#xSyIx~#lnXQV`wD9vsz2I5!xdBGVih?!6te}32 z8kY1;l2#x6mg1iedP5>!W`aGEsfmXA1;g%}7-oOZpIEI#HtJYwDW_8FmIKZuZ9m>fb%?;E#C^kllvRUi8DR z&^C+dYm$c@gq1!uWtH1#c3G$*4Z&<#8Y71O(+EUzwDYBa@)H*LyE~^{D@PET5_(Om zIY3{umVVDAKnxz8yPdVHDQy3xoZwtFdS0pTm`ky^#F_*9>y#TDa^>89aGUKk`xE)( zv?4Stu0FNnp^0s@Z%83_ek?TP2v!o5I7+N5K*5axWbd&&m|k~O;er+r8*l%`$KLYy zN&nMl?B6X2hToiZ4+*?#b(r{EW@hTXu7rwdOXg>p7HO@w!miuUhJ3ie{PaTS{LV2S zwstWt3;>($zm~E(aBJqDM|KnsZqVv2#Br{!kQ95I${0|_&E)AxEZq=1q!^J2RY)zXJ9P9OM@;pSs0Tuw-_hk!97W0dL ziq|L~UE)^q7e^~~(8Xt26}t{uO2=>m-B)?hc<9S#`p%R_ir@UA>Izg-%A*Rx7*Mk! zEnd)UC0|yI-Kj!~G`px6{-)BZ%7C&;p=rjFHp!SM+Hw=i41b3yZMgQy+_HgmKc*~> zp}~gsFunMh)5I5naqTRty-!~9uZ03#%4nag!lp%c1?T0sU2U-#jP-e>t51V(c9IG^ z?FpdYKwUsU1qc!#a;IOU`bg0_EyOHFBF`ENOq@RT#Yg`}kiSM4C;Lw>KmWcE5-@9G z(L{DF29LNaRvIciMW??j@+y@@ZUvwkz;c&yc~(D=!V9cFX8^ z)F4UzU(6t*T8D1>)0+skP{FN`uPZ6h@lW4SgL2a}Y#3$SUM^&PA}cTBvkQ@*+(Pkb z@kYrp?GBhAi}e!T#1tD@9V&5KQLii-fJlz#0^S=5tq z6H(gfOr!J3m6VEwMfmOXr0GGoXtklFOMoSodUne#$HKVDV$6-}FQbH~*;G#(Prm5I zUl?@2j)-JiDpZ`*0=b7kVIf`9pKX-Y$5hC0T)L2gJZ89~1ZuPM>@!R{DKL(^~6FEF|!rF(Rv(hY)0cXtWWNXHo6T}p|7 zNJ)2WAQFOfcOyM|)VTZI_rCW(*v|KP&U4}u;Ze*kg3hK!{`r(5t4D4-mA1WeKX7hBRNF5P zh-U2+R-*ln}_&v zB#U)ep?B4F>il;Ym_}IiF}Fbw2k>mcQ-9NmMkI*^u-wnqtIn{kG24ntb2(RT@AZ2( zr_aS_K{4+HX_qlX-KelHJOG*>bH?V*C1g}lw|n|3z~|MMBjxeAb{}S{BiG`R+eZYi zs9w24{`yAXsc<%NhT$5Te~uutYBpVO(mDsL#;Q}^YIyz|YKB_G_dw?ePd!wkKS1YH|CfZ^|Emb&UMsPZ46#Pcw3Njm1Iv)xZwZ&AiCuQ$vmlu*Gk zCaBoa7|h#Eme{?~%+U3ixoVr90^-B?4M3GNe*v-Js8ydUl=sx$yAfESrMoG~zkBWW zFB{>ar1wszT5Zd5B{Z`~E2=_yq*h$^QG4!oe|r4^S?y#}_6G|xUX6GTsbIkUpsB5< zheZ3TW-FgfNdw)!XGVg{T{Xg{X{otG36a|4Zhyabs*Cr0zyipavRG~86QJSed&)YW zEVB?vVgT0p#6zE9T%n&AbJFQhDMeW?nM@TgE{V8aTIBR2WwXIWC_IciiAn)z*J*Oq z@ox=61aWD-_{^Jd9*@3D$uqrOb&Tt4WOh%GF~3*gd@{wW{70;6>V|^WS+VrZwcZrc zgyc%2O?6B8;ntc9ZiSc6A|K=GiZK6|snHC*T8ii?eF4~&TggLp`Qg6e`dN>jz2J-6E6ezPltpd2#b=(7vh&+v z1yxLlBF3`ggR1K>wZQc4Didfmwe<__eVK^L4>^vt=D1Ocp&aF;LW#A*{0CXP?qAFu`p%7kP{O1m*2(4IEHFqhg1W&fcCFTj`XC1CW%&u>WOP+%8 z8J{=)FSG?FF;|I{=E>sX=Ig}eqbCUjmtV378&#%&a!=lAHz6lgxB;^}dmVW;Yva66 z?R`9C=WY3^WJa(v@yljk^P9ZMS?4aDk@C#=PMQwkw^W5BE?qLbWu-3wkmOsoVo>?g zM@c?2!q^a5sN-rY&b7`mQym`Z*RPmWeXU z!L~M^lL{(L(Wv ztJuesx1IFWE-l>RWP*~EtAvfNf;JIlbQ+IOLp@LXHqK|yhbH{{Z^-YADdx>GxW_V+ zIEtnEA8A#NJJ={EMV~0>5Z6fE-*v$0+22s-+D@HDi68zHW#uDYjqrsD8WH`%;zT4e;#R|d zd8E>#!7_OzYc%0#n1w>G?KbcMpl8FXQ|j|jmmQkq$*_~^y_YTB5l~YOjfW@_J5e?- zJA1g_-^#m(f~381eKkLs8ArrG=p70+h%wKN{zFJIIWr@V^^_`qRU<^`4aYUmqDkoJ zWb6TN;{&;2n0P$XzFC2{_X|FrLa=!RFaFi-CxJfcz89DD%88ANRvu{YE# zW6CI7hefAMf=7f4f0(pjN8xAfrFRh!B}-7G`7!Z0>?{bU;A8;L9=+OP=KCq>fR-Vx zPw^%AtMfnh%**Mpzsq%Lwgzb4%9bc6TWzN8+5I%NEAKhTP!W60Pi>|X|7mAp2M92j zK8UY0Pkod9pmCH;SKI*`V0Ec?XG_537&$nAJPF$mu9E8>nUn`VTBy!-X`Z53_l-q! zk-6Zb*P;U;nt-0iUDH$hk+d!%D=VEv-LRvhy@)ku+Wlx2*N3N;0|AdPXc#VxLc@az z2RRaZQ?>Wvkw6>$w#orVp zG;f}Xuj`Hes2c}R9D61&ufb{HH)f9jUi4?KThkruaNYL6pO;#8IR<(&1ej**hCi9z zX}tZZ1!kjRc{BskL5cGOxx+?Enu?+fX*G#R{<>Xz+)6 za(0x?Oslik|KPuwCo!2`gXm4r5&DU*f-?x?Eb{98(j!}DjyeNu-_*Mh17rvm-ZpYZ zK>2LKnTuOcPlaecOgCm^vWKD~vYYJ@Z?0%b>z7kiZ`z@xjt_yyU#0H*jemHT4c#{Q zF34)nHKyEGW3^<*I&ELA8zXm?e3N69_XCKb$N5XsARJ6Whp&VQG-dc;t6BjMDm28y zK<8*ClAE2y?+sB$cqWIf(8-C9>3kLZdkWw34TJtcTgZC3ai;6R^m#Nxe{=o1a+l#z zU1dy!zSGN3q)qq$Gb8I%0V&F{6cAQ0D7iZsGQ6LtW?Z0y?a~}dyX)vOA-C6yN9}C! z<+{MLrtT1GB^II8MRQLx6zN8fqQVLrI9cha_E;n26IklFkj(j)~ ze^q2Kn@EWA3$Wbrp9-@u!czV-q{HG*` z!^AKbcl|1*i=Qx3zTAn`Q{*eS^s#+*+5%@zvGxGIMTX5?s$EnFdS0FGGm2~A1W$uH-yoR5hkoeLj4bz~ zbRH*iEfyZ(q=+mr{y)N4W(V2SRUc6>WNiHyl#eyAZZH7zmszVXzRA6&gu5N#qH8_| zin_I6gjvOTDpOeSTWVRB(}T1lhDOA>TQO2umojy15$ro0BJdF@P~~C*Y1pbtT`Se6 z9h)@S2;83hUyx-mgwo>b1Jm3qMZNkHI`)`x`j>Q0Zep8AK8+1!`S zIYfu!X!dd*j zOqZ}5FavuOT{B~p_=9%;7mtqz|E_`gvC|@J4iyxFea*+#g+(InNp_mVEoVI&9wL2N zku$sKNKV`G!P^z(OR&1{_OrkAOH|{5F8)P%^f=Wo7uP=!-WCKA>nZh{mi@l-sbplP z=DO58bz&e4tQVB99&yG0I%tp3e&#VCZety|vYN%AP(3+S7M3 zB$CX-`oG8Wy0VE4o^Vp$SAa*~Vy;@Fl_PU|?j=m<8S&LUDI$nN)^j!GPuog3_3+1; za-p(_83Kntm7V#?{D<lfIQ0iF5daR7Yskg4w!Qd3^~Q{hY*oaBof7b`__# z=B*OkO+bFH9_KUmMoUrO6RnOL2Xd!j{F}K(nNtK8PVp7Haf)Xr@fx34(ajXLBY;Xm z&SW)FcUkcYlAQvmLzF2Ri{RHEioY=ajuTdH_+JKBLkJ#9u)-#zN&1HH*5I}?2Yg8H zDb|x^cLQ>Vb)4c4*A%z`L!inOy&ud$i?YoAVIZldpnugpSZBMCIo=w!7AZY>yN#da zfD|ayn+R5vMM_yAawrFdLcUfx+|8d(`2|9Q#e(~qmmyF(Mvu3$NER}(4nn6O`JRsh zn~#`72k8nq&db{^t~5?8XY5$sd_y?SlN1qDY?m{(^YleE&vUEnq+md+3tp_$R*Rcp zBrlQ7{X?oFRzfCxaRa3*pO1B}zqmyt@@LthX#>5#KEFQhppcS|FG}UmvhY+-Ffw`& zTKX>iHq@7s18&kkJ~LcBdwoJI;YicZkBL8ehE-nBvHD>4;nW!0&_epS&{b$L{qOAk zTU+77aW>Y|x8LP4Lv^{JqEENngRoj1wcP}; zI-%$95s7&+)x2;pbdM%RX1ghsh0%IWmkH9600{fSNheU3Ug%AHyXh;?jWi_XyA>O% zMh;>7h7!7$8B2?Y>I+z3Ff#L_@rkmZq{fKL-}%QJL&;$7KWcQAr$v6$NP6ckDX_l9 z3>_`XZH#3(_V?Fg04?PFY2@ub%sO+D+-N6FlTLR%QpUWk527 zL~ui^{~!E;E@Py;O_li3b9CRW;W^)%t~Bg3L~(h+(HQT*1CF=YmQ~I9GM0hpQ_jOw z=tli719I_HI)$FMBl(DBZCKO06L#5&P?@n-?#zY2TD2_N9S%(eKmv?sv| zm$baU4Ely4f4No^7z80nZ;7mcUmLE^RNxpF}p+ zLyPY+rgAkA4uC6lr*1=df{KNCo-mp02IQMF&G$%6EF~}!!n6UoSYz!PQRU>t0XW9$ zp0x1h3?e&kpAijQLlVBdR#S@|3u<&sj8GY*2qEW>RP3D>%%k$N^7<+>#PhcJun^%6 zns(#bjy>m;5tG?3PtBf^2nFTllRZ5{pw&c-IGP5b{igiO^|Iww>!Mw07c;C=)i)Z? zAqnOA+6y-vkH5Tz7_OV06VxJZgGXP>e2LU`SdM=+xc{d0PK|_d*FmZ3W&v!4XfDaO z$ElF*MavTZ1+~oh2!&pRIRtFO2$3tl?iSZV-S9JrW*gXwn=&_8iW@)J;6P;III+~A zbZkY|jzA0bez)bW<@z+|6AGo1wBO50OI?!cne=lL{bZUE-p3=xy#YSon)Objjdj&Z z^>64-ec=$tkWf+r@y;L$=ehO25sGG?uNiupe_`lDdVfWa^v*ab272C5h%V5+*2!lK zAlC>TYQoca`c$TUW^T(}LYd>Mf5l?v)S|v4XG#L&jL!JANfd^o@0CfyBIdSwkvb0LBNC6um%a>GnPzfAn~Z-CxVwaN{+Kc zm{L;G!k;*h_2bw7>POupJx2!Q#90b*usgaQvUBurTbiY$y<>XmJ3sro7WNGLQ!k~B z^mf`zALzZ~{rE(aCan@uNbKUb_6I)=@7r{1XfDcV%6sJG>!tH_LjwA<4H&}uw@8Tz zW6rY{L;pk&C4OBsKohQo`l)$@3=m##wXwGw)in)xeRPyx)d%$pG80~I+1JEDI;Bz+ zmGxc|(i{rZQ{o5D&FeS;m5ni9T3&i%KlPkQ?bms;qiEs)O<(Wc;JhfRtg(0$(0G2z z7^Edh-WA&5cOLWkF}$WSYM=o89IcH#^$8WRHXA?<8*`E|^JAR|CYQURS!-4(_dI}DqE-i^X4PusM4&xb*7*6a5xB6McL3P>4{=a)R6Vjr5j{8Tv0E~}M8KanQ6 zV%7azY`JdOv)k)n^8BK#J6aJVwfEdc-TR_xBahn-RD7q>R<-v`~8tK&b& zGmjNUNz`tv$NqJ#B{k4rptOwg7yIKF`Ju5$9sUk8;`7f_I_QXv!%5e#F2CQ*e90 zeO_Yvdhh18$M3%IE|w8BJ^Lj7SKu9;X%sT}4NrI_$zlPf0@x>9E7Ci9TM2?vgl6`e zgw1LemQliO2}b%nsu8p-KWcyGLgsB~%Z3?bX~sE4NsW{nYm~r z8XE|}nqCZ^$XJrLprdyi?33MxEFa}HQWu~kriaG&tsH%;bgrV1Nt^}&5VIWNz0_uF z|L{JnKGv)WgT203dd%9Qyq=`jOS`68enxG{_+}?erAj?GC-k&kz2bk`;`+djU#Y(m zOkYC!5hCZiyt;sFtyDzC8Ymt+L#6NOMA9O&Ti6G{#5A2&eVCrZ(e zK`60&i~x`0s5eq%1W`sjJ7`N_*}R`u zvqfLTkTf2*yHji3CF6DbE53L{xs~gxCg3&hKh9Q@?4<7R>Vk~95Zx@E_kaH>epOK_ zF{JcA)!WEK!+d#Z+xKIJT96Ql78%z_Ql(AYRbq#N0l&7Nx_52BgMq^;HSKMZ>RdZY;vX;ma;7;Xq76fvN_>< z+a&>?H7@{0iYBFEF?<3EE}FwwESq^70@{=A8zO}~B`Vj~a|8Jkd&X*32a~(zTs{W9 zHIta}IsB8~)eA`zxw!!R{sZo1<<`1>b_o_0vnN1W2K^}q1Vw^DnrH^x{JM|IGNe|A zKfa5+RhRu{;<>i~oNxFW;*3FtEm`quArK6vi1g?DF9YSKa_s!$LS~@Z1sdcu2SUFB z`x+9^dZ33vW*LthVL#08wvkh*Gy26!fS+iT;LNMG%I-vi4`tu$ zS^xDYOU;{)NHthoOhob`DnJ4Z#v)MtN&FGDH=xtD9G#&R^th-O4Zgl;TAyfBi}RG5 zMZjU|UYDSopDrVwWYJsFm(N9JpJOV43l5XXkvICkoVJ?*TFjX9qq zht_jAdn2g!BDC>o8x7TR=8GRQT8t3%~e zrouufcfO%=dL2)qCBpNnGjC=!nI*H}>x;?Z(0`qvq-@IftPRPrNr$dUYBS1~562lJ zY|HeoZ12B^fy%#D*}en5G*BAIr5?Jle8p7jndea;y5+EA$xCB|?wcT}fXizGOC=k9 zfahQJl+H=->+$KHhm6fV(?-u(PXmZC~n^Xv;APRl+>77*h1~$~91X^Xz!(s4e!O~PX1;;`KL2d}nOzl-2 z@C9xVyLhWbV;@|~^$aDK=2_FYzDM&V&5?_P(nLo}DP4+5(352_deJcxKAkdjPKFbt z;KExhle=x5=>rhm;?I|&0|A_A?7=6(@IQ^^g<(sX% z>2L|90b3G~AdHwlIxfcHiwAtbxil$4k-1*NAn~(aK|@ROepxvyZ(yX~g?r2L%|CmayeL5oQqD~cx9qdqNbsk)&}vwufz&4CZhO7O`tmTlb&_Vc!A6y< zIz>A|dFxFe1XFpb0A^)c=oufy=@of+nF@ZhrLeo56Tx{r`=qdhJu`kdF~RM#bY{3l z0V56T?oop|Q{csC3Ej+R|1C+jvRICLq#3x>>Q#?5s2zt zicyuK313E_7*Ps{n38l%T>Cvn+5S)TN%_woENuAU2Q-NKlG@V4{_O3YMYc_hw)UyF zXj^uId)DT)ms{g9221c6{q@oPo6rNNQso#tCyI|ishbTtqT!VrUN$W z{mjep%OVVy-Q#rDv?+@Q2nx~>xpL%(h%1**blNvYbn6R2`W1_9q!>PH2cjMDL|X>5JHIPQHx zg(*t+HJ~ukuthCwiL>!o)SKnkg06+91e!>fu>QCL)!lBwrM_g3>YH4Vw$$m_x; zsgP$Rfpzt0U@f&84+!46&Jl!%;QbqLY-x~^Btq}nZubmugD_4Xd%sr5 zMPaDVC!g#3A?kbHPW>nB56$JbEwPGgsqf@h3LcM!v#C$hyYsDfC`>JznugQD-yVez z&1f~-ewU!8qLf2(II^+Qz~p=T5qQkz#wiA6z-ei`v$&I8qC*6KOgUnM- z=&PUa__L$!c?K};skmN&)UgeKfamwSztT|_vNYK+irmGi!<%kF!0R7r;5amhH``N< zSPp*Tjf$=9si56P_R?RRUeTf(oL+MwfpqLdj&ID{Tru276%)p5kN;!_EkeVH!(Peb z7ymnU8AS2_J-q3oj!@sKrEuxnok30WZ_AU(bY95aY12IgOMg-Hj92GP>3iusOnvn^$_$OiGXSj$`bOYlV6nVR*c01 zH}d%2-uWXF{}&c_!dJ|7UZ(FEhufq#zZt(w4OLayIx_*Dx5mu+L>!HGe?upzvNa=A z>$B&CP9yC_hk8Pw(joZIGZ5i6(VOnes0)Vb`gtd?SF9qal`jS)xU7>5Z}a+-P)ASyMW}LR$;NAj^vpT=&iqSYnT1% z(5n!OeOy`*{}fqHN7us+t9ejD`3GP38?}b5z`I(Div*WMg8S9dK@WAS5^~{{s5FdVhl02Py7LpP@HJ~TY zM}Q}j`*XE$@B!3N{+x{4ptAMGsjjMo%>7KI8RUq{G2^8kf4DukBQAgQB#nM&2$iXt zHz4|vrsN*EQ9F~vNCh`6#IMHbRiOJY;2ZQj7EV^J;&z1`NfQ_Gw3Vafq}y!}M_=TV zgumI@dR#*CIh$%n7y(BE6z1PcS3XRbCA`ZB1=){7l4QN}<4522{P`;kc?q7O<;9rT^tzX7ngHov0k4K4h=Qaof0%3sWE^kbM=Jo& z{Sx;FK9GPaV8pNRGKh1WqM5cASZqj{m|$!CB+@W5n{9vmx>juvVUkxoZO$V%fody; z6Ej8bopTZUFTsg+eV!pA?!`F#(c?t@II>^pTv5~DUKI{C5&@GUfdRV>9fvqGJ)=28 zU5ajrX3Kb$3}@bV9V+M=i5oVq+5MKp{gud1;0V)_ak}8ApbtjF=%2fkI+5Ni8*7}E zSkTzS?H&5)x2_XcGZiHE+VARGYv+1o;=Z}fJw-*#3#l-}WNOn?&4<_b(Qq*JoumRg z{To{8R8Cdkz;(Sg1K2!};OAzhYCD|*LMk`Dd$gSPN2=0C`8wohU^Y3K(QsOnqSKYy zKzj;t{2Qn;awCuVQ^gHgi>4ykwV!OuI8(&xjETZohoK(E`_o|e8%Bbr1pY!Zr^Q06 zdP3uXC3id}b`-o{LFh_Mo?O;TlB+a@!T0WrZCA!5AX1v*KLN4za%g8}rOI;Uzzusg zs*EtYjx|DnPAI4JFcl7sWQV1wJPByf-yy$cnSb!3=-lAnCF!;vgw}D_LDRTs{s*RI zLpqJ3B2v-gg~(sx1TQ~whcM-RC`+N+9snqXhV)fCDBx$aqn8|$+MLud{_J1@;H8E2 z-e-of0CM`qQbShDjMBh4q+pqAchc$<=8q-RDy@^rnz<|_-aM8?yuhcPdb~RkjW>2n zk{TfgFfC<*i`wf>A|pDB*r1Rmf|paJ`qE>9q+{jpBD7lp;&D8~IngB#SmffK*vyB{ zSR2aHCs*sm0p{{GE0}%$HKh`v@6ud7A>6Y#@4j9)2=Cr_z9S~PyWQ+xCstJH^;zey zeNPmmhx67g>hSX+8hIFLc=

dLmN5NsA%N}M~GHtfMm(oGZ>iq(|L=O|wQ?WZ0C zLVWKBZr$uQs$6*Kmg>xc{8^snC`rTKn!GXjP#ylQ2tSX}G%sAH_U+K-n-5m^6yM%P zu|=kd{Sc)sQyY$Hm^c9*=cp&64MkD?0a{V`Tt!y$v&9{^4~1@GUAWfI%b$O)|I%;C z7u>I&4ziA|^GtmQ6o`F=kfd2#9#-($!m7RYCKtIA#=Y}9Xe2hhdn*eaY+%ob@X0`j z@4VNUie;RJP1;#mlfd+fg!YhUenD_KR;udWnFM?wG|oSOMCP--y!}K5kir2OAyziR zu1w<@yf7#{D|_8}L5${_?!nknf)5S6s_mNx5J0^S4 zjMpjVA5fxKZ6)4I0DZ$o+e&B}Zyt~$^rS?OukbVf3062k@?H8&gLzk#_fxJ_-;#9o z2+T*)a~fq6;lC##btzR&2WP#5nujQbrGZtMejkUWIm-cOnHR(De2+pk;xk$%6@?}{>#MiPhG0607{tO4)-?(hQkk{YPhfEs%M>0avW3Bv z%_7-<)x@$V)l%@#9n(TYg0lO_h|Q{s$70I&U!# zp?eZE87BDcF~5xdT|9mw*$?d(KY1$0%!#9}Ot&FF+nLigZA%vMcUlauGOS4@tDEgN z3q(eb+)vG$>>S&u3V$^AOL8`6t*sK_t^5qWP8W_m>dFt6Uz@p-8JRrm3LCsgv*=ZDauv&|S3k zG7Vg2FGWmUx?a07`9duK6zhZLq4dG!(=xy2vriK6nT@1UQ~;GGEci#EnyVt3@9~xd zHgH4h`W1?}8{q19Kjq>l1k%=itqjhp(xU#jMB<=9R(J6%aS$$;CGy5-UsgT_{N61Bb19X`K{V=u|~%PVd88J?4Atp@I@dO*N5st zo==Ha1U|y*k zaf#xLV?qQcm4tO^|Ep&l2fRo?Wp&b_k5|LjJy4s~0Xa!aR+8~wHAU1i<&u8+Fu~gT zjPWpd`Q${wZ(4nFHdJGP^e`lL+=HdQ;cVU6$1K!!oru2C1WuU+OI6j#Et)}T-qwHq zu(9Ae41Int#^tGk+4GIKF*bMlXZcIwTxGP-?JUKONU`jnY_w^is*4G5)A-vgoBzfe zCYtIOwd2zuQiH}W1Cm!sF7F|1NqKxVlGMy91~ZtrGh|8I7VJOoJ^9x$PwvyM@Kpw4 z&wnv~Xu=ubk#9h4w=u(9Gf=)w2^oeE&r@iVuwh(bdjp?wZ2fP#6#OSgjUEJ}Imo!uABK`>h7+#zg>hLEu zyj_j_N>Y2a$w+sCxkx6+H18I~hh0Q9k38G`OOzM0{3X}rpu1UtK^XaRCyU9t`f)^} zlsNOJ~zhz{2YR_Hg=5~~uL+s$vq+q3bseS^MJnW6&__skynJf^&&EKk|#{g$S{a|*!tHSO}i z@~!!GVWfPjX~b_aslnit{AQ*>%+=81i7|qRGMwK}LQVG@u5fUc95(%IoLc2BNnSIS zz4}zS0pXYQzdRQ%?u1hxWFl62*4NK`EJp3 zH#v}IgP^%mtIQrgrZ&3kPGVYn^pJTu{;dqPbnxJrMAJhhCX>;W!*Gv0|Fbve^9x?R z?T`Ud?B0{f1(Aas-A4_Smrk>E3brUI?YS>Lh8z8$9<)8~+T@E)f6S{3w-AVP|HK2N z?_gXLP=QLgNoMItm!rCy%Aos-eHNco>Ii!AKPUaJjn}+d4vi@e;waguiIfvGQh8*4 zP}@p8uF_h#rDJ!!+;aET4H;CC&HliDAY4AOO$_p*xlLJ?LBNJ5126^KGDDN{6X_NH z5ruoY26sJsOTpx*mQ%spBrs(~UTXHFL?dJli;LqjP^DkE1c4 zNUNr2@u<0b-I7Pm=38^ATpl36a@TpNRTgx@1es@6f6Oux`7MenYN7`whS+pbOI}~C zqX=A(h7`-c%=DL>Lr=I@ieWmRpgV}xx-AeXl=gXGL6sp^t?EwAguI$6c#vyRzcs^_ zes!7w=Z*s+)`;sZcMl*qT#vsy$33mzES&&n&WOkVAhzCOtsNaO71zap)(ToF(@!^t zzomf~7P|(el=l-2xA&!_-c)AIFPgG>M!mxf9Zc3iTUBhX81p01e+53g@5RDqf`_Qu zRy2k`wtc~uG(TS*s%y)gtu7KLHd4%9QIh&2EgVNx%v~G~L=>j=TXGLIb&q!(K!ePA zV<8A6ZR&TubKVzHL)U@J#?ba#Y;Pfl&QKn-qpe_uDa0Et67B!R0#J7l)g>v$1_s>o zmx!~~IcRpel?&w?mdh_w+TnAE=h&9K*YL8jI zU0?iSP{uCI0M{C(<3H+>s|$IkzSfu%mlsgEDNW7k`KEx$w|l7v$;Dqu z2mP+3Q-zEFk~uK^3deCot9yrcx14M6JHlJAm-neIm9oTZAi@?a204;PS;Y!nm$PbF zELKDFRqsHZTYVUjCH&$OM1-?o{w4!EQK{pQD)pn|y0;A0_%R+b9}RSfUM!2)-qftT zeh1u1Q)w=gE!b9oufr5vEjG*Vw?oI9r?KuRG#{_0r3oiggxVhd&BEu`3Y*lvZ-o`X z1vC;5xX3k*d!ah)9AI2;agXiS8=8|QK&UWh^#qcFAE64Q40%Hc+m*p@BRiCso|Ry%FA@glZKbovmeQt`B${e>;;JAQ zf&Y#?^8%X-#;4M#<@Hv@$Ka9nV07-I4(F48O(U)8JfHIq>| za_TL`WTY^N8}hY9l+Vyo1v9#rfr`@1EDe7&gFKh0S`BmWhV*mjjqcOG1boS1beJE!p*{-(^?`x^b+LCdcQPm4h>76}9z~RiAURV%4T_Qw0`=Zr%xbfYZQO z!2b(ZUy`@XVg%FHx9~uB}IVTU)d^expUIb_o_VpW`1w};QMEH zux91e00~FgAlZnhR)|v0062kPXO(iSoJ8{NCnq0Dw7YbUcL?eN z!e9qvjEVpO+q=!D($vr2hUft&5n#b|L5(b?_3_X#nQWc+cQFANqYbQ>pZsH}OD&m* z6#^`gXS(W)PFzG1F7VPrRfY#R@FRcojjvg=VLB)ersv)_uhhX^pH$an5{}bD{|<}8 z?69YcH&eE9o~;};raD~BLK|E1Ydj9n&ZcjAOPPNBSOj^tl}JDj{tgVPKoY4PT9%ak z z>i@*NIu_d?9jy8Db9&f1Wzpfpy*^8tDzg}@fTlu$D>~!5r&kpoF6w2z9bX9W;5ONO zJ`quw)o;o3ZDuwcS?H|vWWQca#ls^hXzH1*uP6g)*d3*I|IWHuo=E56cKr3C8b6#d zwndKjgOA2DU4-xbnb!J-Cqn}Lfv#6Kd4yh7(~T>&Ukc9E0i-V^lEuxy7s-2qQ)JDx!s?a+4~RZ8}PJwu+4A$-~q!lB-4)W za_`-RJ147=6wbg+ygz7(0h)B6M&j|W^q*nRk5gt29MP}CuGs09hPD~bK(fvIvQ$#Z zMuxx3pYjCPiEir2%H0P}9Hlj$S8>Ga8P_QqR!Pa!woQ-4fMak7wQyX7uRVeo*LbYA zYVV;LM^oj|9CL2@(onbmI;TL%)V z$vh5j>FxLGPI~TdTuN;50>S&FQ#(YVIsN8?A3X@z>=r1>zo9(QT2Ug`doeNGc;xZD zoK+u4O}4V^R5MVAk@K0aw?(tA*+6sk5R(oo*M~|sNm;v%9-e%4#{cs-j zc;g^sij`I5=dEP5XPPd9qW&(hlW&98EE$$G@608q?Jj?R1-`*CcZDOdae*IGVu$4* zqDU1ZahpN}Hx9kZ+{Y;)qQCFOWu7SH5CtO`iN7?4ApgAdzVR#5M*xqb(PL7va>VXX zY@Wswpyn#Q!u>9kRFrIZZsS}+f|d)K`k5ePgMc>-1z|J~LnYf?bzon5(72)3`-c~d zRLY#?J`)GuZ}`H?Z@o>9bPgQ(qqdlZLW)qjSjjpQvNd662c@C6^GLQG;}lAP|E5W3!u-16r@ zl&Fa=e025_o5S~_r2R$~%jG~Mh#~d;imcUE+mmfI+HFt~E#Gw~#%YIT#7FA;)Lpt% zP_KO{4utH=g^?(tS;gbXPUA+|WLsHZG34z0!jDWIX110`5SZvDK5U}0qt65=L7!zX z#d(M6Mm7`gYTWLp6NAJ@hzP;B`a*bZIre9uG7&V87pmP zf13!<(!<-uiHY<^c2CicH=RI)Gh-Y?p#Q`hl7}&VNF!*=lZGAF z>pfWM`Kr&K!cQaZm&_)5PoqbdOB)}Gwt-oBOQQeIy8d39vGtGoy1>3uOS72F3+$>L z-X8=&Ay}s_b5bkt?DJtbP%Gpe^g3Y%2oNFfuG9q^_ua?k^Tk4oa#4`>vMYSlRPa~m zqFdIAU$A}{b&$Q^I@5vwu=t;E)!E&FV?{p%afQ=gN(&Iw#ghq7{vVp&GN9@I{T?Pp zBc0M?lypdUHv&p`NT+lUkQV7Q@NVQC_@L;ZRv%X0DEv!wJYk6&uA}(|pV$WmKTW zMEwLd5R4}z5Qp3KMcPca6}s)#XMghdcFN^j3#1l3hKk6{9G}eh476%V;tX6$2J7+B!C zp?UNvD9Y(l$>eTJIx5amdhn>s=WdC76pm*ablhomaAr5mzm{rhwOTE+Qm`nr09f4s+Ax|4CZQBQF zfBS&%8BpGJ)up2MMH_lp5!~XBT0-qFg(N1X`R-LwiP!tK7baicZSJQ-P<-#w_Sld) z(a!$e3v_YU=J?|)SB<_*l`uB&=($ROyBW5a0rmT!3ZL3YOq)j~+{@6Q4o5ILrI<08 zR)HNWoqVvju{@a^^5yc9yz=U8M2^%$AY1)e5qrgkbvj`cAN`iS%(U0Tb#EDOLKEOU zf#pV~`pIE!6GJX{`l*vB7)z^FMa~FDm`vS-4uDK;i*c;u$go>=g9~e7ht(+ut2aU? z7h5h+RAJn(zj;hos7pHv7twPya&~S#{WJKsPKxJBk1GxQ$XApQ8j3~Vla|3&vQ zk%|g6L@ffOLxiWc5Exx8Rfe2o{jUx^TMIV-uK=?jKY@1m!+70XFZDe z8%ZvW*q=@U+O~Y@DMvdi>&CUhQlr6?yye&;2VE?_Pn6X#WuvSbJmJ6;%j=$l1l)Vo zmx}dC&GBz0ytty3$%jp>2LYsyw4rc%V8y^LGtyWQc3;k`qzWGfDa$I~oBMHS+B;_{l^XqFcN0?udyCQc?DIXWvwP(D>p8s`%|T z?GI^|iP=$_WD&=W$24wA87f{p(u*j>OIZxF@hk848Sb`X0Mp{p=rsd)KK=p`=jlA;DH;<}6uP(1If=&am*E6Io=l4YeNf&h@^h)v5Fs{U3Y&j)#O8 z!qVj4(||3SRrE55vYABqs(~~<50uo^D?@dfw;~ucHge?ItVK%%1rvTncQhaY)@^*W0hdzg#ff)IzTGuqax42o)zoRL zQh#{mQIu?`Yz*c{S6GCTJlQL$KoPf{ERq@x?1M3mgHS#QR{#EBX0?)UvI;g;iVm#4 z=t~tLZSJ>MkhQd*xV=^*i0U5@etI}tMm(0DJ@I_D{2jVEA_LC#`o5ncWQzZ% zkM~+BS6cu8=&QQqyvn_aYo53I?tI9VPyV)B+O`H95bZB!nur=jWJf$4Brq23Vxa+d z&Z|ce;89OZ7PCr>d@@hy_wv!^px~37%)$f&uXKoIdbzc+iTTw3qNF+={^^?av4u=K zTrpL7Alshm{Cc(=#_{~CK3aC=MI)9aiw)iLjYQJCw07x~$w>cI01CO+IbJxjcN=Iw zi&08c*S_w4Q?hUPkEZx&F4a+2)=%OOrXc2i?7s){wK_<<6;Y6)_wiTrLlAE7vU-)s zjR;e#r_9r}8ui}7__=V2sh+>eA8<-boog~<3PuqYU~ev80BeTb_1 zOxlDM1)X$`DY}4yZ@?jq1?Km1`9=>2pn}eDh?IomC`>v77td2K-J92p!96@9aJb{W zoO!qcN44%1iyM=K1cQm@mO9E3=Pk)%+fpJ0Pj_Uc7PjYs){`s^Qiji)pBzqN9$pSk z1DhYx^U)}hnz={E+tKG=Tr!!ye;xYy@xeUsp^VkotOduUCbU)q{`~$U+JTHOW6&-C z{HZ4t02mmgZ{ob?WV8>j{_)J@E35Za?suS}MQCiKgWO-I`Ysi;zsE+yn`O0S!}yKN z02T%qJO4K9mm0{%_Y>Ph$J^1yDJV97FxQ!3!ppVd0G@$+ z6yY3>8~cTav@MI@R4EpB@d6#nz@x$$G4>1+T>tX{f+3}V22_x7Fe_uhA=jq%7)>ZYwy=hI!XG?yI5{~4QhNwFZh1<+hy-j-1 z@&N{X+eKsaJ73FQ`3Fpy*J!Yp`f#RjF#PtoRNJTl%;Q~D?{sOmw_b2fP)qRhDVt(_ z<|MREh;6ga|M!(#=-}6K8xNSUaRdyy>39-z^B=KC4HtEP#>U)Qr>YzvQ`f}@U)w}G zY#$g8c(7+S*NUU!nQ<}e=<&6+aw3T;6WJdcVOM`qFYPJH{wSLcwEcBIH~7$wXO;fi zqfHQiITGMR+9bVv7uT!ZIT3hY>mA;!kR%asJUl0**0|mL7rexu0H0T1<7W&#SHiKz zrHhHJZreD@lf%BdxQJn3oO2{|Rmbq7Ym*d$5#j|!KbG1372S4d_@m<1lr^r=Tdi&7 zGR&oc`Qt@7TfZsHlm_Bn@}C|~3p-}!Im_JF5arcdYd?|o1a*v_QQIh<zsrB#}j`x4e$T0LFD!*IqX5^&i?LbO_ave8^HDU4a~hLN_&*Cci;h&3R7>X%80%cw7T)yB^LKgIlgF2?ID^yCR*0; z{apj;(w)7u9hOguQUCq?oBgG`0Iys-QBSJ^sus@-mTtM;g#In>v7x7ekE0UP?K{Kn z^AES7s)RZ2EIZB)kwxV6d|3W*sKRmHTwB^_rUI3li-*R{@N~meCHYeQvZKyaY_p^S{$R zKir7 zXS(5^`DivDgN#*RN&i9%o2K-x8wa0FEXDC4`*tpLu#F}SGom*A{(H1k%9ldF(YujJ z9YY3nO)CzhT;TecA~x8Ujg8*h`lg==1Q-CB?*qrxapLnSBIWx*qFH=8u)fmS%u%z3 zg&zB3p8P1);j<9m5~|w46QsAhJzh%X`SQPW#F8sxfZ+z&jm)`jIo`^-%pZmgAq+T4F+zo5Oj>e8k)c2Z7Q z#e5k(k_$Q*I!+Gh{QMTIi@bRAV2d4TpN$>lgW&8=Z!0=Ug4};!3%2C>?|D)_huBK)wA6JK|Pe{nOX6 z^SHPB-gxX%csph-7i4AMlJJ@L_vOylz!e8_U7W)24roWjPb|+TWmz=$y648^*aoE7 zFs;`DN(V4$O{80>VNfluFO@)Qo0Y5ECj)XI4<3~ouId756ycBe7b4DI)p{Ct%U7Q6 z1D2SKro_?@)G7bRtBdv&p% z-;mV@<^|Lby?3C*Mb{4lyv0fvMp7MVr z1-VGtr$gr?u_3F~e1)=$K*jed)xmua!HD!IAh-P27?gfll-w2kIOTa&n^A6kWn$>B zHeg+?_6$ra?(57*1Z!zp`K;bFUPl;KBwkJ^Z);Nt<27thc;g-tqx8H$r{uvCQyL>rvTm-S}?L{cmgHyEk zt=Uzu$$T4t6S9ANH$uGn>7#WceVqx!#(yHk0HZ!N3F{8Gcp2Ik1M+s4Ne3PD9LlvD zPNaq6>8Ur?$rjFF!mg`Bdf3K zF?fo9C&gx@{L^zOb)Q(IjSYjT5znzg+2+MU@|_nM6pE{O%R3kgS);w2%1L|jl0kZ- z7(D@zp)`q!Y|Vl^E?>+pbNG)lI7RyCJ-(ZZl6#nWD&0q?L|tE2;^CbBbm$toOX{lj z1^#)Ts8RMuGu5u<3nr{LiqDLUlH@<5Go3Nh%2%GR&Dpt2cSL$SOpL;X$!FiJu`#7I z1D0sD9aHCjkpH8y+&PH#_Znt?T#;yfSm=s zLk%jO^m^Lg#&l zAhPe2FyUsBPbsgX{@UkHNq~bZV|5<33F_aE;(zIof+(0Z;uI3{6uc}g#raRAmHFAQ zwyV3Z;nco%|J5UN`O6$!i$~3j{)eDG0HdUY+&cgoenCwV*}YBZ zzkD_Hgf-rBs>g>#Wg)imhvFSnO zTzJy08z1YW0%(Y8i^+}et{zSvkkiTyBk)_)ibyO2c{IZZm^$Po8k6xG>Eb(iI3NRF zsT`WCS!OYok3T@)FRyKh6=a$1crxIxC!`1?v`~lGG=62-s>I|+mI-`&zjMU?tAbRt z`4I##S{*ey&4jicR@2`Q18w4yIFAIl)!7*HHP_}z4^(2{4KPTKT(Gdv zP7-c?d~8vFvis-Z?c3gA>MZV08mK8xVvQRkCQqsTOjbhF3fR+`K6Cx~oNGtM!N_+p^=0!StLad!_HlwgxV=mtl>Y$_qJ^P29MC;oiysVp z%jWb+52jo9*Vo6C0yB;K0Hu==&tag(WZ#JI?*DNCw5w%GPHi@RhWkKn0!v;9DzA7) z^X157L|s@BvDh6dV-)r$?3;+E`=^4MbMZAXmYY7nz3Ijly*dZcmt9xfpamqtrBy&V zri5KTtgGZ61krzmB8X3$oKh|CR$sC7bYz&1?Sn@#? zZ=QO$-zR0CKhxJC2iM0p9HQ=Mz}^DDTyv{&r*E^5&9-*@x?R3V6z{5sTD?U$`u)Ci zdgT6q$H{{`Nsn%MbP~gGSXdF`OGLeD(|l!$qN>lyU;|@&2W>d0ujWT}xK1r`SJq~0 zvA`dqgz;#QQEy5&mqx(#-S|TwKRG*XcIBgP(u=>p>vRY|%xUyQu%sF6z$R>46Sdvd zA~rLi3qt!zzA>x$?kuy1yw=;3>%Q-xA%u}g#}F38vZKhFfANU93}keLi8-cl6!FQs zh;zSPF=R~Jp6RYbHdrube;DhY;cu$LYGEpOO@OO0zl(8Zgc~z10x3E%deY%i{TJlW zuoO)|e_ec{Z2!Sa)E!9Qu^5h~2T)LQYp4gIN@|9|)5}ga-8I|GLQ#a)Kb<@ZoRFR@ zVf8ehu()%!>%z&R)Duf|!Vr2%rtg-DvR?~@Q)6~AtG42SzoA#$_Q3g*`>Q5(HavnD znoiEy9f@25ZZY@uqnsrTt!&w{J+f9(F7H=l6b!JJwL!V2N3PjU4#XxLo+%>c8GNtK z!MJaml-U>8rm_(DQ>@<7wN~A({qqhs1ag{t^(+`O#!^_;+j4cEHr-FTzVRYw({Sn2 zPs|gU@f31NBAT4BdQOmpmOGyTg zepcXal%0c26Z3!IjoGcp_gy%v$q-)^;df8#{kg*3s+F{yB|kjaeMs;NmDUD=3b`>pl4Si;K4>bKf7Gq-AbIXW-?pI@!2@oWF37;{~K|Xcx7X?<^E)Ge~9qc z%{X(71p4fZa0+uvt%+Uym!)plungENP~+5#(>uGjS{>n(UobGlj3@3JmL=36=Y4wC zc-44(GyW&(U$G8nnnygsU?;6^w^RoCF#tf)*ur2;b_o9>h?tW0DbP-k&lu*WLuJ7B zHpVps_CanTNA zWaiv$%@XY0a;f)MVSNq4t}MtSe@Wd6Sp|Sst&DKS^^q@`jUIv@h~q{7B`tj*cwPDE zO0MQ+lqfJCAf&Nl(}nBE8M5Q(z4KR12dQNmL4a@nAYZ((3#Vw(Xbw6(piLP}tHjHS z0h(ZQBHwOnZ{8a*gEm((!#awWx5?8vq2He4vb25DGFl0?e(4AQ%D67Zib*WD=cJ5n zwTr`55-8-&rN;_lnv#=Fhu%5f9lucTs8%$n#K`o}7?B=+cIFucTE%%Tb@PFxB5lMd zkO08Hzt;Z{%YU927V6- z5g|0;&_cRtK5bZdzM!?jPdE@1?QU@s!JZ!5Da*BnxOA2Mn$>pS;b9C@|sw3dN>z{c6a;lc80%~w^8Q!X*2%B_ciHoDDd?X52@rG25 zlukyDhEUuQt21UOSCNs|)FxsZT@xDykVQRV*o^-KP&BhAlLv?hwnx=}|OFR)x{{15cde#Mt4 z^m@%vkX3a7J6aSviD^bO|0vv+`JwNfDn@K;UDDO-7hQJnHueuk;x{)>S_K`h?Pi0? zZBQ~NF`2@Py zMjF|9JCeKl%;?q^OMZ!~?&tcoh01=<*J3l#rlKiG+q`BZ4LX|Yz9V(k8Ve-gpZh8y za!EN+`6S_P$`OIz`-(Fc+LieW16+)ZWU^sVMLNLv+IYm@(&fLQBG1I}tdF{rzqm>7 z@sM=woLR1dkHs-UJ}umW_BM#kps4Id4_%~(9um_tg4~5e46)z2>pgbwyJqsY^NkN| z(!~l!@hR$;VVuxMw|i=%E}DK##xSy&WE0+VpAot!dTXf}rZI0^6kL@LT;kR(&d&UD zSRGpXR00`AbeA>)BWtM|ZZ_ki?pOQFFTp;~`9oLW?E6MwOl#$&(d1|(q3VgUQt`Ce zHt$R!+5s)G)I(0Pr$4YQFh1F%s|)ym@Y-aRGjZ$jZqJOm@u1=T_uSXL-Xl;QgNR&C zlRviLxtfJ|@}Yr6UKVb&)4;E@X=W>%?3zZF>`R^JIagOQ;0wW}mbvH4l>6_-Y$NF> z*kZkJKc;iVIR|nEXKlKd3CMvX0DfJX9=ULZIqIvuBp`v> z68j@=i%&=8Wkr8Cxj^%xKXH}4XIzO{-qmt_DVe%t>v2qn%1w#K^kQdGKKsqB{=f5; zqvM=32Y-B%t}(feNVGALI{(Y0goo^~0(I1dz>vz@A;xW=xw1@F+7%xduRJdHE@`X< z-T8m~jZax+jgxq^Cck2b3Qq@K1k+8Aq*H_xaFmfomt{hI9FLESM>?vbC;n5U>$fwa z<(G^wkbcHV%eFv6H>t-9OvKjWyyneU#CT7A#%dNh%hRY_y*?@ShpEQjs>4E5)DvPO zshEj@!G@8Pw_CoPVYiLRLROD?b(}CXJSCEGnEM+cy!I>sUTuSH^fu<%&1e6rd+ODP zrh&c8NcPi}{At6s00YzL^?=(9D(?Bgd%88R8dpP&ZfVogb*w;-LEe?Lqwdk(?x*Qy zCKX9 z-iY)3b=088D)re zoOTe8Ul89U`(XTXv7GSaEjG@~X782D^PyLYgvuOEA?%M|?h?KQna_rAT#4^XFwEz9 z6CQSxMQh~Y!KLPn@vHa|Uyor~n5jzZ#?Uk<(*-ek0sz1nZJKL-_om_iQcQmy%s zO0D)QX_N{F9d#t3sFR5azk2I)ZsB=9^>*k8!XSC*10xC0{b;Q)OzAiAsV{)VGoc!I zikXVAC8I=K=~g`I$glATRo~uQ7Khb18>xvp8_jVdAbQs7{;tgz0Ut#6;Mw<`&ycSS zu1twM?mrBY4jbt+aR(qS?=_glJ@E2{Olsj-NXb~uHp*}M@+3>TL$XVo725?UZV1kK zC?MC$;6mrLq;QL?T6&uFd|tI4-{C52&;Os#%`0p}vZCKyfF4dKTrqu_j*?Ys+TI%m zrF5_7C8pAS@nZbbRcROWrTzGe?>QV2pb`T?bpE^UZ;ZU^vQ?ca7_@CAUkEO)WNIcr z`%m$o&p5o8Bgd$>5thE+M5Emms~m})dusP{Us$)RTfG;f74+T>6CZEZjm(@tf4y(O zvmdmhE{Hi4%If~2y$ab%iS1K(n0XTAG++yuB1ALU%g&&v1kBSu*vqZed78_#5?5hn z4@Y!7(4KAa;iCLeAVM&MFiMSzQ^Ut%>F|ROrH&X|(7?KIF~t=+(U(`%Xi1YKy?$AFGm{m?w>r1+ zlJ9$L5SLw4r87mO>eEDAw!6s zTBz4c2lz?V25vgkIKz2Cw1yS4?i|wu-C(qP$N!|1xN*J`Gbs~_7x9fPZbfbp!H)Te z*Rc5OqP1x$?%bSJ4~>rv*g8;0T<^k{PtUWjv5Ws2=6^s~zkATB5l_y^6Gg?sqGS$a z|t8(`Sq23eis;f3teyU`W1vs73g1XI=iT4r{$nZJ}xSsn)_)$HuTy!tEc&)je{b zpAfu}h|BP)-LgP^L7nrC<*F`+biJP54CvgGYgC^<}dJZi-ohM6|s$Q zW;Ngzg8*}3%dr}tCe5vFslRN<^VU~R^6=ePtm&7ap4%MGwMIgMmwmOl4ByH7Or-5= zeb^%Lr!loOWgeHW5wWppIvl=RCeFV_yM(UAH_mnNPV0VHq{+wVINBT3FGj2fr|E_= zy?JJxPC>Yw^E&E?f5pK@gN*l;YG;_ewO$6{K`*g0o4U#yMQ^UZ3MRLHHZDTm$%fGJ z`JPQ$;eDUa!|b8$_6HibwSvrO1T815(JJWwec3G|K-(<>Cm`znlSU;(D;`0WMN@Z|KvR*qgcS>)FU; zG5N1EWb@vq$U0@wx0GQSvE6%dytBTwG5t%{fpT{;+)rX{Pv5gt>&TXP=(=`W39?`^ zb!gC+j3SmFCm{MSKDcbNO*@s|M+D2_8QxAl zTn2~79!7b_&scCyWgjt}1J>Cy6bF@~rICN-F{PuCbm4n=H~$-0OMFPp>-24R8$ACy zN!U*CgtA(E&xkZ->F%#+WZ^P-9l6_M42DOB40#t_zcHjY5U6FC=f6>zZ(_goP{BSr z*ndLdbM;&L8d{F~xyCXpQnUU%q9iDk1mtU%xWaMN6tq`E=g%KV_!wjD!Vrw%4S?%B zAAtbwBU?es3UL+ozy4g)n!`nL&&Tj^eV#&vC;nYld7v%c`3 zGm*z;q?hYt1&kGj_1GR)9fRN8Ss|PJY^~~e0 zJ*MU&k%4tv^dWylom7YNt6ss(t5EyJ_z4p;k{Y79bmAk~1f;?2=Q_J}R(MYU>y>MiG z^?E-O^2#^jVdvonrGs(lxlOm`V=GVSM>{qUqLx6;rEQr7u@U`os|M2~`yQm~%!ZsH z0H8UX&bp3(_2o(w`%O*~v;U9h=8Bk}vbZt(afQ~?ZQk49MY8p*HSVS~j-fi1M|Pwb z2FiaSAyd&a$<3hlxq>?&+%Jljl+(>|_&$Zsf%$D;kQu#|ryhd2->UzX@CP$Gwb>s! zNCJZ2JA9s4f5M|=t_7gt$i#50yY}}E)UGJEkkScmfaeb`npO-hAt=qg;?yyrP;j!g zU-mNTQ&EQ4Gh?;1u8@KTla!65oe@sD)X7J*ddY_zW9&%SPLk)y4*$bIbILuPZv84uZb(8ewB8yoCSlp=x5@v^0D)`vDV6@g&@nvd9 zaw4pe9D{N-*PE7P2xb{2`2A(lgdSeDG}Ne3#;R2=-7z8L^X7t(8O(d#Za;X-|1ORV zgk6i$bNxMWk$rbS9>w5ZY!02;?s)fqv(85TQ>#O=;oHQJuo8^^xj=o`Q0nOw{q7?2 z%a+V@Q*x7I&ITSVzfLwh8j#oniv}B>f;4OL#!Re)!$gTnKoG{r!}FNCOWBK7ibG`f z^vHNFCKY(b9gj4IWI>sJYp>Hdrv_3_^7NnJSUze7sn z6g{$${c}0Gr5t#02SYkEt?otA2AEcHt@-@VLsAWnJO`&&ida>-N(V^$HmHdB&0fyC~>7YoCTTWv$%E_m{z5U{sAJTT!;#NYxCeglpIR$ z8g5g{)dJQsxCNOIgA@s#AEq;nQX`9dcM+e|5Bx8$#A^RDEYJzZFSn_4uo1HL78W{b z4FmjY)KcG1L=@~+g0u>Vc%J5{+ZuF89Imw5LMTOLTc!tfK1(_bN>F8nH~Y72h~grm z`{TC72sZ{{3ZJC!4*&cwQfl&oKqPM-D-OTmCfMuWGYtL`E1g@=T1+A7Hz0BOb`^4< zk-E>U&7^Li5gqRoll&`BAWogJJd?B#ly$5K5G7bB+8<@?7j^tH+*&+(Jq-MA(3oVu zDO4r!*`n=x+O9mwyzdl?Sh!kFT~UA2uW>89o7dT#NJ5_tY_h2|GwIBqt*q`xu{|xl zAepTImUW^I9w^oBtZr~6I@5{|rXC1I?tPQv&{wIV=>FA;q3`ELNbHg1q%0Y$Y|qd) z3B9{+Fd6cSl^bxQcupkaYotZJ=7jAx^m-33ds4`(^09ObO)ex#M6o0MGk~>yln?QH zj1Rx9`zW^Ci)2pA3l3?}1UndGhcv5@svks}g06{MJZ+Y~(Lli79L@TA1&MCTZgK;7KJY zlob>18Oc0Gc408KzWIB!_t1Y`yV2rhs42PgyddlWh!iG_0u9729X@wZb=I7vjDGSlxR*4W1ls?EgxTS~g4k$vRJLel>C9xZMTd1x3%I%? zvuNObaY?V!avid^Fx@SpZEw-Yo(<`X-y6(;s_X?dVVPbVWT$g}ydDzwHEOYXBV*Pf zdm*mLRX0!Dq;LJ5AFRAO@#F#Th}b|x!ox2dQZ?{QmYgAIjLk*<%G6$GLnS04(P5t- zaF(R<3oB8(=XKOR&Chnsp-p@84P;lt`(LO~iJ<@j$mS9ci(;&eD8JHQVSPS(I;?_Q z`k#^C5$lN5fn3gn;}x0GJ^Db)?(6k-0BP%1s7F!2j_FfoX>d2vBfVzyHiqAASg*y< zay6-p)~WvYW-M)1$L_7ut_CMrBo_GpvD@_GIQCK!W~xUJjOtBSrv>2~P%!aDdUn4- zvVeRZ36Bo;>tTvUg^l$O*d6p%e^v6}4JInLwLUCp1Vp5TE9?LU>mAfMoXMLu{5nP9 zt8PzMp8Zi75HyBGQp|mWiAh11Ehpm&o#u#|#C%v(D^Uhp3@pY;nw#Q$8cIj>t^#0D zF(|FP^QVl!bdHm4vnShr>i%-ZqP1P#IO&Gkdjl^xLb)X&sVl#1u@_El(eFLrd24Bj80o$%Nzo` zZIqpN7^^NG&3*2YVf|DKaGX`3odM^Z3KAIgGXXrh$&7=1O z+}Z<5el{pu(HB$%=LoQ{!vXyCee*A9f+ho3r>RLoHT)I%=B39OOh|(L0%;0}EbyJ` zC@*`JfMfFV9`e#`CLN6RGD8hTY?oYe_9t!(J{g@w{;g15>`VDI%L}3ydqmffw_^Q< z%T#!%&89WT_7wRer~m&rAv&CmfNbDr$)p5kcQ1+3riRy)7!wqVZ|%z;7~a?Ox`EM? zN%6k6L4+khFv>sBmYck_Z7B=XRioLf0eD_w5NdD+^Ayf(bnL?s{Y7*LJKq%!if4Hd z1jiNsLG^za^LL@hE(s;_WTL$NmH~_dp&s9iB~Pa01%m+6!34Unxt2rjyZWmL%x3=k ziQCvWDG~M?2Tv|$oZlwneRjYl-0*vv4n^lb;tAudTYt8R*th+N9X5^scl+fylA6`J z{oD}BMz-l%O9p^zeJlWnJLAiYacNE0D@jHiF9}xio!V;HHGu-eyu0Yq{JZYJO6cRC zlbc?O9~}I@h7+W06N)KJ@2?n_X)1thW+EL1+D)DdlzOL|lqY#zjk8%j`tv@wGJ7}k zk3>kisykNoWMt^NM%qg{9ECzgPrUMn# z4$@lx5drS%O)|axUV?0TU!T#V0}@{P!ULp(7TA_P{l7<1zqgFR740D%on{0N@KSru zbK&C6rog3H@YojCKj>7$j|c=d+SSM+U0(dUF#*k2jPpJG<^~)XNZLK$M9b5zE67G{ zE-S;B{;k(t<>>3hM#5`39&fKm8OE9Mtu=bD%&LEckPGc6f?`P=Y}U&us)$T)0w1A! zV0jE#w}Kt=zpT0-&+nfK@Vk<67in41q_5F?hz+GB0=w|c{%$<4PbCZgWg0J^=Iymp z(=e^}BCFY+LMk$&^5OF2;MpQ7whS`{OjQFaCh;!X$7&{c~%rf{M+#F6!dis{b@0 zt~=5p2x!T&9;PqV?&?EqI-GN-6XbET7jt3<c4fRd0nh5QQpj`$S~qp_#B+U*>Vp8LIAd&V>pcmx-?Zs|8Qa9IU~Da# z-NM?FzW`sz8y9!`IH!i?u}?$0OHfBjly^-JBTx#EqTvRAuLQ=!z>X?VShZ5vJfwKYg7 z?%HrGv4(QAF~|1UuW|r9mKo$}Ii7#Ed_Udn1SRjjVMp4`g6yjv3IW%Ik}MKBEL zxW0$k>Ja)~*8->abS^SYzN2s?EVt<0t5K&g8j|P?Q>9KA^iK$`wi3b0?wp1q#ABH=(Py-oFm2 z&?jGi9->)GJpcmZU+4W1UOX>kggJ3aJK%wQHad2%6l@j`vRQul|8=99(KC_1XBg{~ z9$T$(UFwdBm+Z#?z!I9y=Huf>`L}RYkeQ z6ISnwWAf-vYcO&>4zR$B+&C24``S-RnB14$BL0kQdT7|piq6ZVldfsr2O4iCqwu9P zwo+yAVj`Y&^;oz73qqq4&lNf~t`hZnW99f)MA4#2czEJ9UZu>Vkg;^WI7Gm^jyntc zcfsz%k*CbI28Z24F%Z=BZ;u5m>vy^}SfPiPzXgN1wda4Iw?EDy9sX@any~TT)AM{_ zzJkoQ{Y<^jx3!7Os0&Z|k{DytN5HiYp=pN@vIq&RvlU|byf7X%-P;v0W+OW>HXg?h zW^lMkncW#1AccOKr_=_C)_=;HDH_{&Et@3UqL||bf}r+ln(vhrvzp5zrSQtF*Hiv3 z>D^8JF&w2N(WON44qLo@YIEIARLp>s{rH?COmnYf?>0-}BT7pjt@VkxCzv}F9{wwe z2KHEEQV*@aJzr_SpgoBn__lJVCo;RTEha#<;#~CXuU1tuXKDx!UquEaY$LGd~#W=#S_uRbs4l%g2 zZCQ*g*9(rwnX{G6VUNF~U%B&IhdwCe0~TL$`d7Dem_7Yxs@-C6|HEJaoh-Ch zXDEDXhvm0_?05p7 zj~IV_P_q4_?KpS*-jVR@6Q+^CgCxK=!Uwt0@d()T@RelJ*p^9&`f97oud?c{hEM%k zc1mOFS^cLXy@g4FW`krK|6N{&%^FEB@cV*{xhhipZf_ zQ0W9MGH9m`Rg%6bvsm%MC5ljX;AWAY% z4U|krr1p{Hidd^4U>w?&p8+Of8W7hAX53>-bAh;^E4V>@)vq-ND^w%5mPSZY|u^0pq8$p^izoy`SX6l+Gk{s2P-mHcKa= z+d>B;2>w!%uTMfEEcCFqzCRtc(#1ZaQTT@JQUi{_tlr{8$*0hSJQXx1pZD*oyNFnq z)I($Jo52>N5Ujn#9WL~9HzWSB2<0Vp^L^WD6*CYr-gD({p7OQemwG*K)zHq`?c_@w zngUwj*WWThGL%2baDeemu;rNu|57m_S5bgRf^z%CNi=&>0Z!*-@xqW$xLc8U7`xS{ z5dIG-AF2S`(@yh|f<1DZm2#ZA*ZFMsF7E~Prai~cCfwNTkTB=68LR!mHh|W2Vi=8< z^ixPsQJ0!0VZTCYN2L%e_;-aR3broy!{EDwfw=Qb5+st0di^rC2%m>k4Ct%i9vLT( zUIkXtU~j|MWKb1k&|2L%Rcd|qxknk=u5qxT|3zW#E4hi}%&CDDFVjWw2@X8nqp2QZ z&VjRC_|q6Y@g5%pY{vV|v@ zU7jkYzW{myP-zO~nizWv)>#~2KdZNC+>Ad8ZhfTLxhe_Lqg28*aw_ss+hPfuK~*jM zx;w86zkQ1-?Euu3Ys@h1+Q$r5Ig$!u3oE9F8ct>g7+*{ekvj7-B%55|rixLpce)7Gk=-lxLquU=O zJda8d;hW!{v(~VNFXRHzVxw~Ve#Sq8mop6Kl;7g&K8gJfIMpgL&Ghtez4eFdgRkh> z$m*(_Wn*Q!EC({~{orK7<1U;pDo8tjT^eOpgpyil$elu`$H$ilJG={*?fjS#WAmh` zOPtLbe;2kuyf>m;NW`OIcbEe>n2>Y#E)h?j**g&mFk`xnxQ)Kg=CwuZUWUJ&JHG$H zf%ztWxAjU$9(o!&!+DVwJxE5Ycw3vnffh(A9AQ5_jm z{(ph8K<7*sx8bxvYNHVb9$leOj;EvaQ%9s-4CBF8{DqX6g*4E}nNlyff8e^6a?S$G zXZKrK`txG94?FslHXLzh7aO^jdV$1G8|$ov?X!F$unH2C!ikk?B&%8aXO}j3&<{@UD&fO^cRst1S6b99Z~BO}~Z0ePbgIaffvN5=iQ=ao6{ttrhkY>qbp`%(iIGrNac zlX$Z)WcDCB1G|XDZbg$D}N@4W^_58^Bx8*s{>2U=U9_8WyIV zo%)PGgFZbb%5FWgGm#N$o@uX7@Q=h0aDm!Vd|3`ro+$*7&~|x|m`YLd-c0f$z@#cx zLGi$M0j;>J4T(nG@EH)5lL)f|99Hi?BT~?_9WM81g<>b`d8~-7N_v>XpHM++Yy#~R zxv!%#e#gs9{tJ>Xx*{RcC!_+6j@xV#@D*8`V zDUZ>It!}hMx7LQi;F%5wJ(lpeFzQBU`$D2JAgd4+>y@1S`kd?&s(;6@af{QpVXd)N zHz%@y_^2-N?8(e_;_7A;&;dxrmS63NXyo;bBG#`dS=NjcjWVJBBLfUfqWCW7fjUCl z6A!&m-wsQ;SJI~=h>xgi*9TmZFH?+pf*a`BTFotAnVLw2K&wk;LY$4Xj8QsI=Wf{` zjIwY>$G5>t#_%d=U-je699EheDIGQBn`(j%Vb@T@bI*t<28#3-n6C?!RRz;=KZdU- zoHU30_@~Br7;#v=Bs%T(HNkI_#{`JRrwB8WmZZgub_WIS6TM5!+Y>VQH2UfCR%| z#SVXu@E_%P+Hx^+=b2j`b0Ah9Q+e|mt{nJ40;TP18;!CzElBZ+>4sg})@$-V{l(O~ zp@x6OOJ=9DJw7z%56_u?>Yp%K>PgFeK*MCQH=?vsA%(&m13M)-N z{`Q8P&CiLNn3w2sdz79vp|P;ER{^{5@FjvEaRerPLmB zAWFPi6Xp0-n5xWiEEji{``zSv9*ITb|3}kVxJC7SU7QX9DUt5(P(o5*=okg0J4B_s z8-x+01tg_Jq`R4+Te`cuW2hP4`~5x7`yb5Qea}7n?6cNqp=(t>Dm@e|nm3Lr0Tk_c z{R-%cL&98z|0wSN+5{#Kiov}Y)GRqFKUjGm5$-mvkibedKjkePfpY?hpQLY@mc_1y}m!==Sng zN*B=5Q?X;ZDrn&<=v(I7Pp?ys(`i1Dl{~zEmb?)3$VxwSmLz1&Bh)zoouwMucQOokHhtmXLPs-peVpX=|7@48>eUhqfW9y*n+ z^!fAaI1;Y$Wnc>m<+Nyr9)ha|KuOlr%JCuBDy6e#+XJxc1s^kj zB8PQC6hfW4!xX2r5=Nea&qEeDBIWzbJi4CZ`)_XeA3fQyD_Q6GfTR82X%;D+Of`zAk2K)d;lfY{X1Tt8e65o~>wEFPF*6qfPQNrm@+)uC z7gp(uek)LmM#c2eJ|BI{yYEGe-#@*z8u#z?chS?rZ4>y6A=$v0z_l&8I`eVp1f2%8 zGtQV-+f-EHb(k>RpvSsJob`4Z5zTjrA3MChGKePR4E3iGs-#QMlk2^n{b#vhGdnBX z4@-3IP?fMY*OH_wOuo1TT;UONSTETNn5i6kvdfBg4K%K1!(Ee>jIiTSj(qs6|E7I+X0uKS$j$ zsKD6tk2l~e)2HoZAMr<4cF+TL{V7UgA53I@ikU;xEGYb6sBQ3L`#MxiQd;&M+*hbM zRTTuZj4KHA_cTQxqy_K2a=Bt`q;V@(KnKb zGhCL_HyONG?d_7cte1PAI=5y`SyIz`E}pbXZ1H_}s25LA(TLXK)t77Jj~MV;fO3{- z(XY2(TiD({Iv`Ovx|+!Wz{8D?+0rOnJOStHM1W5upXv)cYq?=Jw`GD^K%Glv5c$W-Ea7cn^-r3o8FH#QmT*oD}h=Ho*ww)+OqmZbjrnrJYhtJOwk z#rzW++w(UJSe83c6%y!+Jx!+pW9c4812{-2U}VJJgpvb4z<&=Z zs>okc;SQ5He@Xdl$!Tj+xDDMto_NLJDVoV7S0|h_bwUEAZhXRrlG*=PyUh=6QxY$> z8Y~pdS!N?(ENzF)U$)|6sRAGRt=pF(7Ih_VB%`Yi;I>ajd7@0tuY3-Z=cD2XO9C;f z)(Jisz1+p$FLja}nE;Ubo2Y9;iusd(F@yfO?&ar;T|ZWNEwTir5s4lK^}uokZHm(CwEb)c^Whx+D`lwg9>&_Sp@?IIJI{YG<9hRU_K%&T@>K+hx7>Iz za?ol6@9U-1(VZxgXd=)haJP1t!?MQb>5k_-`VFPn>Et+S8_)B@(HvNEeNiHO^HW!4 zj8r0EM#XEpS*@&zVhqUt+B4dLEB|`o9%AMF;t_9=e{}Qu{!1-De)nv1X&5zvCc~$# zdAWYb>Z@{Yuhy$Ynbt|^=!sGm{JRm8mYGI;WC!HC$oG6dKSY*3hAfCKC4^A+4b*#l zC*9___z(sA?YdBerZ&fCUbbB6WH)o&R%0oWo*Ho2siDfy zczb_cd+5=VjyD7R_m=E9Xat>e1TEx&-3dApS3SVj^p#0r@(x27D@6Djg+}e7jmRRw zSke2D=sWNPw}zHBiC1j*_8>`jZBOIamjNxrW4$Q7&&Qj-K|dD3QN?lTbQ(G=i57U~ zTxge;o*fdzmTHd}iazrP9Y5l}2^^`#HQTsIO$fD%gMY-3WVv}0DU=PuLOSjyh5u=Y zXrvKiyuBa6;gzd&&xudO)tX~K)4rOuyI$2}M-Up_sORosrYecewen`7y`H2>2(&x$ zLK7H>{A#gZhV5O$UPTceOccWi=BKf{^|@mXsrQm<1;T0rj8H@`X*wbTq6z?g0!~Nq zAfc+indwMmVlch_HtAUrnw_j0Syypp!}Je&$+lDdwR@q^h!J_8J0iuek48U=ZbtqL z^t-o&do35DCcY{_FpP!g zA>b?}MzRa?seSMZCb#bwC=LzJFQ4xj%m$`+>Vq?d?g1TH*$=a`dp z2G~yWa!8V*Ld7WhkM48bQ0+)&Mq52m2dQvKUEXW}*%uW38tNDPpYTD0;Y+n&Ob_-0 zzB@9A*lNiBU_x&w_(U42;GUKgdTPCPTH*eO^j(6rxfDq$ALZ?zaLGvgrDosPPX>bl zR0#*WRGX3W$RH)+A{l>xwDlCqj$YD7pEq8+i_MQR`Wp{egP#Cwm=W)JBs*P@5oTS( zflMVd*KDjBHi!Q#($7Q>+8AP~VT2RtVvj1h=&6t_7S52k%DP^@0^H7umL`f_X=2_4 zWAi;DOF*d5AC;Y8NBA$T1Cs5;vFI?Cr&!|8l_84c} z_}o5bmlVP)oncEHG%1o`9{>EhKQUxp`XL$>;??4vaRM@j_^M=M4cB3^N57;_K}4eI zBtHp|fJ|U^+{5dAkpZ`rF5{n}PU6yC#d^i}B;=`=qH)wOqAX07<^1&wP zjtcrEqv2XSIg9bbz?aWN$*9WZ$+fv=($6X9zINlKzDk{LUND}^APPOcQS^A>a^MO? z<0e1+n#y*c?h73sNkYqBA#e=_M*3>^WmU7dFyN-}`F}TsLssi0#P)25E$*j;;qIA- z2kYAe81=`faU#_wSh%B(R*moB94=z$bGsR=tt}O*<|NMVYL+`ji($C@{p~i`Q_=6X z%32tAhyW<7%3e=!VBa@Ns4$)6ZE5G?_IX$&u9F%4i|&u3ZIHJ3T$QloRqHMHUT~=M zq<16dL$T>q1CgJ{(RvS5)pgigN<#J_<3g;`pg)1wQ#^c##PnXkMPPLlh6b07b+!%E}bIQ$Gf#Z)(n^`$8Xe5Og3#yPQ_0` zRo^pWsKwHLe0ZW&$kcDmdG^@*=xz=PFseO`Cz#F1kUH|unn7=ez77J?#tBM2~4#LaJ zH4u6SP8GmyEGfFf3%s(b8z@8+E|9;_Wv_+6j3rpowRm<);0w1~()z~wS74X$hh8m? zQ;~I#?;btA612bu_?eGhs+7Y=+9mBUSGhhZX^0)UG8ipAYI!nEt+tOqU)g=*;0%W* z@~3B_w3p|}yjJY0wiRbLUl6M{A7aE!5)ZUoNCAm9&xD4&~Tr~$)v z!Mn7LuJhLRi`wSb>q9@<+5?XvCuU)v<=OYlR5%(fnA;@>T2idHt>l{!N%5si)Xdt> zI#k{Er}q+q^sSII4B7038df|$LNHFsBP=&uy$130l_~Z_8lW4^@59srlxU*lhXF24 zKq9d3x&5bKjh3Iy#&l9jdH5~Fur$QTNkrXId0b#7@-^+<91xH~D=jMX=j@9f-jgbB z=F}Y?@nqN?Lws?77z3&jRhXAj_OnNP>ztatvkx5?yHaLRqK|u0EHZ5s2i>72k9U*z36C?S7zs+0F6`$=$&ywYF}Y0rUp_})9E zGH|FLbS=N0;isMP-Z0Nb;(ZwVUcn0G&O|OQSG1JI2@r%hzCPQbyb~#zYr$)pDKpWl z=Of%Q3u`kgV-4BH-c@bdY9f}b^0vkp#&Ut$RBfnaK`8dmvk4f*@1 z)SKiVK5ZA6#g+fB1$cM_+|9A2%zW_eG@=l0h0J>DoM*=Q8aOF`YxY{ikHSlc&rG_R z9!))tUC=5YGy-f>cFL#tjoSk^QVXaQr!bnaMZnS*YT|1kRPY^POzCM?lxZyyLC z(OA4BM8Pz1#T5d$ViRH+6wCv#^LWH4x+xs44q@9M;07ue-e*e>RL&jmO>h&sB%Fp* zpbEdh_9<{<{Bn)utCx4a%bon?Lc23WLE z=4?IcrGAxq<*{N)F3w~kOAa&mFW)w6*kC$u4-w<3$&zTX`*y>-m;~twLaw2vKe*8f z&1qc9-(UaGT1p6FU39o^wXP=YwzR)iDgN~St^VHLKGPv7JH}yR$cLy#AYw1j2VLka zBSz%~({i@)8>ye(P2XFd*g7^{qk*7+%q2dE;+WP0(~-^^Rhd+A5X-WLA74;L!ru?( z*Z3Tf+0tUD-Z@eSmWGrHAB==mHt=hDM>y`^Zj{xa->OaTcUfJu%m(mPcuwmh&=T<6 z==s^?l%hDnQFN=gVu|=ir1RLcYu5-RPXdaKJ5GT4bawj~rqJ5x$oTKoB{T6_*n4iG zan?6C%&r&G`O4@`X`zVqk4Qx~;taH611gp85JUB6gcka~$MG8MP;R8I>y@FL4GPyI^$HF;*_9r^>cNhFGuG+&S zmR(0K>%*BCne6(;&3v}_O{*9v!M~XL&cJV^6XJ&a%-;dDtYBx zM%~%CGJOUSk0Mt4gKm^1)`nQv1X*nZoh=oKF(e%5!+O#wx7U$9TdrsR6_XT{VCRKSd;83!fCQ&_=#_| zvneW4KeEaWR=8g5R53cZNgnB4ei|zGxM4eQz|7|Vgiu+2iY$NrW?s)S9^bc{PsbqP z!Dq{Cz;>{OgXWH$KggXqGyX8*6Q^9bRq}oUN#S)+2fId>)xnU!I|uFK5HGGAMLx-o zq71(_(dPD{`j%fF;B$6!fhOk#z-Hve@81fYQ7cAJ;0-vLL^(LWej2D`#;V1wke3q( z!(U1!sDFm7rX|p#X<39GhdW2t4;#5a?T1-PJIi6Eq)aENB?Yizq`Hc4rmNuS#@TWj z<8RM>2fBQle_rO|(QC(ScMKRqZSRfhvS9}i#KBe-5Bvh9!@7ZLN0CLC9KYHvAvm75 znr(vk;0=C!)8oG#hBv&LXr7y9HZqOHMWQ+^Yt#H)q%QH+=5MT_ZeRDcRB!CgC74s< z5^wD=oknGJy1$(gTS|(uBP%I=uA(CYBAgdJ)vwHDXKHbZy)FE5HcMx%CxGX*HLN6i z?a(5lb@pv5^m888z0{PMDbZmgLsuF3uR;1%V|x?^r5~0h;8Prs1B&@ zgG%pc(XPu;yd**63j-zrvzZTa5|9aZKK%>*y3=gATGm-AKYkV{tB8*CRrX~1t)1-s z^bG0OTQwpcaA-B-liYn`c$_>@M*6q40FO^az-%j1jCK%hu!lrYNwhc-8*{6!;@IW> z^cG~;jjqwr*PU30A-g{nXf6qidIfm)MZ;8_bv;D_!5;J@L3x$_CVV&}0sjtLeG*4* z)7BCE;mT;G?p2F&)^4*vgV8REgdZ|ACAP$2l!Osb-fFK91Hb@NaD9IyR-Be}_*##( z`H!}zggm`VaOR(eLkg^%!)2<1y%vr8O?Ut5if|+VAEPK+pD($;;)_!1)zgo zNQn0M_+GD4T#&Lt|EaN`Dxw`7^k87nnKEe+cR)$JRi!w^did8^)vWUm=Z|onC@31f!Z-VOOkeou+56ZCui_J=wvP;mx-uW4Nq(}Jtr_coPBhmc)tL#P%Uky|0J zh@1~f6fuJ^mR>N~JOVEDD3^PFvI!RTQ5$#b^FrZsM!z}uivfb z{9?QmQEzB9wNswQkU;gOrf?ji-iET0yq4q*CAwBnA)G4%M%R2Vn>Rsjby*n zF=e7+@lrf13#XTxazp*?lEJbTj#BP-vVz+|c|nNwc>uuO;s383DQCC%Acaz~Ck6gu zMq(Q3cyxM#cMm>?MJq?2ts)&!OVBH%tPw1v)YU2)cJ>>oZ58iXlY|O$Kc~z`<&SXj z6iyxAmpCpLsq>PKdOy7pi32ucc`XPp*nh$M>K3`|A+T)dNNSeY8j}TYue_ z%W?7_ezRWi2l9p3$lb|c*6q4N+P^MFs_$2JzMa#+A||(W$?c9bHk|Mht;MLb1lEV% zI56yyNXIS8L~Sb!GC)AQd6|`ACmVquMNzEZU2oo#e506Yr7U;SS1Owf8n+3?gM^Ui zdee5va5CwP(^20@BjDtX{FK+A4to)%!Dr%?qPFgcv8J)dpJVXfAHo(OKlmjz^?RT2 zUj@`u`ROA+AxSYbWSp&yq!hlKc+jQF?1it@vl~GT6GNx{6%s~P)}~p}OX48}{jkc5 zO?|RU+2u$YAYw%*U=Xo50u^&nkj!XREFo)45841B$adPjLZ(e@kDL8hHHfJ^s7ZsR zPMz{M``m2s$I1f#TUl)F1}iANbNTJZZSSBSNja5?w=HNTW=vW{9Tmosxv?+eH-uGS zxE7zXo@ZL5@5x!eNdqdlajX1fA=>x*m83Mf3laMaX

riStbah>4guxI%&kz2_^t2p4&blbMKj?-MMFqx~u-rL!`gLr>?0*Xqa=^{r}THck(u z^s@;c69en6`}^A;z?mq0FVyRb%woaF9+U~_3D?P%nb`Ypo&oOpCt|FmVc8G01rB-D zuui_1kZj2f;aBS4_eR+#n;E&4*?y|-zrAu>I=!6?+V?O8<{%N$(}KH=2OXpiMa@ys z!xhGKB@V1WAc53$h;DLvf^l5*QEuKFN^ke+LA}IgeLqi2>$M6p5s+b8%*Q(vz-~*g zoEY-vCT8o)cUsA&ic7bdLw%CbX1_n=tU=$z#0vp>e9sx##_zGf-fuo=m7)_nWR&|5 zkiBxN!ArR(gGERPxwpEnSCxT5M~0MMX&^*7!VCHwRoR-*Lfs0u- zJ4xY-h{Bwc*$poc4gI`*+Sb%vM4v4K-$wTXWn015ZpGm9=Okoenp>xd^(*DH zSfl)5E+3bcLOgcOXoz7{Ja=^mA1J&8WYsed^0+RXZv z(e?Oqtj(KwzDhCwblj#}yN&D#)OSGB90*bEO-zj%?$$k(-nN9_Tl}KSQ9;vul&xD` zhl`Mc!|#Ovjxj~|dE9cBgJ!C2e_#K-ZJU@2VTW(fpn0kj6n!`A!?N%}6|33*mGnNyd|)y-$f4=6U!A6w&aI-&*&mMceCFSC zVxMIzrxt!-G1W;{AOlsP2fm=K286Br9`hg(_hIUz-^x}#bA+5g~|n5j6A30`*(kd_+m8Om!n%U06h zwj>dPJc_anh*Sw)-#=%2Lvmd5OHo-8ki6j;T4p4-f6#e8prDL z6Uc|1%WJ9q-O9_Ag3{rxQuLG!dPP(AZ3#xGSog zC!SUj5V;S*$Vn2d@^n@+IzA2qZUd;C<`Xj$K$n#IX(D95i{|TJgnV8{dMD9Sw04V~ zjZ{0fD|~U$d8t=Ua5w7+T_88SDM|2*uvy}8BOeO-%~nyBHXOw+Jr9ZXAks-#_X z$t{QaT-!&3{4=d_aHbaYW+@~J>=EU{rsS^N_Uh|bn3HW&@P(S40qt%b#{?#TS0n@V zhW!;*bdp+TLvh-^E8`-io_`UYKoI=(YH-70#cP`s(J~FP2Sz3~`rC zJz=kE z*8|X%1qY?2DD>eiG^z!FSST@-D8`3OW?uoKv-rT6**KLNhw;hlaboyy@s$}!K>Jg1ps7-^-d<$e<5oge z3^w#s3w+~SVE!}i(%|k3C+Y-nZt7(3Lhv?NueqtH$h1D~xo#H=?ORT5t6rDE#kaha zJHB&f2I!V}QPfrEYwaZf`I8kswO@;*bdTK3fj~WnO7YhuxcuH)W>N3;mU^q>#P`)b zTbrBGgY~EdURt^d$)`788|}ko7GpzY=fj!P?HJaeur$${Xuf-{7ujK`3!|JDCC^JRKKrWS zo;~21QXoiXLjF5TGoU^3OI(u#nRlnS@%W6Hln`!|loUIG9Lt(vyA*L_dkNKR4BXQs zXVf1#3n)ugQyI*t};%GO;=`B;)~SA8G%HO{cm1`gMB$GV*mBz+4(udG2EN~Ew7i7&b)B2 z4eZ}&h6ayUpuh7fgC0yqt-?vBO(n%t6if zozR)xSd&n0LB+(dbA9L%Q>TcFHTx}mG(A$cVR8knzb|Suq&LVcE&u0jHJN8=64S{k z2Pq^C<%r-<#NE*8j*sW@HLR}VO^Po25Zeovfsd8S&m}gg>{i(`-dV5x^W(^}&OFT< z*e-^_yj*oLI@;-eVsxjJ>v86>00>n#A4G&WoU9bo=57xo4r$B5;^9ro3o0Z?ne)i9 zGO7?R@(>|TzdcO7Dk)b31p*l-;Zc4*`aHtdu{b|*GO zmDb8noVXSxbRWeb3E@N(VT1ja4*%ZP=6w3x7bzAX#eARg>nqG8 z{i*))2taTUuL9fLcNF_f0FAl<$L4$Vci3*JySH4L<11X+p}d?yse3Q-idJTyhcz_L zFCvJ(iU5Lor?gQ zWYfaZS3Kx_o!`F~^kBdRc1WFidpMpVPK)#tUEHOQ=kfMoyz??22Gkg#!ywVs2hG08 z$XGjJ#^|8=T$Buaj$qJCmHOt05x!LG>P9<9CDuTi7?aqA%|5g*I0*dBCP<|oB+ppWY@Qi&>D57keQRB_Ym74W$n2bbcyuGA%mO9~(3YR?hrHjJH zXEsM06t!vXn*_!mTGY4O2%wwS`AeHdB$_h*$s%97tX)5TB_hVq=2E4^&Fr!hy603d$1HFAofp-}+Vqw?6n z?V0my()T^m>huVn68zr+>^*~7R7cibt zfl$}KP^@|UK#X#6$~j$jhMzW-(Un#ij>a9$@)L;{L2Fuy+(LgRgT0dX;dD+cfc_?a8TkH+l zyrnaAs#}o%gs8-v-L}D9(2-hq^s;2oX`j=Gv!bRR3s>hac9x>3&9Q3jS~xp8^W)fc z$C{3LIKkt^^|hsSjEQxKc!2^`5sq1$33t0r!0|_p#pSX_!3y8vw(d50kc2{mNdnbA z|6>irh3(&hm=b=4RJz5?Po2}J9gB9%ustbOZAQ%sb$?GoCar6FtXux@4(m+7X#Hr< z`d)1Ot+W-IfT!h6sr1IZEg$Yt0{rs1vrBa^jJ&~2x$5gGsi~OL2@(+mg+Z}R3x5ua z5r!P$Dp^8h8c*umS4ceT=Z4*E@A$Mb>fYA5EbJ)`e|*cXJ?+A>dbg*;;!bpvcXOd2 zo__n|s%BE)SjRk%UPl~d?~sZepWs}3u--1bKU~u^X`21$+eaDYFcQd5#cTeetYP1wfUNnGUp8nj#@)ugTMM-q~hy7M=NizR2?~9g=X2dqwEK!j8wFDKKDXfOJAI2x{9Cr3&L3 zkt!QbENdIqS+=K*0bzvhT3YH$ZGo{kSN_|$hCdEnc6Q1$>c6+DCOsgAoXTChKIS|- z^r0(j!(l&+A`uL5hNor9Mtz}zF`$$3k$2|c^GtLM(^WBUwgH#66TDzd@3EV=9SmpJus7k@o33edT*Xx@OS)~-!fy#{j47tG8vQs#S}v{TyLQ< zC(^bTy{b>I#`xM{8S+m5Z;4W;U1~HyVtC${wnVDI@wb1~sqpHN=PN~>I^7vZU!-D}{qsW_ldRA(%4t)F^r@E~<~KYbxiNWmZnAQ(ln2(UT7 zZev@o`5Zg5rsd66mmtbT#s*gq47@8pc2~%6wi^bkJw6hvY{*s;u(0jSP29|L0hY~GG&Tg* zt3HB~?w=BAENex*adgQKioT*Q>~l`;GPr_>S5F!`K29=dJ`kS? zYQ!3SU^}O3qaTpaK%CX3lLkGu2Bpi%BsQ#oqTafZfW>9m~y!U4R4bH|N+s8-BDDI&{P z1Aae5UVV;F{O_7rQ5nY(?=|a`;h^Jw<%HYRbz23U=}!ion5#)0v;ttp%_^_S>T)w! zBj(ib|5^ZO-`aoM9YUP4ucX0l>+g7sfsFw3?BCt`j`E`!=DwQ&SP4;xOmjmLk_BV& zpA)3o&Q72Tj1n7o?*sz50;rD}!&DT8#LLrY2lQIRAx1F&*H*ZMP4 zN6I|rTA&}sPIA^Xl?YnnicRvufTTL1mp>XQLLXi5|K^TA+S{by+Pq4dCJ8+Ism%%` zH#yu(_i6nV@g}P7G?e^bpri{H-s7#x?bV`1Z;SxA*?X zmKXY;E1hR*o8_~si`#%1CWY$)Zp0}iv$6SZZdUwjtwRO8;rOCY`T6yOSpcxTt)KI9 z$k$k{9rh9~JkVUH?_8&LUfsUVniM{}7D^y8CiT{qbJmC}E6>_Ge!YN#(=iIjPR)+` zW`Yu|bpoBa&e|nAv3|xlL5`;+fV`;GI`3S$EpI`I*cG=1X~CCpOSKBA=v-vk+urWz zN8rGZ^=9sxRRqK2S}isfqJ|Qyi8OKSvkbhbl1Z^+A)+}XSoyST6?@S&;=#>8QVBMB zJkdUXDb9IT6>*Y5rc9l%01ll#PPL4f`}P%FDgZ{)97gjf4LIP4KZ~%>P90Z~=aK30 zKKZve^d4!;z?6uW@JwvG~#g67YOY^uWbe4(e(=xDP(lV%5vLo}^LGdvPo#Bnj@DuUwRA z>i3x3Zy{e2@^n1kC7S*ut7Le(*ybeOyD|d{QRxW`i{y65yVBbdgu5RfGLSEe%&vYc zwHdMsdU)*OL1!vh^%wz+>KZby1N9eVXg8;?7rw*I3}(|_99qzD`8|H0Cx>j36w+lj z-^^yCOM`XBOwDMa6s4RjD2x=mt7fz3tj{Wjs($!G{skH$fbD$KILbE~co+aw7l^#?6TL9Equ z3gS}aobY=Sf{)kyz{YWpc6NOO^cXgmr11Nw2}i9`M<~X)6&F=D1@kE8E>?Cz!Wx4L zbS7%EM8BZCbvGyklCVbTOWVEAtX#TC=Py}Yp0uWk7Kl{<&*fdr|9lF1Jyt}0EIjI2K?V_mkIWIXSmfL@W>-2)$VUxow! zB=hrm`fBM>D$%U6kj7T9WsJG`iwpj5l^|xtI>ZpOlPe!qEOnP6jQG3J?T?CkN$q1$9#*35S8mS}QYl(5XX;rG2V zcR+17%IcY8#!>Yla6Ff~q4SqwnNj}6Th&3{#d4l~%+%E%$J0?TKWf#xnl3k(8D|b~-Zqe1c zjGttf-%Ud;mjj9`R3_?C%tm{B7ex;zZHRQ_OHJsMrwQuu9UESpAit+Dcxn>Yl#$KL zYFvZhh_D3Ty5f*%6FIcjfkB`UyGg=ASaiyo9=d2QUmmz?ZTix-R$BYnXH9i`Xa9)` z_F4zGQPcM&WCPmN*K+BO5<&pwW@XE9 zA4m6gQ);*oInv`R6d3}2Pe%POD ztC&o2MvD2}X3u9_AvZaqxsUm&_AsOZbJ=WW%yoheW!{&_YXVj#hBqYsN?9Bn zxf{K&k@qUh2V|bnJnZA0)uPfF@|`xk-ku{?a}HR0#-(2xUW{*Yp#2g|U|H)XiYhDy zNt*9C&JX%`pBeA~;Wa+o3-a{LaQ%RoalNr9S)>LiGLMkDJ%+2}ZM{78envOOuOwC8 zL4%>cU6%ipe>5TAzFm33uI@f^eGb?N_zDwsEVkGI%OECkqkRz#PwUsVzi)k!fp?sR zkNFQ|DlpK%eY~bj(7SWZlnK`A+(i5UNdK&MNJbIrs|aQ*>))~A&u?DEvLI9P%IKrw zA!rE<)_)SCn)quP7#8NG)Hrd0#7wGfj2}NWkP1W@iY|g|_QWnt6yEGe%K1>geN!m@ z&ef`5`L!$wNNUz9)*A?8>GswUtD`3TLEm&f$@JWO>)qejRethC<;<`#XpnGw>Lx>U znhwtiY3M-d4#e<~{Ty*~sUY=o)=c);s-%^{el9cyQ;QIp!mc!|I13CSRU^m;b;9+% zrUr>pu@gcPqy@O4FDP$~?nx@Reww*=nU1kDU84&Vr?G5#O!T#cDHvEe=r(=Gn#Zz( zWm?zr&%R-#Lj^eMKXO0MhGT5+OD|9o@yjd{CDDwo{=mnZ>Y_)yHgDbBk%HYElI(X- zIYqb9GLwoh)lp)XEG#Q9kBhoKf`Zj}Sa8KG&_D~ua)d{cyhaMKckR)4?|wD_{wYD% zBGqTs`z}6xQt}>|1Y6 zD%vVA93jwe4r3iX5{$#=Vb&C~Mz`?fIx9z-s_@e}w9ZaWpIe`!x#H+ZT}oftLJb05C7PsKs9uGHf0{h9upj`(5gwZ#Hd z-JN1&w~bwWBZ=Q?dsUllyIX$J<)*1$MQ?DC#i3*>OQN2IaCTN6M+hs|SdpA%DYG6o ztDA8zb%?J2b$IJutymzEZ>f+`7)2*jBOr{Gh>?jC$wG9w2Cd5eWzkNUbW2T}J>WVn z2!-me6>qKXHR`Q4t(i!DTI*@edED4J{;5x1k-ENPxDlJybVAL(;_Jq)qYCA1hM+1^ z;?HgU6!jl~J#5|1k|6JT;J_z?jZst3@)(}}Ma@K>HfPh!ht#m(ILfiv0g6@tTJx&j zKH5^&W4gdz)ehk=LLG`|W{FSOtn?Xnk$aZoqfQdE8b2GiimnmR^x^4sggO{yqawt) zKzT|#G-Znn@;H=K+^2hgNH2fEW-^WolK^z}c60p4gT?@5>Mt4LH^=YvEwf2bz@zuU zRT_4xMrVzx`E;D;;zk1(>=n~^?dVRapx$D3PZT74v2&h&V|6FUz=PYta);)<|K?B* z$UZK1mZwy$t!F%7Go>bh7CTx9IY;2cROYfNaoh3R*aaqr)vjtIs`!T_u!wAYiqL{i zM=J&!SOTob9EtkuGe>6mdOt4ID)RiNyyupmESE%xu4DA{G7^fh(!sIrRbZ~e(7qn_ zr;X!y;V;(Jiplj{g^$hTwdU^F{u^J{Q`s3z5|s5jH`*Lm&Vo1wTyP_s+G8GwD1G?$ z2~1+t&1!=;vp2zsL8KH>eg7Cn%}~|T(DR;lS-Uml;u~9;8zFyx<8I(f@N{V0B;8}I ztJ(WqAzB^Dj|y>XCun!`(@8DTI)c@%7P@}oKNg{AVDR<)yOxnCCK7VCfle%(t~94R zxG*Tuk#6g_{(Rd%?jRvS5<>m;OT&nV^dmti+z0mO2VaFwa1`W=S2!ZGH#(d(_|^HW z8|~y&94PdE3k%v`q;MA6FPub;AVGdAE^2h-W->JgoC4s!vZk^g8=EgHUFF&1Z2zD(0 z4Z7hYMVPkjT=vwNI84hM^JZZiWu& zR#HU-rMnqGIs`;Ir5ouOW_Ul}-+#R~b2B%y)}DRNKF@yQwPZ1#CPEbyMD-nHBYn_9 zo-Yh)RK;C<%Uy9j@Ts%bi)0ways3NgLJ7U$y(v~VK!n462s#EwJ!ad(Gekjh*>REx zqpARHALqw-CmA@f`Cf->_Qy374|zP?-cgb<*qIa~xzgre%)i~agXx69%)RfzS)Y_G zE}MXX6{4&9yO+BsrzX6KH|Y_C4n<)?KLP-r>`0FFEP-_Vq%{95cy?^7t>4i^dHgp5 z;D$Vu%Ce>MnDytKawD3&Hs>&%o2(7YmP{4J*w~MMaj)3{JS?MylE`?!_LWFhhJw-O z#5mrBR#J)x_bh*AM50y6GQTm?smtp!S4_?{F>db4#OTDxNv?@Wmj-L|^J#5Li|+F5 zBpOgGNP14zU3Z^k8&lPI%@a~G9KglhHgX3hAQZH))S3Z+&W@_(cuZ;jYhe1d*-p)o z0T91DXQUb4MI{F;7enKF=h0d#4cg}|j z%%2CfSxGJvU_A1aiq#37j(~27!yYg(XDeH$FpOpcPQYNQQQMbxi_O<#@kb^c<(G?| z%-re1F5siy(3cQtdbMK}xCj0!Qbp z(0kSz$ZW*JDyr}2j_0aLLeBMOtu=Aj4v70qbHfVzQt(}r?V33G*w7guexeh|_enPo zpZTa4VM=PGIT&a};juE3dKa65fQV_(-t%iP0hLzpBNHgNf! z2YgyO^W6NxEW|vrBChA~#;lj~I7YR)!A9~x0m=;shA__!Z@WD0mt$0j~``qnJ`M`(?TD5 zjzC7u$cJpUHrYK1MH2(DSX9^0J@@9_vT?0V=9D2D;&3v-S6lmk%bt{nxsW30|r>ipZJ8~x!Qh)G{ z;oCm<+>1Mbtei=A65bCkRSOS>!*A<&6(_&fok;;QC4OjiVByAK^H}p4%39sZMrO>KiC;%|Yd*)~`64}n>my^18huW*EU@XXb$2qs=9B6a zp@*Gg*>hEhaZ+w&5Zk-oI~}qcYIG#0yo-Z`-N9Db={g@YG|O7n-u^2d0~Yf{HNqNt zPb9dnVmT8&fFCVluHe~i(m+nI=r)9N@WN67YAhvW2569wn%^pXQNI>8|AZ2|5Jc#l zAcmcBuG#S3D+%quGckR?zPq@k5cvIEq}r${K;@eqzCcuuR^i#feT#)uGR=-LeL6YO zT`~f`7gh8K|Jno@4{|BQ=g#4Kx!qK4o=EU&#LHLkU*p9l5F(P-ZCRihOFv3gKdS+Gq7Xt=HFMK(Yted+&j zo-GFO4eI}(YOp-dD5>?MB8IYybH1U`sm-XOtxWHCPwZ%RrA#bDdmI*d10tQ_cN|YZ zgtt!d{KR~u3LNx4mpYq2N`sOm5V_se|M;g`4EcBY^5Q^Z-{y7V8df7$W815Tw5{-aIv0Su@WRaNav`TdYOt5m;?ga3M| z6m;Hlk0}@XCF2q4qK+&zm*{rTKq@Whz^Fp}X@NM8xJvxft99vKqCYjUvDSl9K?neN zsNM`Kc-8&7L+yM^*A99D$IbkGa-nj~@)(RuSP!gZGVBUbiyjSqT?^M=d6~hW()*V3 zPOm5XdbU0q!04ADT*M=krEaS|HSjg?U^2d$!S;lf{Zj;?AuYv zh+BXCuuv(=^PTb^F2bR0vD{J;1zVl)Ga_>YCrosf-bNc7Z}-^SiUnMFTg`-!gku!A zrmKROd!ZWdH6M8FA6%Jf?*vHiK2jyYS7+|svx^8AmW#+{#uNrgaN_;Oc_6|f^-nPa zSHfvY$t+jiE>7NuKN%BXm)g*=4kdXtr3ty#HZ38#bv^Of3kkS?4zdn}Nq^acWoI>j zELC|tzV7kSSIzKY{@4A71V=(m5X<%3VutkL9{8eS#2DYUQCe|e6d(^GZtw6Iazcwr zo|3a2eJ*!-+5?L#R{tizM7>g8m|cVQjN#+IjSTBuaX4DjwdCU~Ms@VFf)Cv}(1mDb z#Uih@*O(td2FAAiS#kn!T zW}xY}uU4?`bh&*H0!%PR`0p`1GRnVx&5c;WmD zNA{U=4cG7v-TXf9QD!8j`pJvE#tSezdaf=jhFPVFS!G3&{oHM8c|C742`#flOV)#_ z*{Sd&>F2Xiq97@o*S@O;TlefJDuWp(FJz_{$%$%^2#=HKqgCCv=p$f`OMk`ucwere zC1&p%kD1;@>-43vIG}tR2it`b%^dj3ppC0Q=5%9Rq^;p2c3;^f-LH)y)z&yxp_R)b z82$b2!Ep0|mAJsUoGJuT+m*)`w!8HlifrUOrEgw&Fagod5a&NSJL!#oycGWYGpl@- zaoYqmxNwA0_)LS5!_?Kl1YW3!#r6jpy|d}4g0?ocTZpC2P(@rP=#tTkX-bo_X|HHC z^I(=$LoObpCYKg5(b83;?0>SrvMJ?-l(b(Pvs7%QKA#`=H@hu~d&7*D7N#C}>;!`Z zcJak~k!NQYJeZC4{25K9P-GtU)d7^V`OhE!8yFu15E@<&HMxAH7k98^B6^b9HuW{o zsTv7+3-8|)xrUx5*gYaz+%;F`2g7Q2F3MUlCYiMhl>SMi&k(_%`bbmS5hM*8owJ*~ zg@`kKs8rCNT5{iSk|mHklRN|H7 z&k^3j=UhBo97a`G0vrW=AAvyF#4Hk^ManaghajAQIC><(y-Tx$Vs@S_8F6geN6%=0fG@aYGf zO4hpHu1;e;th5*LJ;fLDEDr4E-P6B{AN|`Sv1gE4Ak<=kcP3+$jQxE!U)Oab$)NY? zw!5&ZhcXVkAT(m=Yl%e)ujzXUQc`n+l=}J%J*fI$vNP^@#jPVt(9?#RzIdBpU#<;< z?4o6!pt%W+cKTPM_Xsq`h2-o7l!MF9^a5|g44|;=-x9-0K(~F~D?%=#joePmK%MHp zep<;?wQsKLOy~77*;&BofMO|6XeF+B&HZG@NOklPq|1(s?z6Gb&};OvcTO}Gtn~}^ zHVp(k9aUW2`PzvCNd!NXp=a8WMpzP^jR6^saU#AH?84XS)q(P3B+*WD4yi~dwRk_3 zLfEBKvLtG245RC$kgYtaGO-LRntaD{2U!E}10iEEv&8peC8noM+i(cqMQoH_PxTa^ zVQu<*k7&A~{ymANE%H}ds9G>K(u9saXhL!zK~)vCD*> z2G#Miix|$55*H1OHHgyCwyQgZVMp<0c%Y&0tqv)4QC@0E^&5*COt3As9}+WNK@5$v zkDkwnH^i`hK{~4~qg&m303)r{dZJ5Pco4aKu+STt5>S*c(uR@iZbA?(=P#1We-+Aa zd+JTAu-fW?JdU!77q{IlLl&$nB|ft{d@8<7iVY|nbD?Fl@L4O9Iy;sYiZQC zG96JACee`|vazV)p5@c^mv&Yev}{ZP7V?h*Yr%r;iW`HNznjL0cW?-jOeJ8W`)ZA? zm({iHE{S5m!wi@TQxb=pCk9zA4k_?Z{%YBiZ+<5{0fahb1^$Y@Ge)#7^sV!3Pt~vt}*GMd&WeCiOBk>)h#^w&+oGW z0U%5cPC#(>(&#>lAalcSB4dSAZ_J926?s&bmLgW?%YXfMTKlipE#}>CWy#L3F6@u6 znwptm`$;-eeGt`;^}-7erVmH(=j!EtbOEOK`9Q{t7gn@Y#W`A=KYxxdve{yYm%3E} z!|kYA!HiIukse2}N@m8+PMZ9M*+;qmZ9XZ$k_i8H)L*U8P+z^$J8gF@YDfGKc81Gk zl&2|IRe%r@lFj(Qtmp%O86c>(M|koY@1R4G`P}C&CCb_ELMl*82c1uOS0-+}2eC_b zLXN6;)+w4}kr;obG3ZXRBhG3B zqpxkjFHi|T*{WuQbM=V#ha$;x?zjR1$vQ9~vK)bhP9P+#tF5_i%sVK#Wyk-wx8-{n@=iIubyRyAss&m|VeW zcx7bt|G5B#r9;hhS6vt?CVu@Jo==s4MfJH$~6ja;; zOxebZ&%*O4octKr?gh&TV?vjxN(FO)%@z(fu%Is%< zMZ>7O{Kx9u`j~0&CI(#w^blMrwLP(Ll1YFS#fJyYZP7+ML% zFCZC;WkoBhbOT2GbgKX!iTGrgd_yLS|F@UCcbKU-oqPgVE-UJ!9wtRsW^YKL)WF$? zt@ifk5fz^0(IUzdw|9D(b~rEu_Z_SUZJyN@EH*(wsFAW&W-YtePczVgXko)%sCHkG zDuo`&$5&3|d@2lp%69nf9xzTV9gSY9?o$U9*p&fbQME~=nirVftEgwLCEG?5X<#%I zV&fO7&>lVXaAJa;Ogv8HW?&Jo{QIcSh~_>1IC**1P~*j+UIgq#3k-@_uH%bitx&*G z9+Ea?3#B`MgG2w&#bVwb#=+tE#hH=3i4Za9-GCxMrAZU=Ki?y~t0mx<+^&y*JoTV^ zksmjY`tCd^NB73pLv7PwMd0XlyqGHx38D~P-j#%3T>tq^^mwyq)D>Cg5zCO?E31&% zcz+SxyM*aHRnV88w?(9m$SH-CIisn~ZNkYguNCL8Z_DFhyhW?nZmILI139poqB(^; zsYkzOyfazI+PSH1_w&NLD$KHXNN=!35+j+%&_68?t)z`~eZyRCQM%T;IAPAd-@Vbv zk5Gxl=Ysrrw`m`YKtyUK`}pEKgE;e9v4ck|Nnug3EFPNME0 z%~h1%-AHGe=b0zSD#X5QBGgU(QTQBUA5a&oG1R37gKqYE1jXvSJZDGdY=$24-3I;6 zqZxKL3{6+U;bNTvNN7x|44Z22jihECm9q8_W(^u;+5noa($M{>t~psNpJY#NZe86Y z>-t?t>YN_Bd!@jWD;F#Gy}!fLwS}tdk0v&ZdEb34?A-%qauAS%VP};r`B8J-w^BXu zn`{;MTQ;yJyX7j@QO&e5QIzL@mn1v9Jyw3kO!1 zl0z#-k^J1oqGD{fOp5zViw5vEWg3Pa@h4;SwAw1aL(g|~w6p-yuUTr)!(7eW_a2@4 z3x++(anBL`C(hu+D@EqNxa$Jm$!*Fh?f+M$Q1SlaC~XqP?~^zci_WRXEzBzgwI5VH zdNmd6HRiGzJA_Eys5oUfATswzNsZaFElLH4d)|*@9ob>g+`9{UMB!BG+Z~YULC+4? zeqsJhk0^UcP|Mo(Cy^uxfW!A#$-}4Cd6yZ{(0!dpVfL@cU>_oZJM7XxQn0qXyM-Nf zS>J7Gg&lApWC&zKF8_e$p{iN^*ICUOuGwQYOt){Ub%xQX%bAcl%q)v0)$CU_2)2Hv zc#X>S1Pn2PCBZ!a(Ur@8RAFZ(^wq9mH!r*O9G`*4Max;0v@DxP34@>L;3D8BsVF=4 zbKrHIqWk7DR{U6jct_U4j3Z|oqO+oCiBY}i&}n~E=O;1uS%U6EnYtm)348y;r;ydt zma9_9nU{asbM<3e9~FjsTmlK?YX_(VB#`UV>)gx4yiI0HMxdQo5kKDA_XFdS4>5iZ ze^pSrubJWhnZ4c)NgcvXBwJN{f8Z#gysPp|t3oWPd;~D6AjLj$ehZA5w zmNfH2yf9u@#iVBNmVP5ynBvAYPUdb>L_dF_xn>FC>__94ZJLHq7EcM{FGFwfF(Hn0 zB-^pusj(aW*^)E>isox{Hrl*+RH}Yv$<8p0O><>h_l7=#SaMa_^M1bC#rfMBC2xY5 zQ$b!f`h4maELLyKPi1t{7*;n{qMya0l%^`~nLK-4Mchvl4$-Dqzs(a~jKZgFtziK= z!ZY)J%X^Nd7W%1?JnaaDUtCL}f3zyp{&p&DvEv@GQx++3K`KcK+sd>}*MlBkh$W5_r zh-PtSQPu$gP&h1Vs;ud7t?;_sP!Kw-QR62WHv%b-Uvc?Hm8V6cECW!H)rwhY_LxK+}`)De3-8o zuMPUq>%gGFFDm_HBk0uMSpgKM{8?K3Ajb?WM+G^1woI|m`EvCrKNn- zYx!d-D3T-++s>+fJc9G&fds4^_ut)RQBi0}@5T9VIkslE96*4_pD|H&!Gs(USE^X_ z8TMzY7^miTb&l3BK2hws83Gtt_=xI-`&*6MSs(O*I=9fc#QNeNRc1qHl6-D-?RZZ$ zlQP~e5w_-(*Rjmyq~3F+4`3FqYIn()_y(Kh0H)9_)X_JCdO^0#p3uAGiX*%A9e~!z z@t4&zv+YedNR_?voxcqU2$w4L>Hs@c6my}eizUsyW;pPGx>d|E`qWnKN7-nKGPyE) z6RjKw9bM=JcLvL^`nrp!jN_JKT}wj6Kk*kt!5@v1yn9nT*@Qo{X(mQNfz3cFEk*aX zaa|JZMh+D9kuAgZjL;_;HQ7z^J`q1$cGa5WO3~8GYe5i@)R2a)14DE7$uIS6Gyu_mB2X*ic_G}xaH(`HlwOPn#d+t)xrZ<8skh7feL5!Z zU2?$g3o0ERcKU(ee+d6gJl7RSNU^rS!6bGLzO(~T1EEKc@MMi&l;y~8Ic+e?NHBI0 zr37TuFSB!%nAfBxr`j_=hvpCXi$BKDG9|vyH>w+q4OWUj=p{652P?t0G1f=V=Au^f z49uAq-#4RpJ{;eDii;Dtr_@JXr;$3LuUmQ;e1;&3m|Yq`Z@Ey5*9%Yo^h?d%;6QQH z@E?usd|>PZNd=*9z4|8GCB<=mZOPA}(+cobs<89zk=V@XudZL|J$F=Y$F`h+=FH7J zxN_R6^xpuh>QRjf+n>p|QRVD!Z;$gd37c0(??_1|+ta?bc9kcFFn+~laD9ZcjdX`; zkcrD@lq9&GsbPsQp>e5YcrB*@fUli#mAg~>kwExV6-R1@XKV`2BUU^yZ3>2qvqrho zVCuS%Sl8Ml3vzU4k{w|>IyBbAg0S31%UX%JQ@=B@h;3x(i#O;OUfxNq;aR&ysgpL8 zTLcCRL55Q#qZlIB{Y;iSqQok$j*lt2FKU#s<5zoY`}_f{Dky#0lWo*bs+NmT#8bE? zDP}$OmTOIIyFB>E@um~AtG^oCZi3m|QTfrj8f6Z##*d*-C^mHD98v1Ak2&ip>-@=i zT@-A*M6Bpg9@+E=SiO(-7;OO|Z3O-}``GEoa+KO0T|y5W4@_xR$<^{_ZllSU`dwF( zFu5b_=wlBJ zafzmCP<%0YOY+vosIfDKEcdBoUXMH2@DZ;9-2CJ*JCuMxk^K(|zVb zmv*(4Gy_H5vPsmNCV9zZ!NrUE{C)EOIxj}+$<<=KTgD@7`OU{SNX(mwkC*p>wQw zO-L+}G58jYu%-UxjJJ!QZ>;E$h~-*RB=@NK`|OADcb>}hZdKZJ&|k&A7hzkc;s8?T zW#{ynfv>J8&cPNTrkV7$klGm7(w-U?n{DQu$;jPvQ|-TIHmF(44O4zTB^ZJ~{igK#B<|H zh1y~eGOlGfk6c~y?CP^ZIcq(=z9?EYNV)9`)6^TnrH#SJM_ z(p0X{Wq1W_?A%s;JGV^q?|-w&zBJCi3<>6l0aZHmOEp-|#krTjBrA{01d)88tinNP zrwp%%rXcg)-#G$1z$8TajjP%|i0lKbDXbF8(*e5(ou)@OtN(*s`vLvI zz|Y+Oy||}ctp`p(_EVYFNu!F2qbVE6W=1kfkrDh$P7T-We1?nC7BHgwhj{B2#YGW` zY0xuA1W4ftxSAq_e^W|G{v)^2fY+#z5{k~MN#b`E(h?7Fc&EVYtx7s?FZA*--wf9X7 zJJSMN-6wf0q@JC@Yx0B|RwEvGZP~3m`z@-S)!#5S9wH6EbRNE619&X-{EhEqYp+qX z(lnFbw1)3)SIJ>Wmwf)4iqV-4d6IH0^!|SDO$t@(t6bLSg-V~#|9))@zz1WA8sQnG z@vxr^Be~^cjWxNMP?G3xCl}asK40d5xMHL_+Y-m73Qca@7|s0IKEIF2_*tsVE?{f0 z$h=Ov{SKu`E!uN@!{y)#bCdS{HR1*cPabx)U14Y!fAQMV6j~~DvT%z{$cfhYFf4+b z3^@?1bl~z?P5Qvz{bdv)wJty;hvTrkW|E{>8S~D5c#HvZe0v|u;qhMs?%Hi^@d*a@ zX9HR0ak@Rp0{~^PBD+LtGzgO#}C4iF?PibY2(Jxs= zM`%Rg)b~F+9r?HzuHrK53kO7ndt&b^)DK59?t=TTsF-YaKy&nl=P=>lL`OC!&50_c zmb1l|j*_?>kG5`A*o_^(WQb+ieOIU}Qchq~O$ST9PcdM+Bun#bj|e=OTL;jF6V8T; zx%~IOSR)QTY#A%?>#lj)pQ8wh+oa~II&kgG-NM&(rfAaG$@ioY zB(4cdK`r~iVTv2E7f{!U`vB$s)b)0(F3mfgXYTH3ZNsw9$^O@VbzZJ&Fv_;_kmsN3 zxX7Taz!5sh`ZQ-vUc9Od%@kisYxG4N0nXkDFE43$?$06zfIw!B{(;@OyShLrt8lW# zR+KMGlZR%baNdKKD)M*G&yo6;<#vAX&sOb{lGZ1S>N_<>QcMf?J{!LV;+w4dmndM5 zVMXn9Fl)niDTq%OY<3%{)B22OM&Ib)eFQwQzMZKqKN?q0E3^M4wV;CE?JU@Hp<1`C z`@T+^d;bq(#l1s6f9?c?8Bjf4Va{IHOyPM*mCF^)r>W}TqU{3<) zb+b%hdt)SJcqUV^EQ8($xB2AQUYZ^jf;GOp=zcurv13(WCyBPSe)u&g73D+P2c?)> zj$V-jOqJMeB<6Rn^aukliQu4RM@yd>y$Ct@$5*5vneXZ+C3=Wv&2_LZZ!jWzp0%kr zzH_%dH6g>4lppd`{V)5>hlu&#B!21Z@GU1;skVwFfHjoanBB6_dfnSXJ}!1skHw8? zZMu_h@@)zFiv3372<33h*Hzy?$}zzIfOv^P7sK{hb|U&rslZO<;qq#|=-7}XmkKpB zH4Z?Jf>^nssK5(*ts^)z2((zGf@o)RPOje4J274FynuHV&Q!+NO*Oh9o;KvMq@Osm6C&K!QNdU@%-xpP26H!H zN;Q{1b7M2PaeZg0gK(#chz?~tz*X1>BbhwU1fZD%&hyWLdlA--kx)Zs)cvKOX^&%F zvM$f!AMx;AmZdZL*N2UJ*XL9j#uXmc@CrQdv{+~f^NcOtj!I&B4@F!HZr8^(%e`?? z3#r|eqM9jkoMDjxsuW`kisaP+fgU$E=<<#-FchB0h1N8TzmRi^O&=(#Y?wl^d zG5J&Ud2BPwNTVEAjB|3kNMxS@g4cLYx(bY;Maoa`3%G&pwy`Q*KJt%!FESUI06R1n zdzld!prircl!scVk?WCma*w9psM2n>#RBJK;mQCOaQM)JPAs2H<+vRq!1(&M6-W*a zH&f+jq+)6JW@K{Ur-7H-liuxhD*+)tEWuSDdQjPy<`*cs-*bd7@qO@VxFSBa4}#fx zTd3XeCl3zh+;mq4&*cKRN2}pI?pLeIQK-bdv7iTshWx+6ksghRqq!#{WdJGWkG4vb zF1;{`!9QMg%V?Sk`bb87XGgA;Y9Z#jn3#53OvHlWJRet!u>mxEl+PF;*h{&xeMwT0 z>lU(Y)}fI_km6(rCRntz8b&m|?n*s(@Wg-P{e=Jh^x*)HkkecfwF3<7n* zTKkuf5Zl^fr%=vXag%efwkk6}2Vqk?D##|Cn3jY}4lN970lE-J*_FK@uWmbbN@RHQ zojrfcmMXIEQz>|5EXQl6_GczsmK*guN>7@qNhY3tT0g{mF^F2~KG%!Kq-csmHq+;~3m6g)(=ZEj#TFfS9KLSgMq3puu~1VnaM%F}}bTNx{_}tiNj#ARg=u{?rDD^iaYGVTSJd`9|w{F{o{&Sjxtd&&0$0 zU!&Z*r>#^SF z`HXm{C9K092fpI`uhQ+g*llmWYlu`gWlUs@EzAdJMnL(7ex*#SsVPY1Yr0$jbWR}$ z6#e`!@jc>#M{sjIWVnP-o0`$te0ArsGD|&-5|1cv`*x#QviFL9Cdi|m*#3derEmPE|U4xNQGu~CuL zh}Z{wN-leWW@T}bNNpq-Vjl>YpmQ|~hq+jSXZdOynyPoEi9Rp9-Krf%q5#i{S~}#X z+w62Yki`915!&0LZeh{Xnr>=(M^}evt8$Na(=MR<+Q@+5E&n+U_MaDH3?sn89Y12} z+NwXOJ}7iN4c~lpt-2xRiiB`AS3gW9Jz|~}t++cByg>m%Qy)u>4nu}S_)>jZ%ExCT zp+fV>fEok{%Sh6Jy#^oKV?#XVP9IOh7b`EE*_RHggk%X^8T|X`=hKoV6XHv~0t7NmI zwYo83$2t@e=H1oJb9*>u=-E8_NKuG?lAa~gSE&c}b(AQQOK+N$G4MNayfv+viD1IT zi%Uw_qLJ1hW!8E(T|eUW5gr8dTDP<6(2IcXEL+1XTCxcrm`Z&F`Nh6FPJJ_F=4WgB zcg+KHJ*Fy<+nya9uUo6nPZ1ZGHeRFWwc98w!jen?0)S2$(0q{PAQ#*}{GUO)PF9Mb z@8v*WivHJ^;cP&;4{jTKYn}7(I8+RqE!ke)-xi$U*GApupDwO6;#-GM3>cPZ>tWZ! z)JH>}O^6~W!*gH~qo;uUnn(;m8Te4M3+Hm#wOjH1^Nu=__#ku(ZzbxFcJUZ(37vws z2kY_daf4~D_)+BHd8MjCsn%*Xer5KEX#&RQQ$J>3*The_lr{`JP_=TW`rRQhx&NLnup1zigD&Ixa0CM~7= zIiW;f^xQHtTEii?fxuMF^Y))V_H4m%e`;=cGhVA6Cz(N(fWxVrL4? zjZX#PvxAJ`AB9RAHt|D7f`jp4fp}C-a*1P3nGpG@Btu+hAvIYFB)?GS93clzE6xJx|U)F}3try41}INbixeVfEH z(i4861~7fh&qy|AB98oKho}lQ#QU8SNA)5~ebW}yA*rhqZO?t%pOf5GZa-e@W7QJz zv!gWdJ4KTFSl+w~!wLU>qv$<|*m#YFx}@vDj+5yzESm=J!@fL8kV7_|D*(ByEI+_J z=l$Z&`~#5Bg1cmsXnWmRazT8R#UnW+i$k|zIg<`j8 zWON2+N_F)GsfW%!z_*(Z=Cgf^UGjxK!4gX>&FJqDU$GYJWA}8bYG_u^ZXYmu;(N8( zLQKdqxr-&zwxwy>RIXI{Y(8QQe$j&SlYHDO4T6BknjhcS|=P!{?6Wg z&f+D}ik8;g^zdmYFEPIShQrS1f$#h^a80^#1a|>d+`P5jU~f}}>he{Doq0U)9fZke zvG(fB?aPH$LS7+hk)OzR48r(L*&&Wq&2cwNlZy<7!ou@gttiPRGYu^0nU))dI^|Wl zeuXMV$R;ib^#ZM>aU5q&y3U&j7&^{Kw^sx7s5gJveIvKY|PIYF=dwx_@ZR zDv(M)7lD@{;HL~3rV>(Y@|8sp&jr{a^w8k=0 zY<^cToV!uMC5FUy6`hriaIE3a|$ss29~07Q$=1VbHSQO3FcTR$w3 zTNzedWsmP#(s}=1nOV_a-?mmqOS#%8O-45ueqEXWr=DOgAy{jIHu}A)YN>(z@p})B zS(BobqRsTt43?yPrLupPqP#aVzcs9gl?aDS{@;7W4V38h*AFD3x21eM);ZqVAOE{2 zkJp$VzG88!)yGub%W=&2EP#+HqnK<@oISkm0S|n9)la@V--n&Bt-w#NWU<)pzDlynBx{Qaieq2#p0?Un@S&}1Wg^wp~_K&SGf{8!S&SsIPiVS1+F9bh9gr8 z+YMpL5TWDye29Br--?Kt-?7*UZjYL4aWd{QlT|S?H5w@1{DldnMjlC!WOS*3qS3^j zCv+MiMl`G}bQrrZI}B@fWp0q@lOF|#3-k;UeR$3LOFk>vhLHJTniO17gQ0%+5{#;~ zf|Uig#Ofe29Mz&>DfyNLqZicxkaD1Fd`;RnuC4T(y{iiT* zA&#rdQe-zptyA{Dk3R=)muZ>fG4F5hW(xQAYer9>L>IR_+L-#%BRW3P&SOZ8eZ@)a z|M{a!quvT~11l`wu-kak#j`vUi4#(nzL*1?ss4FWf$Uw-Yk<+^rnr_V=$b2bc*c(W zy`vvy_u?S;_)*Cn{ru4g_sV%aivd%R&z;XQ2PhRaaeCY(rSP$q9A)I|l_3cu)((t1+Lpl7v>&)VN> z%KRB5aU|cTX{}S{3s-Jz|`fAR)y3A0j zmK3pM$t_shEbTpZHuMOyoFEtNK)$4A2*>U1ls1F=I)~+L)~tT-AxY@T5Z+mT=v)B1 z|Gswo^H9AbJwoSM^fZFgGfmMLjPv5TPlKVCUu4Y54ry^wBEJfi;i(UHLi1auxZcGf*#>p0eLR13fyQq1kO{b?J-5jtY{%_biKS+U7;43clp zP-?#pQ+(ad`D~7En-1K6zrPEn?QbzfUAZ*-$_Q>pRWHlv3GCE{&f?P|jHB7gZ0sUN zEGL8`M!#zPunmX-L<>fNuYyp;rGsh{3W2q`>xj#DAl@Cf7MN)3@#W&*Od38bD^`V; znD&QU}8wvgO7w#pXHb;-G-M7yUHBx`S0uYGYEz9wYMkwF%&R0!4e zt|Y~rK2CC&U!dZvO+_oZ6o6e!S61b>xlS z2(W#_7zV+Qrz5R#UELs7{A}y9d1?O^rlI&yihU~agWcwX#{GupZL&I+ti)o;&BP&) zpK382Y;N?MUa;4O2(Jykt=(92JF;j!(i7#^oD}?@-)k%J@uU_Dn)`Z)D*?#@D@oNC zoN4wNn}Y-^1vBzr2{|iDbYedcYJq<|3~uEUznr}6YvlH^Tws0GYrxNclg)ZQ9CVtT zex~psHH^tw3p_9el6cEPPaYd@cQv176_u?4aH4FLQ zgDdv>%_+AJzm6h4J+xKA8unsi6=HsJl;itGEXGw-Pa{Jj*}Jx-83%dm0A-Or_y&kTgyTgF+R zRo}(E9BI*2&IrGydUfmZFoIn~gU}o4sg$bba+-WE>&SNN4*By%3Rc~i|1z-!lmPEF zG%IpYv_fsxoS#%QJA%d>-psJg$M-97C*(r9_3i(S^iZ0FhhR6HgrTRYWarD2-IlOY zo%X z)w*4(rq~y69bSqfa#dC`SM&44O=UX$GPUeWk`iTrq%}+GZGLz*K#0x2z?Xx?shB`I z8IKQODjgu#Z}qNR1NIOXD^M35+9WK1S zCE?Bc9q@n4hsB$c9rIdfD@J;R`ZP(Tj`Us)!gebnytD5@Y#b!3OIHr`}L z@y8Dj(+jxr3&hQhu0a+>$n13_1(y~$*X#k;yI-Lfnz|&# zyKwej*RM7TpN=%;)P3yzXW##EyH7z=gdC4;bUE!as&9RGKi(yrAiA%DRXt#JnRnVb zp@>NW%%`NumBqgN7on;!>^3V*E@Egt+neFQM`jPPZAYP*OmyG|l0PkBdVMy15CiYEA?(O#;bLLu(??zv?y09Pyf9Usg z>fAhu{9{eI3u=@U}xRbxL)NXz>f7&7!Qgl!p;}5a~)AQrF{q* zcgju3SHd6vrPO@gE55zHcp|HW0Wm?fY>6SuqZF1%S6z8Q5>GPO$LXCZ2K);!obSfm z=oBrUVq)cB%_&`O*XL0mwyg3ugz;LSHNW~MBXr{{;Ifd<*6BURF)^BP@@ag5W|bPq z>vzRP^uDffa8U$EsKu_nkeO1jHURcdb*bSETIA^J>?{`(2!q;qYLEi?mn7nL2^{J< zb4`FjvcN|29ULtTj(nkyPeRuCa8?5v*4>qC+%DpIbN7V-6;%z!Zf$tU)@`0wqj9{7 zZ_i+WvZ3*aiPsY3a5`zaTX@68ZNnV*=rR}jZR@bt9G*;*-%+S!>^EYr<=M~DG!nA> zXZj&RL7(n`DyINQ>ezU#7UDC?xCQ4rvIHDz_*~6{?@gPiz+^F=F#}(cwZ3VFE{`*iAR{H(tbM{*uZ?&);eOhF@Mcfg*3tV zd3*P7q~As#hlH>^O)xo_n90~^-n+VByNU23;4f(eYf!6wzj!kR$zAf1s7yz(m(QP# zrXrUn|2Z;!BdmpRz2WBT`S z!s>f0js}z-A|jR>o&(M(%yDfZ-Iv>){ui~eFqh&eV`<~~{oq)4v$18DL(yDzbQyFt z7glDYy|ZXlCim>G&3(15ANSAP(ZM8K=Y(Y<_*VCh+xX#O86UCL#uM=$b?ucJGhg*H z(}aWE3vSLUm(O3W=isk2L0X|se;F_UPGChUr-|!KdiZS)0bdvaY^k>hhnp3Z_Z>jyRKuBcwHn8nUd5AkGZOy5<|NaV9%xL7yy ztcJ_*xtk*{6r zp8p?tz3p5^2g;!p{2$@A!G?K^_nvCzsqZKlr(LvnACS{uGSGC)S22(#a64r zcX;3QC+f93-jBbkfmEtRs_4~|IpnK-y@UT|{=5<`TKB#w*V|q2Us$p^dx!iVNknA$ z(mFv&Wy@{K#W~r|XGklx6v4f9e2>{ZZ3;*WlefUx^x|#ISZubpzJBn`XZVY z{KVRGcm?Urh_d7P?d(DzU}*jxJpon_W?!!*86?lH;f3N1w)MQCj61m6_ngCI#{jdT zgTXH{6Ewe4!Vx_tAH(v|e#(_#7oD{q5N ze9sVGGYrbo?;o--R|`g=kebnO$@nx){HKyDN8svXeBoULE`0;-s|z|U!_<3My_Vo^ z3z+J~nK{O<6Yf$E1Q}dexTA{2N{Zo=?Pw1=S!QEND#KiSHd>+T3O1O*>`-(qb*`iM z*T4&;7YHf6fweoo`{0Ksv1=hpSXbOcs`yGRa*ngI*cY`KtqY6KJcoPO*ey>VnJA&x>Ddr{H3n2onnUaE1?Gmx);7V z!$n{Wq-lxPn(hrphMB~{Ar9Dbmyj|`K+uD6mg6CX+nlOW5G3A zb9ef&HziGu`#qP(jJf8hx2E{A*M4d!sF|fB;@)qJHel zjiANwXN>%nY6UA$cOPib$^lFslgD#d7*w6|a9dRNw8`}Q`>S%(P9bbkC@guG(>!mQ zDh*EdfA0@pEoS;)EUc8{|3}nYhDG^BZQpb^NJ_Uf(kUTbf^HgbDG5Px zK}4@s#Z1%8u=UDZwQqu7efvX@i@bQ3z_1RjI#GTsC zp6p$}T+&LQtZ)xT%z^$yQll#fuPsz8W^*|n6};AtJ5ZkiGFDvHCLa6KyN&Cm^ztuu zAtWHyT#@%7m9)aGDJS8BakFLEQ*R$55Wx=67oeNyj-8jTGJOa?=N+2ExiL71y6b>>1h&`VWxWj{h-TU^03AsiJ}}VP1eL4#c9~l9vbLVu=WX=#Q0DsQqrcW( zNogIl6_sUS(TM zp`S*2dOVOPr6%md<(>1u9c6lc=lB(5r}^Ei|5$C{ZEdMhhjzH(GM!#Om&3n(k>^We z8tCOc!FA=x+rR2p8PEg#wtU@7htx1f;S0$B|HbRJTbC*h@mK=`A!Ivp z0^F}jB>FERpBLyuc81LfMWuTxZJ3xJUJ)tbH09g`y|W>R6c!>M8%V+b?qV44Cl?kZ zOGBMwm>jQt{axzs@j&feFug|FD1CwzH)+1+$^Pn44?<5x?_oDONu)o#`h+Rp$*UNp zmj&2W)nki76CDV`h?dk5zcFXCpXX0f5{=Vp&&Y?HR)c=sg*$I?v9=GoBCRhWV3r4! zBHX^x0JMrQI1u1L@77~b48D{RF%}WS&;KLHt zLL4+11iBserXza|pu>bXo}6LS>1q#AMacyHO~jIqX4&=}Q`@<05JF`R9cK>Dx>ma< zjJ`EPuKe`KzslVK$8Prmisw`;1u?wTX_e{0M}Ik{K1q4L2Gx4!v_90JB5D3TjpRxV zUKGn$F`v&SVZgEXR)R)+^Am>)~x-xNj6gmj#%;=e#& zAr<6O4RmZQM}wz;b=MSb%RvMr3Q-5l>mWZTX%rEY~=ewVN>}`?2zh;*wPOs|7Fy~9U2maUB7jaylsoJg_g{7V>cd5=X zr&<)Gj`3&o^kwm5{MqZlwp5#c$!F+v4~sPSz1`2$`88cvsT;1>v#%eFJ|P>$o|Q3YyBV(i zXe0a&i!JG5KNnYdTNgIWgcjgOZkxi8I-+djUQIQI)mO9;aohc*!eNlMBpWnbL;3h@ zi#mUyUbbkF$QeL(nfK-dB_119nTyQ^_KcqW(cTq6&b7!km4ql)@8 zDjzN-<{rI5XWN*Oo3Rg&UtOsHtpOxJa`G`@C*z8(y8&mAbZo$z6zRXe4>To+iSo=P z%-X9b(H@_w&7}PHD_Xi4@Ag*SJxkAiMzU&~hYkjC{2MaHC1sle?a4q#k8~g1AIhL7o*2uY^jP?alefn-Yl!gdH>^K5|)*_Pq1K4pO{BZ$`p z*KQp?>J6?^@3f-BbVT1bMQY&#iv8jfd}u_2l;Tn|!O#3ECj6kh#}t7n31JS!;(`2< z#5LU&A~s9q=%&1JwcWnbuXaNPwO>zB!Zu#(AQyiDcK4qi<^3D~``(q)MaCYTPGt;j zVFObKc9&mJaFqX3vsxO992c8qlRNRwMeRgeNm5S@2GYtC@$L&0@0`2XTQ(TQ5|xz0 z+SrQ&U7Y_<6aL4guX^3!{Q!ZVA;=SDES1UD^Z?XrUmIof&hffsQl)Yap60EVER+16 z^~vw*CvCriZ|Ibn?TQ<%Pj=;ery6bV5=D@y_v|RmY6!x_YUA$n&-r-rjWn;rHH54+ zg)o}oI|qqIj+rUr4kF4eDN7yx@QqpGWv^g=x~Vf`tjaBQqT-Fz*Z+p3SV`|osxciJ zW{%X4(v|;)?DX%JW1O{!sOkai_J;YHICNtR`IW)W8C|PVmL*vX(ueUgwqNzn`wcQ) zBwtwIyU9-Xy9D1~?_r=e39#278IsncpLtr?ZJXhHGetr6u0u@dNeKffQzXe7##_#r zE@spddye3uJ%0zDxuq|FC4)TRLJ>o5yO?)Fn~+fv5)ku&oy+_})$AO!>MKCEXNB&W%Ltj)5wp)+3-x|6b0;9i)&OpQo+Z$fsz?&tV%ODfwA z?=Q4+zv+79GT%q#jQ%VSrT5jNcm%G!GCPukV2=3rUv!nDhiW>iLW1A5qaUMXX=OG= z-VUGM-9qfOuPy{mTErn#WDU-36u`_KuWhtrMJ?0wCw6vtzV5s0jNN^@L?^KF3$L&{ zZ~D-kr$M5AzY%%!t#Ath1q_{Um!6qCohNCYhTrn@T{MdPjBwFJ?M&3hz^Y@m_C}Bu z4isyl@7R4loc=0IxXo3Ugxxb=4I;5a5(imt@p$0f^7AVA59go5cQo^ z;OT^c>5gBdkskou=8o0@*aMB`C-P#Ue9_*viatb=*Hn97v^;@drvy7hw_wVPfBgR7 z6;{6L^Y>jbYTgX2CfNcFa%Xza9uO4s!e!~fhDW~-HdTMWY79g{PU?% z0rWol33sO!2(dHd$AtGY+ykD^rjlmNZa&z_7p)2sS*(yP;7Cb|izTxjLh2Vl`xlsn zMsYH6T$9Pa1*p=VrS15BR4qK!{W}!^8${h_+Z2sPa_sJNQ;F@n$g2YVXhDZh%zU6n5bF15CUR&SH7;-ta%zrO=g$TNs6Tr?fSF0aTF2jiM_pv!2mLe-^H$K!1n3lsXqT>{^8%GIcDMtTJJGe{sK z#rgL_L;>td7>SxNU>;dSk#b7qYRXo+Om!X5>8q1`ijH8!Rte?6+9k&{H5W%)z@y1s+T$$)!BcKj-OYSMXeOdW~$nC zb4iyRU20by9{)%jW^XSa3s|_6EpOXgQQ%8R(IEgSXDOZx@751JsM7QrRXO|wx=|yG zGa~KE@D_`*2rroxtrWaL1iDn~Y~KB$=Ir63FJP={NNmvZv4P+w<(pXt4D`%`n!A9W zulLIa`89H!`&c0?NHt!n-#$iEb*s#e%<9-9(i03N(8^C?L(UAkC4l2h#*GL|^mPfB zy2NF1>t)5*jWBDFoTfigUn$|I|5h08OYSi*2Id@GGIU)&*Y-nX{S?9e%)U zASt*dA!P`zoII@xHhBQXS7ovWX?);*U20&PSv-eO8G|xRywUhC7{1Cxw=bf+tpvvu z;<(1EsKsXazfow56pMNCXV9JR2% zq4wkABe>g-<&`NWi%&VP@Ty~(o*i+~kZ->~&v4drh{9{N$a_*@FP^1iu&*g-%Q!(Z z1-F|7-j7UQ0AZ5{LFHiF3tU5~g(scYI!N{n{8&5p`;Q~F9-d%E9@=TYr<`xsHYciAE)XNVa# z6jd)DnMx;#A3dF+lmmy`{CiuhCT=2so36imxNrUK6u1s}EcriLfF&zre`QD#4OxGf z3)&?WSE#?a>F)XMg6$$quRL}xj4ebNEr|^uc=^rKavxdStxqvA(+5l%Y-g|lDyfZJmzxnffPchfU#7BWier$S}Yi;U;R}4 zc}=^RlUt>oS-8mru37icn2U>e}x}kqbwc2wHY|6}eXEaI>cg%0l6u-A$ckPfYX`1dkpS+@GvON zH>Hjb#wQ-ZTSXFd$x5?Qq-AdUdj3hb2NCm_yv0u>GL#~UNds6fL%ukmM zkJN;$a6YgU!r=4QRs@|~<`hk8|wjR?)#qL^m7Drlw;luR>KxE|# z-qZC|uwO3YBm6pCAfluCzf8ng(V(s~+&8%DXid8b;a-hxyJ7yu%{1e#G8onm#8_7I zqSimsgI`1pw2IC6#oi>&AX4Nm_a3SPdY{GA>}>{1SR8va@3BJhIyM;fGdb16an-QS z+v^R>sfuu>;-?#X!yzUEoAX6j&-Lc2X#B0^rTQ!^|HiG9>B?b(k~#{B(0j@Wa|*}p z5$L-Y>^_IuCi)D<`8l&K-l#z$7_KUKynt`GeJT4qY)wGl3S+0aT?W=d1~AgbGUN_5 zau`6Z((wC41^UhoUL$iH0O17P)VP#~Q;~yRiVz{Ujkm{OKAXLO{u&8A355SB)jrdw zuSkHhbEzyEwcYdYKrPOR!+0FA| zTQ)0+i{L9s4d$!;e310wi2e3R?B}m8VQJ1iP08pq522!)lsrL>(DS$&w1wPH_byz$ zoXw5B{dNq4Z_d5HTNWpD=VO^%Os^9vqj{1TV+q*-eZM$L^$OJnw;9tGRa><0``DfT z20o8x!LfbBeoL2CIY5d~(mRD_tdO6M;dF@y+wX>~zm)gzx2}J;qHPFjRv%ITKB7Vy zcINh48W;{aUu#Hqw%w) zd`;i{iq5=mFG%Mro$aMDPX04M-8f=AZ9Mjy=0rF4sfvXeNrdbt2)uU%0TFsJ4@p5+ zJoYv}t%T;?V;V|XKo-c9OGyAUbHRA~@n`w`R+y{Nk^;LNiJS8rm6{!)iPvOS^9*O7 zZ;F)Ql>p@K zzwN7pPoKB?%kJ|ikCWe5XWQOhMR72<-^%KXUxy^{PJ3i3y4wDGBezDyp|>WTX*#+N z2!5o3?(qnM$Zz{FeCc<)SzrUVAr%rQDd=QDeXWqk-RGAil@_y{)1No2Ds2jZSCPIK zG`H5zF#csMNpbi~nn06|54Dbx>d+8nh@ZphMJ$2vw-JU+OGQ%-U`wb59IASE5%kfe z`_n=ME*^V7t1EY{pYJ3dhS_=j1||k@rpuVXnHH;)&V*_(MFt6I84nJHd%o}WMpUn| zU>&6zbY2wfZPDQC%(5VLI1qRwt76>eCY*#u{a`jD72qHflmYYgckC&T^!@CvBrV;f zFOs)mSdV!Z=7%e~ES|11i5LJuo9foxO7eJUEgj2x*N+9FoMDI?f%|-QBbTi0++r|%!)sH!sFk578@eiRwwKX@_>775(web!LZ8X z)I1`F8qE+@%M}DM{~b2Or^{(=%x|7UzmCsmD~W?P%zF6VEZVBR%Ftr(03Ce~dU z6_((FZ_dH{URTEOoM)%w%{^O%(bsP%Jx`_{%VwN~zfX~!_1A&kDOb3PGo1Gt)LGap z|L*ZsOi@W6W{uv@mzLo4<}JO$(jbD?y&3yB-Z*hLHOkcvyPhft%YRfFCeegAx5Bev z_dj`0(sI-}13yMGp&0Jdj!i9ulLoQ?%+OY$lj(Hb|2fyJX9xrNs{L0mqqAQ=;P@v4 zO7BZ|B%Pi4b@U*~2I)gKkn)CbKR!s4tiT7PmUTLR?qz>Fq(J{GM_#K|E`Z=;;I)3z z1DeKmx0cYj#$$^tie!0u>hC4BxfK*;rn#%LZtG(M&F98q-Ppof5D=)@wUs}iHQirm zKc563o^P(PNp(4xxO9V-tw-8Yh0le1>`fWwKzh*LCD`k^-%0rZpf}wdt>8-KO%~bA z4_-MnYkFRNtMzElx#uZjK?ARroi8T{w~b}@Fmvc>@x9=)$LDiZG7xV3e^gWfb)P8f zw^V=rwN|f*i?LT{%24~CMOoj#Rq=7peC7i*LGt$Ytw8&o3^Do(U5%KCIXa$Gxm z@j#C1Gy3dgNj`pvZ&8%H2X(0uR(}y5!HV(FTDNWx>dnsut0GmFcy)a;)jK1NpgGQE zt`Ji1a0CXN9PhE{2)0?+$$@t9l-9xX5q^Kp_p4G!(K~;HsJ*DW>iLe=p)7X7lr6Bsgtwr@4-Xy_$vLnxAJ*8Geq zfH)qEP0NPPF!!L=qF zi$Hg@i_2Qn^kmp1t`qT4ABgzBq3`x@y#Zd-8-TIX(=pssv%MDeD4k$8Nc=O-!WjIQSd3`})O9k%C4V2qF~bW=PzuaQnC@#O7-5hO+ zW-eELj?-6^!^1S?{hPh)hFs=Pf;nL*PMXte5n-=#IejJ|WBpENIy3I&URGw8Rn<$z zZ?FKe_Ymg2XICjQPi_DYVCl+y(v)*~&Sxpb$ef2lPmE*A`p8Ic6zy1^iW|}`^4Nv^2R6+6-dJ0dMPWKGNC1e8eg?$(n2SKCKQzG*l;pT21z3Cj z=t#o@q%&<%c4!$1M)FbzzHT8nc7PfCdj-M=19QGnr%hRm*N3oF$#zLHi2vZvbHk+{ zP2cj@@*bZrbp`OFgdRJ^?_1fBP2HS-6#e4+WBEmxA2hHyUeLYiDM2$$dxtXzL3$YH zipMA3q4`r)gvu8lX_(1xRsis*rVD2K0su9VFmMI6&hc6Pbc6g*5KUcG8cm$&fI zCfPz}e|rwF6P!}z(YLgo;Y=~elO;I4xteJNNNsP)K(g;{i(%Q)BfplicARxA!yuA7 zy#SrK<0fI?X3&ks{Y*Gc>O-r1?kOd^5sur2ShA3{31QpXvPN@E?RKF_e}9vyY)TPN z*_cT>)fs0X6S*6a_f}Nrm8^sjkI#MQ=8_9bv6`dP#UHkhW9s1scUAo&!h#bMAV|t^cdNhXsWJ$6Od3l)jQTW-vi(s4-nP+TNFXH zgL$?t6_vw}U^BtpL{HM6{9A{w2LDh zs)4e$Wwz|{>R5mPTRzV-KwtTNK+fdNNPFXDUq*OsgAQ|@TceOQA9^5sqIS{GPv6rm z+?NTnl<=6grIgAe$HU=GBWay$L8}phAF73g)p*JLoNA`YI^JdRzQ;RywcS_}B9BcF zKag9wQt>QA6Ufv26le$#u0%Wg^<^8b%2YfydSr9c8xILV7~2u`e+RXG=9BN;SO;LZ zXkh{4n6@#nhnmVJs*yH-2?Ld zVD~QB&#CIAS}rp{uKdu~b$s&h;C|Aon*0v&(QD7z8tHEZVt85M;oBlY`r!D$s%6{N zj6Y;!EA=->)YD?I-)K|ZS36dHtPeYMoOLNYbtUz+_=<~|FF9U}%CR>oZKZ7dsaOX% zk59<~0Z+>aVnc6pAX;0PXlA&oZ!Nr~*KK`wR-M_Fb9HU3r-XrUUA?$J$1S*MScu^1 zS9u`G6IoQFWli;333uIE<`3RY{V4NXf&A0b&qFDj4xcU6qALm48X_zFm_fK`xLCtfAugA*Ej>g9iNYdA)CyxZ) zPZw6eT4OS_djG<)NC?bmyfagSjPm361jOqh6(LZ+mtsJ6qqv+1=(rRi{rS^7qYOb8 z7`58SPnzu5wgUdyhmr2P78ZHtA39j)lr(EE-ozUMd&9gOUT6KzWzCWX3xCQATI{%@@hGr2 z5g?c~cHk?Zb#^F}anEU94VZ$Gi?@x3k6;H(E&Qq{<^Jg>7b zMnMQ8`t$?LxHSVKezO$r#0Olv>x3@Tnt7vOoc^TCUSkcQgZ$aqf4vq2KQ=0oQ&c32 zv>V94`L9`J6}zn8q(L4lrk0yQ$2Ht+Q4*SprtyV3_pB_dQQIz~;xjryhSqY(9QI0m z#vzM{T1bvZ#yB6u9ZIYH@ay}b3uo3ikqrq0{+YKJ?>=MbM&rf9dmDT20*RJ?i?X2~ zcz2q~J}H}w)D76PcvfWMFqUUlTlIkC!Gg4-w$QciW<$TT?0y-F<~WVcebQ2*zBdrDi}+pB_QZglVJ74&abbgVMa;}<-|{ybXU{h9U6-j#iQ`vqfb0Tw%qFC!oI zab2<^H*(@8s0nE+1I-bJ5F`FIUab44%Bc2-t?y5|AMF0E97mt0N>DSAVsL=wzWd7a zomEFs{y!^+PBBmZV-*rG6Gsb~+h zmw5sK?WUTy>eO#rf3bAFx<%61XkeT_1b-#g-3JT%uOygJG$B8p%vKFTX)I`Q=uR~ z6|?WVJ7ZA`Va&FIWTW~W5M}3Wi29nyqZ@yMzxDIO9jttN8fb4bW|nL_sL{4```uC% zi=&zIfi-UL%YoU~JnE4hYwTc$FaN=y^)if>5thy*|lI98GhyT{sBxJjQAl>aK^{*&>;? z6F9R#A^4MXBd&HYohD?KK`l!(B@~+de#Kie z_xZ19?SfdT;qyT+`m$i|6 zo@%ELE1<}4qVLT_724lS9+b_BjHDipK%2dDPmTXt#tH{Kf`oK1DY-gl=vy+uaJZ7@ z(P=5(>E{L?{&rT>JhFTonU%cKgI^iR0rS$)ILWP5oXd)LdI6)DlUdPpen~C5Tj*Pt zzopy)89(gfjuoJ}mVySnQ<7(Ze#K@a_tJ;Lj0hacdv$@Tcy)oJZ60rM22k-?NCCK? zNN{lF80kTf4m}$+o+lgLpJhNp8C4$?sirHn;SfxkHdN z0HfwO+VI1K1f5^^rqtW2m16ZlqZk{+@qjoRIuFLS>tR-;X*Um*?!B~HoSM=74%`g> zXxlIQE@8leeg&GgJ9YsEzOjGwBupk8*X)e%c%#`yudr+g{|>Pd0o_X5YBk$qfN4Bc zLB;tKiOLb;J*RV@&bKutMYL8N?4rhL4&=zH-VI$A@bZVTU`2h#R6Ur4US^x9v#FHb z#a`ORs08n?AD7r1vot_XYUTzX_jF{vu)uch^nB8L5q8KWm7vdfh8emz(E01mm;#T<@K*}p0rP&J2qvdDWX-w921AjE3oK^Q~>aY07%sk+Rn zb;O1eaY?c@A7EqaCA`j3=!`vl<4iA(UZ58w7leXyrDM>Mu@1~>8=|Ah7z*$ci{v=Qrt{qNR?JjG52Y88~ zwt1*TQ+yzwU0rt`IqZ4wQ}#*9DZfu!pXA`3UzFyk$K+Urqb+NZ!JP;X>Z|5I8+P-} z!@pRv_95J4krchO%q9U+o)*I2R^;)}Jv;8LeQTF2yG)?sduF9ZMCL}EGo2e$^Tzof zPcW@ruulurnl7wi2tOWRkqw7e>jJ;tSxujufq=Jy+ZMZ zqiK3+8R%o8^OXCoWrm4$>kjQQ1RD67^H}Cqnv$(%UfqKTm{&yKo$AsAyXcjSU1|S2 z8h=p$SpmJ}oMFn!O7+IJx6$s<5K?3MIugH*4Ez{H`7{%xl}8*qWPqIEY)r_gLyq;Q zdv$PIsRf-&bEC!*j%|($A2+$^g3J=NUhrNGIwT`f)ZQ#5JOxz(^5{Y7bS!7ta7*`} z8)28qXzn7{x3m82CU3P}wC>a`lk5X`QO~BDRZwV$N2)v_i{SEIi>&{?OY6#&d#gXJ zX(SZw-|6EF5sN{0EE?np-b9Vf=vS?7|0~dC728rQVoz!KtJJ_{MX zlF$>n`eNe(V|hMG0hD5_A`&L`FB(I%*JLi}8!w#J@8`yii^56`@8XXfo802@4F8OoaZe9r{hBa&lbXM652#y=AcyMzZ>mX<-nkQzrOSJv^P z_N)Whzm_b`alqJ~N1RdL!6Ihd>d&??QK?*WICd|2!y(`AV~FEx^j8e>m1C;p)}8yx6lA8jI@FMK0zrPYO%ab%-7)10{IaeD1M5kUje5@XQFM z{dqbCT&=ET4kVde-2?An#Sy+}7@0RgN58c`=574W(e0tW&Mu^i34!~fO->|mq*-$N zOXaq7Mx;~TGR~XT{;RqHS{gM;7Sj|o)vbTa3|0NH=d$nP2P_^lp&ys~5hJB3S{S(x zSTA;u`l`gwe;BQw&;v;&kuq?ct7bYh(Njj7B>XvD!_} zM?(0+%w$%V#jWVJJW}arN4Z`;)R4yyjDz@&WAxqsqGvw-3|8^h7DZy&GjVh+hxexb zVfgTE;23;!B_>qa!swKd9BR}y*Cc;S>)V|zhe|rIz$`#I8X&Nb1;1F{Q|GpD`pLqRkM#I@H|3a2TBOd zEO}-xOLRa$Kj$SC>uko2OXc=)rFA+EYk~T6Bf8S_elEFXJsUE$=@>4DXxtPyE2+S} zsXPk=aYv?#HDAYek;HDq05OkpMOSF+D!UM#60^X_ot$+zoX0|XfP|J zpe<{Gn;7X}<)&MaLTzimi|*0VOH;m@fZqMSkFLDLStp7hjdWA{1yJnRisAr%WUJkD*Ni>}S8wfeddpT9TT|AOF4 zR{xpJcOmv=H>6@5X9g&PPRV&HSr&giEjeO%V-0Yr{GNj%Z##$IX>c5%zK#rYg+|qM zBf<&(p%@GT)J{Kz?JGpLdSWd6E6GA&xtmarJxh@$}+zzMy(?I-G zBU03qGe(u2k&_lQ%P3#3$;^pS==N}Nw<(kP;;0p-ESsyfBUDd$+j)CzjW%U8aerh` z8CocvqT%n*oG&mNhau+>%`${_pEB_OY?EboyqR(Yuj{T(f>`IxTKwGwKcT!FiuQK|jEVI#Gt}63en_Z^-`#G&es+%nZ|B7rsxPV74N%BJjV=@?Do`6cd zP6q7^6bS>x?SMq4SQU{zUOCcL{FRsnFEpHCqFWrlwIl`3SikqAUXE;d_QESUzyYtF zuW_P*oYgY)H&b%y{Fbi+&Ly8O9)JaUiBK5#+x@v5(ypdkqqmqB36Rq!$kJY`IIpcH ze$e=ksiSvF;sE@)WTt!N(l-D$$R$oQ;s0m>Qi(HRD&S=PfC975yErst&5`iHA>;k{DbeL?34UDQ)1!u$t zRrS!;HZZfUVaR+JgyyS#WS|h5e|+Xn2KIUt7v(6|-r>jjNQK#I#fi>(r-WN3MB%ls z7V)_FX6Wa$85>yw&sx%IV|Zy84gPcA-8(*eiN@P|yLIdZ)#3Lo4Ib-a{0^4-mf${H z*gBy>`~dNYFq;i)Z}M_EE0YPGk`}HJCuoc_Cu8}H@2T7=|F_>IoLY9hzH88x8+B|T z2QHpl&TuWv8ve)nQIDZ# zwZ7)Jg#Gt8anaMV4?>#(W@i6xor;21Y0?tvoyR6}H1^oz&roFyM|-g@pzFb$ z*_TJ+xCYi|ypSIQs1W#ThqGz>bEEe4F&0E-OVcIe=1Ouuk7dw{n_WL4f7|AK<3x1e z(37mHkWb2-QK5ctjU0RZvdsQ+4*<)0Plh%Xt0UNxYs_nAiQLGWiAi?Cm}+mYH*}F_ zbCJryQnB5f&r$FrA(e#Dm#p9H^7Zp8$tk3jX#!;7omHKp0WJN9$p_YVVGS4en?+4j ztUIu+$8LD6Ik#(wN7NlHpU-sij}@q&#<$@obp7g7g5FyJ*5l>8oZMyVh-UFp0$0^w zha?KSuSHp`qv4HdZ`bc4E<}s&^w{nm(&Kc6tlsh75_)UH&Y`We52O+3?TRSm?gXF< zcX^%v(1FZ@@Z4vDd9M@umVp$NA#71Yf@~H~Q(n9&lV)viyG#%%)ismpOqH z7eNa4Ijn{(AqLxwj;zJ;ZH7&Ne1Bg+agby5H>upbBT9&!k)ZSNrFHBbRs;eyPOQc5G;Mf_g`WPJ* z_n`sRFn}C{_`db-PRicK`;<&L!5+T-`Q@m(8O!P*#gQU#8|wik{Hk6Gs9bFfXM9mH zNq_HJ&aIq7Mmi5>)v_u`cyyW^Eh9VtZO;4l>Qo)f*oF1;y4`wL%s@fyr!ChV)8gv* zM|&Q0Kn7?V*5t>8OvN)B0?&YALWn2s=m4PC9|N)Krcoemk;!|hsU}pu9e^jWgTQOY z;23D=@3Q;r=p3;HA*piTQ7VWwevB(g1zAlL~1npg#e zjRmIm-$|j%VQiz6e9Hg*qIIC~2E82}ttso!X3tt}(>9${Xu@#;$N!R}la3aTc&zhlLZU9! zs67eIDK$z?b}w2WsR4Dmhz;4n1XE8%oErZMRK5-d5vE zKW#TCY@ydYM%S9SZ{4TJ{Ih3NSjvzl4YaO3y{bXGp&xr_d#%Emrh?a@HuiRB^M1#s za;sRc-L+39WXB_E;7hIx^-$1SGo|9ZfWc$3lVnkmUjq0O6u4M(`~T*BpL8rjxEMQ1 z+!dsxBmqtqgAMai#jUoN_HPRzUUq>l;oB$e3B?^-eNK;58XMTt!Db~0>G_R8y`{fs z0KHqHXD$2!_mUI&L=JlA-4`-HcfNeS1#Ko!K(+-qKvF9NN$v}f$i2cKwW7cebNXax z2E?yB-MCtCl3QNAJf0cnKQ70QA`KB7Hi)dpO6}7#f1!6ur6qXHdRNA_TG?^!7&bI8 zy7eudZD;Xc?OF_bYClZQ7>A(Hh@WoW!uTLN*8Dv5$xZ=TOy)cyRIc6FUz0*$j_Mg< z6!+qT?`1Q0sFc(ieuuc{W#XsiCHj#gE;#k~A`Y+m>6!{SHqWcIj>~JWQUj2|6+>Bh zxF4i}@LL%dlQM5mjRK8diN#7w%ujs$O|Gz^2Y6mCD1S|ZEHefn;eh*=Y z(m&Gz3sj94?Uo!lN+K}`RqdmelZD~RKwwY9y#N{ zkmKmai$p$QZ&-HeDdgwBS?%DWrcdwjjOiEEUgClrgPhISi(XhC>d2$detvS%!uzd02efcNQOfwXm=;_3CG;7X-c@-hj2W!Kj zA~qp1h8Px&_ZYi|GX77CeaCUSw}#Ad?ynBSOQ`+MkZ}^ifs9Cp9qnAg5pjw70ZdcR zw_R>J`|nGzLU$M5IRqIN#Udv2XaunQU5Fz~Ct?S<-AZF)rSx1U!$;V@B#{KpJ_uBu z*+}UBE6K0dBUyjo-`{li7rZNpD=XhZ7y4{Hd&u@A%EYLBQ>ZU56fa++cQYx%;34A` zc!K|0*|hTIdg#_oC!BKinWagZ+wO75jO;B3sxo!;n9pZ?AAG5{u6fvvb#n2mty>NS zExwN78ato25D(@@Pwu{N!d3ZiCnc8v*RXyv76cnGIpx~y?B+r_#KbE$bY}w!nDX>{ zFHD{|W+3xocG+E3?}^gx57*a!$`C)P`LcC!c2z2jzrm?~Yf){xP4{R?u&y+P5BX$E zRyJWtp%v~0a*lUnJp7f%B>(j#mdt6GwwL*HcvQsei#PX2FKSSICI?qeYO1#GtlOSB zU(GJ&ig=_Dk4vI;*t4S${Z5qI*^2eT%)k80{~&VXSBMy*S{c1SO9C~I@#afWRiHLZ z{Os8P-QKvkLWoiI69b7iYlh>So&H%2+&IZ(c=i_9eo#nVIttQ0x?GTRL5mL$Sn2c% z1s5&Nz8YAT441#icbk@*ht2B+0yBk4RhFHE*~(bw_!hl0A<712A~Dp-@W=>V6ag+x zPOK(uwRF7n>7P@MLtQofos+rx8c6-%$ZG1O*_`xSAZklo+b1!v|0Iy+-k>?DR&PZvItQ*Q3Y(tym+M z9oU`5`a-w@g^f<^Sj@*2B?+fd(X@Z}*`x2CA+!eis5wS~hBHcmRx~m^dH_d?oYgft zoMd{Z0OJ5;&;ZB+ZNzmsqJv%ElO;lyBnJ%7&|^lTrW7b^kgY$I^=Iwb5q+gkg=A*W z((`iebqz}uAA3$q>tf5Kn_#4QB9u|v2*rtIPNaX|J7#&gNwJnNx5vd0GexwN4gcbg zwl>H8kPqDR8~3R)X3T;~b{_bS(iEc_zbIVgUS5f8%MNZa56T<%n1HYqeeP9e%rDWl zXZQ|WQo(!42@d0mi!e}1uS9Zb5C--HiNkHU4}+T-;U-RIC zjbPD;#(?MWO`+Yjz8kOJ(zC!K{ZL}zuo#jb0rOUcaQ9-d6jy0P>5RVjm($x_8PGkr32vR-_{mq6IeDyzs$;rdUd2F$1b`vtYSM z9{BKtO79TXBk7oAL@YyIcRP(aeRP*o5(2#XZ? zbu=K(0_NTz2=5O!tN0T};1W`dfUx9c!^4UXYdGLGD4E20^Y}d1Gu44AqFp}AkuFOq z!g)JD)B8QibxT*&oyM+V{B1w#H-&8@S#VlGXLkC}E$8ca$}+wWEKPQ8BCMppxqxg= z>hFvd`^?37MeL)Aks&wCR zog^Z-QtcgIqr%CtO$Ztuu$(SURTykq4kfZrtTiB8vays#3QR0kw#Xcqh5(jI=V%J? zc7->yr^eTaFS@IuZVPX5LZ!aiM&GvNG{;NO6@;O;az$aiE%OrJ)`WI&Ky;8w3$JW= zp5WfJBx(L@9vZ@cWu6>`zDD0-UWjAhKCD@=)NNIsa58clqyeJU^8P~4UffjTF!*1R zxiGlJl}1LogHP9_b+EN>{6MqIt;G7p1uor>yO)`IiB~Aac0KS4{udvtJ#zhkAyylA zq|NS~RY}w=*Fmdei9u91F*8K8^pn@j&T)`H$Y|Y6z-Zy8%c;L_Dj8{__&zW6bH&aT~@b&sKsC=F7ZCLd0J7#Gl zM?Eq`TJpNF;xj|cFBOr_{vvO+ABD$2R09z*JM6OK2`jtJOL?}>dUfruILHQLpf~`m zJtc7Ifu3&!n&0V+@l>dvDDbV6OEFu*kyEhht}qIHu_h+yb9K67-2&#p){qQA>K>Ag zd}c47@nU7QDAYL|Y7AnwAdbN-uX>uD$Cv%4Vv03rjXZ<#B3%Ey2M;ewhchw?ZCo8j z>DvrMF;mx|-v3#{oPV4Xw1}iCNu=2j(J4L%jr$AfOnbOz7)a#MZrG~o`?(NuR4Vbt z*5-`}x)hTlqTq0zqckfbt*8Pga(sP?t5g`QLy(LR3D_}E5k7wUkC>VaFS65jX#sCe z6(@A&8+|al;xn>$4V>6%I5lm)*d#8f2P&OulDIaej%)4><%gGvm5JI zp#4&UM8BsCKH#f;;d&KRH(lJ5N+43z@E4=z|0C)x{F?CIuwl9zDQTn|L0UpeL20E+ zS{kHdjBXT3X;6{wj*ae6BnONd-L(N@y!-y%&+|Ng!#Vdk_kG=0JU*X&R(M|FNEV*x zf@5a66vh|0wygiEYfdd!E~wYh1Kwuk-SUZ#AjMm@E_2I&*%^juPJ#WHwl@HN88x7f z6&h@Cxu%1!{_l32Qi}%6iI&@y|oVtQ?4Z9s&xkp5tJrOLtrUXBZ6zznDU{w4-EsL zkl@T5-lcnCrjjIai6P^pp`lOxlu9{@A9PBT+(umM z+huO7*-CAL9~y^B$g7rNiWr`&Ql6DheM{bWp^kQh9h{9ZAbkhy-<2bOPhhju;_Gg8 zF2ccP=q?%`>58*7SOnNC!j0T+(|KiW|5Ff)V;fVjkm<2yR_=u?+t71@s0pDeLm5VO z5)!wqcaNjyM#9k)2=Nw*<4s{41)4iyy!o4YSRVT(rvlHDRBG{b99$USS_9s^?RQs5 z(@i1yF-wp&JD_PctZ@+cUvJ3q#86wG6{l5hqU3q$*bkTJj_XN3-Z;{P9^}bA)Cx1tK5RuqR1@?Q&SNwo6T`w6JFWZFd$p zhiYIR!=S=OkAbjNC|$NMYN_aW4qM?A$tF*l4f(b5{M)SvA=K}p%%a~-2Y>m_N*JR+ z4*}t1VIx|^ZJ4(rhDwEO{Rruqy1T9p+lHU_e;oj+t47rv{*ele2Jx9FzEyMkbn~?u z+Q&YIc-4FG?EJ`h^7={B&UYB0ldkDipvV?+zfF-*D8$4y@6X-8B_@MYuREEaxAPZV z0U&`P)o@vHZEO}o3*WX>I?PM4oO@hln=rAfX_J*TDTJItoA2*3IOU^e#QsE4k}+k7 zw=VD|FiB)Z{sp#Z0wyyB`)SPryETlSmV2Y3AAOL90Go83d^2G@bsWk9gu=B-ytePF z^>oX;_kW8$D8eGBu*y_PXuD~G$e%)|vS^gvU0>+EZEL87ZZa$en&e2{Xy9t)5rCa{!MkHI46s_9evgf{J9hvq! zDYNi#eGG8G1w6jv#t8d?@K+{6J4&3X9MX}Y0cS?=dnd>rODB#@sWcrWDV)n~#jb-^ z=b6yYrkhr7c>IG@s85t$CkY92ABf#NIjU%Ne>d+1;hOD50C7Nau8zOF)He+ro!)j2 z@9(DXn2Z~&Kh(4-fo1ofB=RJLJK_eq{@bnBTV=Ov=V7#>e*Y6Q_}oKay;Bb3E5{dW z*5AzS^oXAiJtlQYwAb~wsBVQ*C`jKVlYBI1Yua1jzQ)q8o8EYprBA6G>;0WB;pJoK z1vT9PU1Xf(A0nWEW|slbBRY&(c&q2YG*wGXBogPN2WI5|4wFb%l|$C`e`9dogsSE?8dMg7PU@2JGu$7^a87-EnqhZRS?%O*nBe#pJ?3gjes58}#QTvF ztL7Fr3&0KBGq3Ht?l|7OcCbN@!lJoUIA{bi>i9-OQ=gSTGtt6&NOoTiv;}{ww+Vd> zsSxkou~;*v$fLwA`)6cWKK*#NT`f3~sCAq0CEKo3(<2kE3g+B5*a4}8<7rC_ME5X{{|e z$^RVL>kPh;?G8U~vwi;cBQ^U$r5T2=NDtkstBe<}bp4Y%m+o8Btt=HveHBjjYh;_y zJq0p^w+FT0hgKD8?AfP}jJ)I&CTjuIDFy>@k)KytbPc9BZpL^KPwrXmnzWx$WA`ts zQ1HGl);~u^f%(4D9%ealyXkKK`J~8xcFGFb1^vOj{u20IIgODE2+bTCMnAvJ4D8#z zD8rD#-PhWs>dePYR&1nk2JOEbpGuy;ms0q?*E*>Zo2l{bF*nQeKx82Tdyj-m#e;MxUwDbqi-7 zcDQjd#R#3J_;Gkj3;T(K7Q4ow@PCHEPogLOsAf=+p{;j8$m>EyUf6>&KS9QJ_g8`_ zFjZ&A^TOSLi&U9XgC@VPy4F25D1zB2%5u7H55qy3BXDHOnvh=6@z@ z&^%^Ra{aztQRrbdTa9}zI5x3ql?loXbv5g=A{$tx@b$*tVxKdor&=+B;Sy?A(>b++ zC}^m=`XG}mw#h|2(e^ggA;QEKdc;&#$I&sGeZ^Ogdx^BBYOwuV3cv6@%-0>ckgbj!*Y z!HdD|>-I!N5jr7D34z3+r9#;H1bI~KN=?S=3(l&^X!FIw=$x;;F0~9vF-ioknm{h( z%a3Ta)do%#jA6)j&Z6%{!I@G2`J{&Yb(Sr0PEB46H!6du?jZ2O?ei9dXo1gXpod=PbGLDoQ1mxNy3wG^8IGUB~6 z);br;!pV9sx~6v@BtC@e-VPYZ7Hf>#_y)&I*k;_7Jm5wB|dKoT?2 zuU(I`{|zYN7+QHkUTHzQGe|{bhSAyEDT>P-7#Dp)lgEH7h)Slci)4K{M<;*TJ0?ZZFS3;Y2yRUsK}pTpSUR)~O>9CP zf+OU*-tM+K#XZmbz4vm5!=`z#?-ijIZ`B~tzaV<wl|C{*v+4yfw_ytVDw_CyYvoTA#?)iE?=> zYCip92#_VCi4D8N`ts~yk|O|frAeZvMDt>ed+#EDDH%5@I6NIl(WX64jhzVDyl|t3 z6)yMO!aR^cIxt8}3yDTzoB|vlOLb^79$f}A#UT|pTRGI|0{53A zj|Mol5!5zGicEtHZ}&&Eat$G3u6sxNR4*Ywgpv2_0Qf2UnH(CnTH;(=0Mw4td_U&y zezQi68TrFeG5`3{LVAx}cEGar7c-|Dc&za>SS$*h;RfqxEL|)U(B;1Aly^aB_2kN^`MR@qS#aYGW&Ku=37s+x0b^f{=wyISL#* zK5_@QPB|2)cp}f>{JbOROFeNmJtOjga_}}-_ajh)2HWZw>?X!)_+{5r>B?Mj|6M8% zlKDTt`PW^Mtg%FNQlmnUNxgyUKzV2SX-*&1AS}`V!0t>Olq9~l30;0zM)F>;Vtxs; z+I(e^RpgFMXY@w6@q*JnQ%JLbD5nC-w4ko>b!uPM-nD$pxiN;nnt=tK4l^Shf0%Av zGz$PN+=l7pTixV-9R!)(=ma;?*or4aUf&bkhMJu#jBwd{h}HQiY5@4pm$RvM>x zsPKReg_L?bjSq)D5jXYzR+s2zm;yVP5GWJzPw3CEO{YBklyQdd23^7$I3a=zT-||+ z7SGvkwoVapUZ-)WksVDs=8)7!tuPn-zgOc7$!*JoR*!^S}jRkl>*}7Dh@r zsu9#eIV9=ju0TKD0xB-dluUo?>bvCH)fYCS@l@r-!1u_I^X(4*LEcE);%B@*SK=C; zHS>S0PFQ2{yVABapxKtl36nkiz=z?Z(=rjO6xK#sKav$%EsXO1Z>nJO-<9^)D{ZVZ zI>a~YC!{XsDOB6lK$kOQ@<=TjqsH^x4)JdgM_Q(p(>{c}u~LVrOEFOa;A$HTRu)zXI#O z<=Wn(cxbQG##&iAD)w$JDN#=o!V>8)yDX%YBi_ZFOZ#SBP_pFN3A0d`o2Gb##hhii z80EK=^df)?Iuhg0oc@_+Lb~6%?qH(zJO$CoB+ZTsu4RvFdRBamwf@H6>O)h+vdpH& zEi!APPhWO57+QW2P-=suf2D*rPP!g2WG1TU%&{wWs_v3`6utYu8^{E`SVBPs_O#?a=xzhCPY3Z}llxq&X} z6X$scT+hyZnUgBY8x@de4P0&p>tG?A`+q*a^DIS+q=d)uG`ABQaY?Q7OXP-*S)%d?Y9v3rl=2;Zl5WV1xV&ysv&2jA=A zuok02DaWhbLfNerlE}k{g6|^<;l-F$p^3DgKTi~I$Z<+uy^|ldr_{;Tp|F=0&ei>B9Yul2Li!>^ zcH)bOYvv%Ab#M4_gm2Hl|KMwtdwwhK01RnTS;#>X)KyOz)_NAmz@vm8i4Wpf= zMTN<@W0P}o(ETV&dhb$i@ILDOB%kh^k#Ar0HcPCAPkTMbIX6C@Gt(Bmw-N25t(R~^vx2#Lr;zF%{ILDsV95gx`eg+eS1>np*in{?#CaF*Jc! zmiEk1FV{D!a;EJ(1e|4u!ztb~^H#n~fMw7qs8x^rp4&}irA?I_XZl7E5>#{63JOtNYU5h}*{=G2}4RZwaa|wKvzv3!ZmUv3wM}m%mtEqsBA4)s+u5e?_q=vEHWe zVX%o~ofzxiCE;WUzPtIvzcBGRSk$x>YeO5Bys!{57 zWEKC2O8wofl)jK~I-o|2xvSX#lTi-$VZECkYu)Q=Qj+y%l%V2RrkeKh>^f$RXPWbH zFT+a2rbzv`{_HE+#ky(UJCROeMe8nn9+KZS_bB`U$EF$6vIot;ti7!1QR;{J_JFv7 zOPDCSMb5R9vIJbJ3ut}Qp8>z1v^HVmuDi6rw?AUgdAkxcvdnPh>T0K}INoxg$e^~7 zk4iKL6y5pcqYlR>n@3+hNCBATpl3UHrL)7B=B7aP%3mwLd8m9@WQX>R;jf6^MqPR$iVHn z^uA|~HnK8uDG}`jH0Y6ew@x#rv+QOkH{=znT3FZ(0a*^Chg-J4i!vPl%x#Ucb+63{ zu;Z=Xb_AL8mdtPYObNckn)}s`69dCDM}?3h4(9P~0mu zLzAx|tu0R~*;6kDgnVeQouG~-z^ahMHAlMQ_Lxe_2Av^ zhSFEQ{G)sAlN9)&VW?h}$i+kgaE|7VL z0kD?v@Y%aYDA5wWW115@mhyi5m}5Z)e~k}`zmOHF;`_0S(6<*$&V+3?i1M4(Uz#$R}bdJ}UWq zNG_aE^P4v^^gzjMyXbDhf@DJQtbO_uk*$m!W($4#C()DKN|CxlV%9&WS=6sxMUXGh z%r-;6%I05#s88R%Isco`Se0fV_n=}W{~FN4MAm2J&TiT}pEDf)3zGbHs7-cS$F@eis&m^o5Z|1i<9b!TXb1>Yo z)@zcx20&_`13*W_LkW&ai(E@12Y*jj%2a_I{3zU@^eb1MuHzdfW-WwVrBD|@BiHuX zv1Aaq8^UdzuKBzC?IhH}V&fTd75w9{3HtgKe)yh| z^%`~vxO<~{1`d@~CyZU-R|T=t zeOCDC!b}T;HMC>!@FuL&e(ZTRuW`$+D;r+e`=DH6Bo}7@}~*MmcJ=cWfsTt?up$TDZda;4z*28z+nPiy46oY1=%fBpoYHiEP8RIC8qu)ndrrJuPZ^?W`W zk{E$|a5m8=o!Au|{#=hBrz?3WL$e}?0EzqJbf;Non^tKE12FM;q%cmjL*=Yb z?E-apLB0&;{P~S@D8Um?4qd*^Vfn$HHJjRmRfQk7KYDw?1S@qY$K`69&WEpQpC?Do zqh;w8PtLlha)(FIpF>@k^Tbcp1Pb1ae%PwyY)ZIBDkH*-pH1wHD^i`LYBl)ZQKXFy zt^%r3zC+?V`sh}SIQ)Rs8TAZb=+S}%IVtkH^G9k`R25{18k2_u-bvyHwcoIEFv~S0 zll^RKRRGttK7ZhpoxlOJKlO|U=oGypWDlCcOE!_R%hRXn>Pfh0_@d7*&!tZLc*82y z4JnU(;6h#3MP48CUb>#1_u<(#W~87lGhaGYOXMl4GQ1{Md9`^e=8$+B)%!JK&N^UC zKyn1TZ0{lc@5nPMd`rfpRk+I=ZycnQ44p$COk#c4$voO8uLFpeZHDg|v5w|3_Aa%m zo?Bzf&^7^JirX-%n#QcDqD~c0(|0LA6hl7Xu3&wBe2#gF# ztVCe^pBFQd+A9t750xW>f)XVu+)Pm7TWXA*F@ln}_)&h+U0!p-~GNtqQhP;qwdHMwXzfQbE%h_>b(W?N8R3CL@(ePz%2=gAb z)z~TlTE?|#sw$opF}4oWH>q|UH@{C|BiivO|2GJ(3LV6Tt%ZFz0Giye2Lfb%lws{g zgN>*(*Cefjo2Kr6p>C(|f0rRupTEgz4~#RrJZ+jdSA(H4mXrvXt|Y9>yPqnDSp_M8 zanT3)i4XvycdmCzIDUVXC>Hr)|Cvw~xrD=U9Smh{elF6}B^mm@urdp=&`&mHR5H<6 zzmow34A{^YXG93bc_kQA(Kcr#Yw&}kTCbUhF72IJq*GK253oNobu1Sve(3xMFfIQe858_p)T;;BD-Z8Q0?&PgPEvo@88-0%!I(l zF>kSFKnjKUZNx?1>s@N>vd;w8*fbqX0oQ_hXEc-xZ~Tl)paTE(L6+fXM!F1%ccn7p zA(wGsdgfMSjvKX{tiI+@khe$J{_hA^a4XSmQGZXyj^R3ShR@nV*>=leGQV?s_wq+;=Rlj_gNdp6Wi{BY7jjLn z30!0qCcI}DL6hg88&X&p?ti%9nY`1+?c+|&=tdV1=@M(E!%C$MnSn3GiG0+fOlGj_MQ%!?I!Q}2)I=#MzD;E z)Mk9vIK%^h9DC1SAy7X(;ATx5GIp!zc!!mJX#8sQOmzSze8$WV5*nSf7AB7^O!wF?`G^y zVhd5ZsjTV8OEif*o_Jv|15WYN7UxY_Mmp@aE|a?8lWM8(6A1bDKzf>RkO(dXw$<~b z5PnZR0&{ku({3^N^Z4+S>E}en&50}iFc=gtu*reLJ-?)%J+`r%BtUyA#+1LuR6!+D42*2_XeKbuHpEW3da7)A$UDrZof1q)A#Ap1L# zq#IioF;C5xIK4vH7h=nR=^%APVi*Xi^sJ>1>X;B_zY^ZYTa>MaE#a7>!+qzr^6}Zz zh0HX~t4bmKqfk+wt*|#Y!V6u{*WtA0@fR4xdYWOKYl~8wmRaD+&^IBRtUu3a3NrF{ z>k1y;;&uuqDMU^V_qJExgWw2_B{t$NQleXQYS>qN=Y>Bzj4(KULb8v}EdY3t;x*RI zs4mBq4Wf&p!7jXzJ)L}W$+F9|Uk*O*{)M!3i0&X*LSI|ju9IF|oV;LxS@DxdVedR31hy(oVE2faL_jzR}YO;9Sm z$VI?oXE)`F3e_)IO<1>{Hpiw4o!7ER$k`?W+?E?k*ZuzyS^)7s$c%=4`($H7c17A? zT4F7^6IQLw$NrLSotPA3E15zb{oclss|Jyur1})roP*W!#3}roeJ@bK4nVJcf+A%@$*&J{?>Q-^6TT$ zh`GS*EkWc~*B^E46MWsa5nR7YncfgBguuqn<$i;jXIJq` zjaBY%ARWEG+lJIgRs3+vO=6Yg#OgSmW}96;&H!iuVp&s>8XSCKsJ$-*{8$c`4zmZ* zV2EM|L7RDsUjgSx?9K?)i4!s)T!3DE32U8gx?4OU`n%LChC^faV4A4$zY>==0kofU zT>tU97QHTb5;Fo?yW+Dx4Qpuyuoh_{EAb~&*2;D%P|L~3YgxBKkCLcjGO=^5fA%ppcXlI&KguYR}Pd# z6HRYrZ1eediqlIo)aPm6ior4;z9qS7!LnGmZTQgqGUt6aj7xDF2~yXAFes-^L&3BDe-9;(EGxdvnH?lu?uN)S*|A^2J} z7h7qd!WJ38MyEF(tu$?oQ0VPE2E+b%Ru3QEd<@R{{RCQq0Gh~KW?NrUu>U1<{S=JV zu~u?-vidrXyp;~yN{9mi2(S?GdosR**fS4ggEP93ne)s*ZMUtm~z)!HF z*P?$hZ1(Q{Os0zG9b!uqu*&~N|1i-xsIFQg#I-~IX=|Kg za+=|EcYJ6QsvdznzByPtTwOT1vI?31+vxreZCv>PvI*S@V@9ekTy_2r#zi~Cbbz|t zG7nN!3ogjzVjD)2066u2p)Q=(o?kD%Lv9VWult&lb}{W9rVc4tTP#pBC+~{EP~x#f z;OKi9yS-5Uy0@yxyX{qU#p0GMb$PhI8BbWdETj4ar)`EQgnXx1MBaDrQ67xaFq*~1 zfbRQ}phqPa96iT&?abQPYnNO$mYnzyV6dVQ-aR`$aA(_2YF23SNZ||MJKU zJ*w9ieAsOcx@uJqIZayQkVrb73z|7l%o3SsP30I2>4T;Rp`(?(J|=|9<-VjJcDGII zq2lOkiYZ}@`OS(O8tRq6okyZ_^#E&3UGITDE(5GeH&?qcEHr@s>qY|0lw_adBWnSW5E*hA%3I^L#u!}~;K2cq^A_)<~ z#VUwcXZo2(d%5}}gMTg8yec5wg-tSvZX%Wz<&cQa+i0(7I$-=oIwwYG8Jzl!Qs!-^ zAYK~zVDoS!9E}Rfv_({1+MA(SRG1TVEk}h{M`rvYEXtRv<*VqD1vk{^qlOy|Mx(+$ z(CIu@@8~fYavd%`8s-izuDrz?zl&>=TFyIxlGEUt4A!*eB_-6k=?=AC-TAL=blWyT z`ga+Huk)21%(ypGfQQb5@Q1`dYQ4juc_RM1S^g-61rgY}xwSrOe8?cx0Qe%IJ9w?{>BRuE{l1+!Tzfyzcz7OTq8a+2xJK3s1%88UEG; znH&T@fZj|*S7AtpsC-dKNlNvi3wk)qooBR^KjH&>B%LrGS>3-PNXo zn$Dd7WSlXnzOJ{>AD#;wp=~GNrxXK0r@8>@%ltd7!RDUY%003(p)vk5jGLSzY71on zo|o1*4-Bb;!-yRhX8H!^Y^$tFX;dTyJ@0qbgf=ea_+h`lIP_~vq93ha>r$0lCL4^W zhOiceEM0tFPd}MHtYDM=X0aVoi$d{9qbnquHF*D z$UaC3P|h|Dd&WdltF?^tv1^zJy}S!kpccQl)u2UXdO|^GsdHn;@Q8MJHH2qRrml<8niMjmRUQJ}W%XqjU5JS%kp6ka;Q-DoZr(Rt zUtJs3kRe5kMQ<`<@?d%*G#eFSk_bU+mWVY6n-l9fAFE^}2gcHCalh5qJwHwlQMs$; zNqoG?_KEJh&YM<8+hP~yZwILlq;WW2W;YmfY($G$x9{f;&-JlwDczdBd@V$neHfY( z5qPJa62v&MPrZ@FuoDn-)~aKHhuHWz;uIIonn)R)T|;mY`ePH+=np-*)-?S~`+v9q zjLeb`vmVL3wbSC-4?j1V=smMFS^=IL45svzn_VF;F8F3M*y=OB+?U7GEDoMT@n&(h z#>}Q9UCbyYTs97f3S)YkxGVnd5!$Vyg<0R*PyODv|b}{LWhIjdSUnp&zD|b zAC<*VTa5*R7vS>+5!S~&5MdL0LZBkU55?uOrOvdIL+0J$T>3UWwvKnvBc^t#Zx-3+ zmb*h7L?`|E579~~^s%?P=RNmoYyGE%(`Bop1_%l)#1ot}+fwmX9{})?>i3Qgf_g;4 zRj#B7Z=G|ELA~0TC-rZ_qe7ew*swaqj$cAOj;>BTtnN>N(kVshr~mr^p21;Wch30k zD;-z1WxdegDU)pGYOgkV&t6tkvA)cWb&ujq=U395K%E`7Y&t*XZql8rM8`v-!%$gB z_TKx#_T~CnY;URiBg|lp_c-#1yvZlh(=Vn%>X&Ph%39yG?Q+Z40pbBJ()f5t<{mX0 zmLb~07Q?)p2?>QDaNPSdbprxH;~o?I7$(ry?{UEBUjO$~Q8ZqcZNgzK4kw*}%eyLV;45i98xYLESy*@GmCB|QLQc|>>pE1vU@0`>S=OVE zX$7j~?#RGOphH5GUqW20P?0VkQf3rc@6ai{ zQ|d3s7mMvbFQO5v-#3_BvI|PiB(>W?nJURr%W9*i6qe~eoOv>e}&SA^(iCY z+Jmm&dIw_3FF;aYJnBNrn2{Nm%oRN>x8IKb%?c)rFyP0@%#2Ab*~Cjv9rC-!o*>`p zPUXek5Gk5)cuK4%JhR3)i{R}est+jFr~fST5=WJzfG`R)i2Q+an^yeS@M4w^uJCE; zCp;lATr5(8a!D2)zk&CPg_HF`CNj0W3esXClr^sZ+e+BOmRwjSofeornceU}%2l2V{T{(0$`&=I40|z79vBaRydyVJ6=i5w{_x*VA4=0;iULmo__Y6IZ z(*wy8)3f1}w`N^(>Z{Pz!*i6qN31E=*OhBB?d49sO1HAeSW?)PF{kEwHL?PL#@zic#(Z*V_rBbu!Ywr zr%<@!7X|Bd| z2H(3{g;a-==!{^rVl#1pSjup}m%3>*r0u-D-7PoP&D^^7uo)-Y&o=kLoF^d=gbIK1 z_<>5a%{0ezT5*-dH9Hhee6$7(RCJALG;77YFK%;tD|RL#Vn9+wfo0{CcM(Vkoc_>O z!M12=o6_{Es=jhx>wQ7(MhAs-5`lEHxJkyw{l@yeN!huDW8pMC^N(u_YUuRYXa z*X(22-%O*c}@m z;;4b=)&q9ZHrxN#io2lBn@SVa#qX;RWZc5~sm3fRJoU<+)WjZI7ESBra+x!VD)Gtj zk+M_rkq*+bCkrU`HnD74O}AVU+*K?qh9m~P81QpFX}bIfCcFCdB>aOyNBA5^_%ky{ zm^1iY7~2%mh`8@-3;sG*G#KC1T$eNV(3fpdJ62VV0$U{%MxP`|gA+f?k{)p3qzp*y70COfNvtNxr%@^y4>vcUJw|OWb!d zX1@dy0bC(hyD9JkS2Tb!q@w*O#IC~!SrFK<`L@3x%J1rbPY?RJTY5eQx9UHBBOVUG zcR#gHKl*+u@~OQA_0hV=80IEqh!#+V;xXNQXrDE{NZ`{bqu&-B*rrfJ}5XBt=M zz?#tXf~O_H1Rq_Qd`VMOpXd1ar^}c93c3O!Sdbg-X&F*u!(VSvKepEwM|g7gpeE|W|YOff#629{(!ct!o>OBO+8*d!@@ zS3*=Ku9{%jH1Ae{iKD8+g-6>eN4>0>d5!R1KVjN_z)ytT8V%&Y?uu!$pNp4t-!F5l z$(fN~RWb@Ky2#^%7|RyoF_}6tc6bue|EqNL+1P`IXsvLvdZJ*_B$16|I; zzxmR2iUTRkdA!I>&=dCQEYRmewUGda-kFroR*z@^jVc}1k}QJ=*^wHE4}Fydws0QS z3y@-XxZe$$@hy1YUInSN7qB7SzC5}QQa|pnuaI+d*Kqs1e1NB_>T2qDug&D>>IL2W zYwMYQAH(n1`Jl h>S!?u_r3FB6OYi}x2U!2~JqA3!uU0*Fh(gK6v*(!b)bgYy>@ ze|vGM9WqBckPH5evA4!R>L)-de-cLcND75n>x~D8q}-qdUN>bawz*t*VO;0s;Es!n z%lFY>8vT9L#?9!Ug`U~*&(=8K>nm!kLRGL;#CMPmt`Z&X3!69R1zk_+ou&uCo; zxt{j2gjbbj3H31dum(@|Ur6REA#$lIDcHy4*kW8;d4!`nY?y$ebZKd+okYjvm8ABv z*(K}smi5HOEN1;}jdWxcMU}nhRX+!)P$${lVZ``Rv^_&Pjw(_H#42=Q>>QbLHZzUP zw=L(J(67i581uuK(1GLWskO_x0We;V|LWqHk01Cf=N~~{0I&>`&ds`<7)gYtHe#F( zRbr1>y@$y%`F1g9vtfSMWRWmhCJXt9{)}}famvzDEw=EAdg7nLd$DXVe?I+@Gw5tn zr+q)z$3Fxfb5u8;UX$_tU!&EB28u`VUn`wudw;=Ezq*YxopaEaI8b3yZ+y^J+C~h{5{b66Po7x{VR9^j;}(3>Df#-6#q8m_B>dS zF00!gc(AztWIa2qU!|LjIiyasUxPT}WEI|hlAc^lV9#uLH>qBC zQSrAZ9xDC&Up|2slzG}!VV&Xq<^vb47(TY!=fy&~ud5?ph4;8&-4_c~FnWa(P4QEK zyt58?+%+f6-zrNdh9tcv3ex}XIadMd>3US?!h=RlhE$J;Ji)e-B{gv;7Ve=yd^4Ex<3|dpy@O5B&{9Cjc?4nn7@(K1hc2Nb@@qatp4`&=Q)t=yrmZcZl zV_X&~-!+zuD3X>JWTr6JK3czHzR7P{fN9Py3Y6>MhQ&}I0y5I3F=)Ksy{x`J%|!Wa z2;%IV`OG#9c0|49u;lk<;4j1S=nK@^#FruawNyT1gdq<+Yu)OB8xm0eI1t2gcS}zW zpRrv(OW)%co(BI~y>pw=J3GWKRNgVsAUDfo-Srzlt3^1Ovx;{su+{m>q*&&JZD`eq zCFHf(y81m+{Y{G`0dokKjH0q>;nP3XQ%f>JuQ!nYC+{v#?PZ99Kd% zf{MNydqMv=2uorom@>H`+TbM=e;Wp{n~$x=D2)p<;7_!+4q-bBypIo~Su&Ryyr0g9 zSj-Y5f>!d*q_d6PlkIj310XxwN(a(zKV5F+D@id)6(;vVZ=c)cpw|)w#$}Ib%IFO~ zUz($WPn+b%A#G#W$Nw6sn^SmT#FNK0>Y`oirIluEL6rTMYf}*^fc%%d;$$YS3;Zcf zzZnoVHw;1s=#o$+g6Mm3n~;QvHbsF0JFHmlENkajf)ex2_rqT;Obj1(YTZGiJ1OXe zs$l=Fb2Gohn|=7iP_Z3t00eDi+vDsu&O@zBN(wRB7RR&@i7K!`;kc|rI6T5ID*mt5 zmXlLzB+B=WCrlGvj8tp&zemU^!&+t}9jMW1SxBxh!$7JJW`YxhQvygP(Z#KNGD~G| zsV|nzFi1On53caecV#>2*51ny_pnt~kWQh5@ZJ3Nnv_rT1AXv6zMouJ+U1P|ZBh~U zpF|%GJKu;}T?!|Zy-Xm8N>{gf!kb#X%7x0npk>p&y}4^V_kT@wXt>T_xZe5vbathn z;wUf^$OPFKF0NkVt%gUO9QQxLc9fkM8}7il&U^myH3^a(>D|NG<%QeJcUu$nPMbJP zvLM95*!sIDqD7m_W zb0*E;_RXVI(PQTFO=9XL@|OZS!^vD%K%=GAo1r5vBK6@tG}d?35$5R{i`2d+|NhWv zW!cxWovG8iXAWkd_&QIZ;elDhlW>3mHNhh8P@b>dO_?k&G1{vPutO+HoHcT*dgsm=g!LQR)H8bX`i^ z%3foL&%J(2isuwK_X)sSKB874pt+2suwa|9eA!zx4WBZk)%qbTO1yP6prGIUMz%2% zx+g@W?MxV{b%s#5yNpM_tIQHSY6NuQ{}pENbkwjQRm*keX2xGd^CgaRLz$6R1!4oB zYO(c)lei|MP49B*S%QWt=x&`|ahjO10Cs0cZk;yoy(fC?8TCXHY>fQTnJ*tfwsv+9 z+A6J%LR95;x$>ngzUa9}zwYC0BEC11u`s*tla*fyUb1!ShPjefXwLY`?t^R$JtD&# zohS)oCjycW{O!K??(xel0nzD>ytrJF7YY<-9SA5C8w(BvPrO*6V%T1r4txClx|D{|A*D!52?8Q9I;6Wp z8U}1MNcUhcp8Nm2@AGk=e>>+s=Q>vyemH@V%*s)8_t##83;IrS>bT#%ZPENSj^@4n z;yGXlfmnM5uVn$tbK%(EHw%$?UWO>8YmW(6T zmE}yrwQKz;@!P0OmGF=gM*g#K0yIGrC7jgN+(na!d8+{cHq+X)_>P8=Yw;^TwU^whE9BTfO^wqp!)A@b zIm*$&9qJF+wy?5F`05;Q$spq?=4Z=!G)t$B7*&J?$lKi$q0o+i9TCnf@|lsV?3*hU z2Eu}NWfxL?%zkxL%HxoYxN0eZ^xnN@sgA&+{faMt+^Kxt1;iG1)|_EJmx>J&P_mK$ zqo<3VuOv3QN{~-a>X>iT1dMo4W2#Y}WFtm=&M<0#3qdxwNjr>30ZZ58&8M*OJ@qF7 zH77}>02iZ8bl2$|pZEP=;tvxd`7FX|zUqX~0NzuQr&jl9{dUivv(r~oqf(|tR03~A zAp;L@LR4Qm+0<{ycJu1T9U!#qaqI^hM@Qgy&l~r>SA3Al#yBbb3VA3b17H9r+>?iL z2FvCb980?}glnxYB=3^+ADF$7goP(w9JD^?El)%=J(_QmcoEWanrvGrA<4WGmG3hXX*#6g0e+Xo8g9Rux9Q09*M+1(L- zUwj9y3Cbu)%4*bIK7V!;>MVDWAaeEJ$^syceVv>5VD>cZ#H@pP#*5$n)Jlaf1_v0A z3WC>ubT7xoJ}kE@sH~9f#{e(u+V?29tEae@ugydge6aQyQ%g;odDLe}%tOPSmEwUVFBQ1*9;6M@>8 zcXRpY98^|4)%fTOI41#zGhmLN+gk^hFsA_Pm*WEpNy>1Cs_h6?krO&vD1KYI>wKeP z&c$EUpKS^jXkmJ3h&B)ElOOfGPA%2eoN#epEIOu3${BZ3uzMij8-v+yJla@3p+}X7a_$`}qFF@gB)`!K~NxMIg`t@ZSNxB2ki!j1L zrIW@3J9!vQN2fX1bSE1D1!Em5+6U>(!Y$9(3xs4A$mjEqn1ZgH(N9sxP(- z_r;01Hz-_aBp*n*cnkEzas8UBixasOU4F9gE2j1&i|>?mLDxwlxizT|cert$gTlPi zWy5v<#D(E$Me>zmXI#IJIGTNPXG**ZDM2;AL(GN4Q-2j&L0V+9xe>8>JxXbpQleK;orDyZmlZdoyvLhG{p>U*X`?!A zO#pBF;$Z_bF$4g|lkygt~$2jE0 zlQo>&ocs5iRBu5+4f^48zI4y40j2x>yI1p`b`ztoyLq}qZd3blu?c9(&umky{YNqqBU98R`emIT0wKXf{MtlT1vaNT+>}GQMfafX?Pe@gl z@C(?^&t|N6Y36E|o)8HFZ2VH89CgS#ZxSKAj*MJWv$S$Ne6#;A4b5~ zxl1K%ViXU0x8QAAK=+d)?xW;sM{KFK&TUGCgl~s-yUr0GFYJZg8pGTt2q?^23{+jK zNZi3rjb^GvN%Orlh4l|DVkB;B6%Z{}`@`kB)_f)|*2u9Z6aNExLmwEd?Nm*TQ3%08 z%N|#;4a5wU$zS(3XU!5Ad0xWu>jFI5_Dia}`k%q9jC@G4=MDS($kGuXloXJl6n&K6 zqLE)KMWusdk7LN}&chfCn$L)0_L#PMAs78v>h(c z_?BO`#d4vJT6W*ot=djDd@!rw8G}kYo=mb``-UL9Key47|ImzU2@*Px z*Fuc5lajst{08Q~rDUZ6P4jTm*S{GuP@PY&m9aT!rvU)4%^JuVRdNtS5Cg##N6>k3cTiNEMx}Hd;%kP-=gg^1@?`|7k_CK8sNRGVS*~R$1MizzB>JOFb@^tyrtGr5`=;auEN{|d zsf6PXrE-?#tHc`d2aMlD$(*rBqjS-%o!gMQQ~+ThB-Ji>?N}Q?5_^>+XNw1hWjgo+ z4VU}UIbP!A!zi;t*N4cVlAbY#y13BZxzfiAX#;P*Ma*(Gw%g=af}~IWh93uZT|7uI z{KSscLg-p)W2=I~UUa{CvCQ}bF#P4@a#3-LKn0xb`U@P5?0rlHvmA`>{C+PXCp~2Y zPiXOI<6@v;hpYLI#E0uk5l?X7C&l0E^H%NAsG!3!LEtDVp_$;!GrYnsyQZb;59)-w zrQ_+RP3T!B@vf>VyKK<~-Xr;$(4*uh^0=R}RQB`Qv{7zY<_y0M$VFQeN*~{R#%kIB zKQ6%C&-Ct!WB?6$sG@Om=?71B%LbLWZcB|p=D$ol1AzVVP{ae;uDbQ_9v$bD}l z)InS7H)%5uM#q;;XjSCqM6vFy(GMNyLrNr0Hi{GDIqCg$Bc`Cl)z1=Hsze=KH#+){ zBZN^drOHqCwUq~XDn%w=Ho!5TnGjQ~BX^~II-yTY6aIO}T z@I6(&WZ_)TF->vx#4X#MR)zzVGy_wvy+(@qZetti748hqQWT9mi|bcBBfT@KJ-eKR zC%*2~7Zlpq&rMa4c~szzVB*6;ZfLabPw>ZWpoocS$ZX)zlC%QZNN0Ba;5KfF;=7A; zOJiUzR<2rR;g-*>=GP;y>O!Ewy)jfeg?sG}a>CsEjV-w|<|0N!W|( ze6OD(gL_fP>;WZF+{cNShL_fDq6ouHTlL}h zR8YQDEB@XobVrF{IYVqgtrw^Jo%brVt(kJai(DcW=i!p)((+&L(M712n*@O>LN>5> zNvoE%OtLP5ew++X0d5sSkf)DlS-0cPZLirXon>JMDgPcyOGz_%F+!j$&(SQ-Ylkn| ziEjz*OEijZ>)Z80%~&KXtH2q$8DS}nU;oywzNZUW()%;Z-j45dC^i}A{9)F)n*vQ> z-JRvqTl*1_lc}tGYAM+tewt=uY*AV05ocJKkx7#SQ}W)%mv(}9Wz zRCjhJCAQ|D4GuW%N6A#|EM>YITMWrE1PvCbRWm$cDW$7D?ykvWk>p!HN#eK#5KCV(cMU4a9dJ^^xlC<^U4Q5Jfu7IddZKVLITlL>MxuoZ2 zc}cDV24e8(1TR233D6Cz3EqZ!`zK=@L5|0s46stH+AEL0I38X+!1@Ee+J*d8hjH>G z>)f}JO?v>I*5=ZgCxhuOg5qI&!=pAvuY~7;t+Bk+c7}rV%uT5C^+O#l1cHO_OVk*cT~hNA3YWbt zEbaH6^WVUOwIZE}1!yPhwN+Fjv_6;dT^^OVLBPK=g5TKqq;BLFnwpppo~nAWM9{lQZ&29iTv7@wPwI z_P3fRt}`30%rzFE`}tC8g_3jqBu6E2kvRTa^QvvZ+!xYmQMOEmAGYL!RlOG>v&;I% z6*wVxWk4al;46{J?Hs$K3@&LJTL_dHM@%5%%4NjiY`K>Fsxoa}3Nfu8ernxT6{LQt zzWZJazmL|L^6+0}|ADl}SG$CvVv5%f-6L$r31B2h`{sr;$f1?3O>N z(?2%aWh8C1mj*-q(42d5aeCC|li`DX0r|i18JJ2JcDUJck2swcU9%%kxZQ@Ur=$wb z+iN!(KcT+#z-_NRbvTu3pmVG(iiHV`YJCcO+8#44vC@A70Kl0omlxuR|=WF-yHCp3M< z3%cBYM6p~fz&khuq&gpX8sQrj*lRDpV(*O{rA^&j!W34gsph*eEFZz9vBJ{%_~t_& z=1OQS@>rTb>@KeK{BYS1q+ao#h^Nh@^Yh(NN*|3Y|GJJCQ^cM(J+Tcq{^ph;uhppW zvRfMUtmH2LiFw5P{=c@{EMbUwRUd!Mj>w2j96f2?5ZP*KpM&_zvS@^+!8k*HL3;kx6Jjs6M&XFU07Z_wKCVx#Hl>!pY`}GP4=)Gq?o%#zmhkh^r%21-h72+jf^_eFN1Y9VH91#|r&eFim^N{80xBWjk}V z&VIYr0mpxvZVz%Nf&adtyooyB2a^CCv*|>CJ8m6&-rN>}*Qb_R6Y2MOB1|KEzBNzg zvEpZU6w<22@2Bxd@bHDMc~6ZRf%wV?Q4ygDFMG=WjIaHi!W*^BD#w3MpJ=A~ zTK@KPsQyUY{rD*K1MO?+x?r_`9x;bJe-AE|dAfZH9g9o4<=L(~8&{iutm)Fc5Iglw zqVn|~7@wRiMZ3XvTUkW@tQ2^L@h*+zDSyCt@Fl8?kQ5S-@;HJY&&A|U%RTF5^E|L zrk#GeqX_ply+G$Cm-D&>(ec@idIT3!Vx4GK(Qc#%>U!iq_mVRwTp6l==a#?+YOL06 zF!ti|U|qgS;3rM*4si{ql%Ul?lR$#N??m}^))osb3A8?F49kl;XjDDZo_Y0TU4Zw| z=Z=}3zz-s?A8M4fs8pUhApLOTvuUWQJ&^uTXZ`(^+0bAqa&(sr!3QA}g+*U^zKQd` z6Tm=~KA!Ioj7o|IGJ4&)w;i|`#Evv!39P>Q(gzQ^*t;zj%kVsO%=Wx=M_UWTko?|= zGz}_hlPyA$NH|@q11{>feB#dD*O~sy`@VotH?%P>vMW7&)|aV+)GuGJ|6ydTX;=2> zAdi-+S+q7+U}$=6M3395W##5XFnzl{t$__gOT$eoz`q11%1=4Ju_WnqT&Vbb=ni7u z15$kIpU_dgzFyV?Ln-4PI6NGDBloLYq^-F>OFUF9FIpXzq^I|3PTMN}Ob(plY&$_TlQdeYl80_4F787vKEP8v0oCiJ=FUS1hvRU~= zYCr$BLq`?XXbJ=&5axZPKM-Yui-x?jKW|+q_qOZ{LjH>)i-|JT$n}=XA#y7yld2%Y z-wWwtmFTs}U%x3U?=9oBIT;GbL{KEduU1B4Ss;+4bffI;&;hB z7>CQ`2CWwS+pP3>=iF=aptx`WBAS&%T;Rki102>S*}Z*{>xy}b(u6BdjC>L_u?p?S zsDhq%*$}7x;WY}Gh_90nQ~0TrMMF&W%*p|)8xC3HOA?6_sMB?opU=tdw9k-pb6GDx zm%u~d<5ym+^!in6=lrj`FO9{5Qv3-3gCPYaxJFpB>(Fa~v%14%G|F@;|Ft^OOnn@~ zRr)M`Xp1?wTrDNqT1qbc7Z`Cf;^cmEQ4ym~!0q_-mX8tOOo07@W)^T{u>F3X*`9n0 zVlH=Ml5TN<$ZcK4gjo5_d2>nwg^anP^;J+cxSh;hwnj(oVEsjT>2p7uC)OUa3KZz^ ziQAz>EvFKE>+X1)Rq^Sk3z!efrH>(I8Wp(zXhh7a+Per*g!ob$gm+*=2lYuhDkvQHs%d3yQ-_Q&?D9!+A&Q!jChN z#!2oj=dpVV8Sd-i>v+T3IGRX@)otYCBxYI6(1c~u>UHP8W?i1=#QFz4Y!Z)j74O-! zgJ$Xa|Nq$b)1U%C8Oy30cwo~f80&wf`CVOfC7PhjK}jMXNlZyPZ7e%iKY((|SS}wM zIsSxi4`ClnD&EB$Nog&J-YzrmD zr2r{!=X1Y&as=*gV(qYnHMD^Iq84|RMU#ya+3o%=8$}2kWU#EO&vjG(PG#bP0;7{w zAG2vW#oi_tr;Wk?40@2l_=SWUYa)oilj_=Qni}-4&6ics5GyCv(Y-BktZ`G*I@Sql ztu>N$5SEN4am{%qLL;tC^>~eqv`Z2Fc!z6ZGx)_dnCH25~PpvG7G$FiOc14eEbu@x?#>pt}H%F4iZ>o6&JN>|9XcXj_l;;K~pn%cCB7Hou{);;6ybZVXSsT zqgIgZSihs1(KNApCYA&4RKpF_{eem~z-G4^C`v-ec`lU zkj%e?$HJ($%x5e8iS14OiJSk#r(NzVPsW6nY0uBpE%K|EbuKBLt)HGj?)^7R)db8; zfa2thipynid<=NYcAU*BQR3drL2A*(*2pcfdm_P1gWb^Ym=iS!KhAP4d9+>`M3JKc zepn*+kbWf{?a6aj3gb4w5=0khb9ueq4?ds+eLNVxPzDFF|bz#T$(C)~QsSoSDX)U@yPw)A&idnc;prX!k&DHx)N0%@RHu~N(=F>_xW@giwRY1JtcF7{vFFi}SX z{^aw5$LwH$-97~g77T8?yXj_$55={tjD6YFjrJQi7h~n5H-2J}5%*UY$49hTqA`~F zsE}Vb-hClI@dTAWhcS@R?)jCAz)p2^+h7ziTO*5C6^U>!np*Ek6bN!3ihGznQpo*+gE z>FZ*%)YLLUGOgq=8yTu@)7Xe@vW0`d9y4ME!9QE>Oy>D77G$Z&54(hwbg-V8@K2V? zQz0fyn|b(T{-6xZXajHCOTOiT5f5zfV#;3BfN^G;@$(nov_m~yjXg(>yuMN=5sA2m zGYOfye6K9Qrj{Bj4^vbe`-oR)4qQ8S3{lxJe0a<6aVL~pD`!F&swIzT`g?bPm=5wf z8`}-QnIk9<8Qe4ZMKs7_UO*;H0(o~dP@bJfIFi%MaZOU{s&ee3`>gcwGa}ZXkU9FU zW6&A}aDe4azUYPLqDHl!cEuU9$W#J3Y4QtaL6AWN{Dn?%)$dCAFM(axXBA07VNHSj z*El*z*=$)IQ@W&%Ng7P`gNMq`X9I@=KeydP+#mJcKo%UbUczj*(&GfG-{;`m3z6@N z!Z!`qqld~7+Ap)ROAw9(SfXp4C(XsFithlz&n%?HUoh*!;N>5t@5A&@Mi`XPp4eZs zFdWKo1|`hXbQIzI^IihLB#OsntG8z-X|LeKvUj>`%(cHT0Hk=SwoxPr(Uh++?^E~Q zg>_8AIXq0)aqDYPF^xqUIJf4l_j`bY`NTjMMG!xJ`sD84vUh)QV#At8Z`HugjwymR@oJ4XZM3G(O#531b&xdHM93K}bRmQAmAZd01)c&QG9=X~T1 zCiN*Xj0uMtUr*Xtk+AOZkXX4lIYxYq$q5OZbb!eJ`H*JDY07xbe7UJM9Y1V7u-{0B$fJF>n-vuGO^^R*OSu&0MtVOVAO{yVKc z`&?sVheQ2{6Yko68cg|DZG8F586`5U+t=LhCT3US(nv_zOM zg|B5560a051q+I{v9juxy_=Y~SQBVU9qaEhJ^*QnbRYRNProK~>Be2J`1sGK#ri6( z;zr`hy!~VUXM&AjGXOym6PRhm!&c0gD?APWY7|@kh-N%v`!_w%RHO$eAE_@01{Gu{ zEyZ+sNRR>R(aZVV-alD>Gc9xg{Z`#1eS1JRHs02=dIm^d8K!)eifmZ%X=@I1GL56M zK5-DYcGLWQ47I-1SxK3+pmG7OeQ*qmQ za_g+WhQOTd@Wc9#R3_MIFal${9B(O=;1Qr^x1!8BF4rBLW4lU|8BH(!jX4f=nk@AlZgx%PyB;| zyBqk;&y1!g=5nBldm=llyXk_7MAoDVmf}XiKq1gDGoj z+D=7J*v(&zDoe}Uah zy1Q+9XuJ2^KqVUU^>=+>6=Wy)<_`AR=R`0-JmI*R%iR_s$&Tv#vzG#Jy`D8+LIluZ zUEWhfsH4aGV{B+sr6BoNI_%@^Dr&gv_U*)_Waedr8SvL3T?O&f*b}3tR!WL|BcFHr zPJ@?SLuW$12ASq@-bVJoG&q?C<8xzDd|DsE(B9pfMf`mA9chs*Bj?F`U-b3_V5k}O zb(%ecIftgl>}W6k_x+?EmH$-zR(R#ijh|BV)#m3)F&72Dl!X9h8*&+Z6W zr997b_c!UTPVY)NP?f!rV0Fi*XYPIe4dUiVr%zo9zhntMFbEsX)7%TyvG~o7$6=Fj zhtDy^3NfDnoTw<2>$iPpyBlA~%r?#2&OM9jTNdi6HQ|Yd5x;i&ZqK4Fb5>d7PJvfe zo0xUE$GlAxkC!knxzgKpS^*!SeR<_83QX}9Y%;37^SoQZQVf`1B8GgGPl5*RGA}4R zgI0naM~h}1D>$F_ofsuoLX(nLXIfpT|G#UdcqTD*pLUlUrNd8IUd)D8vxTx1%ZTxE zlMh4Rs>60>FBq4{;r~GeIXgh>-R{T#Z4P208#H=wzzkX!c<}&m%?66&=2Ggpct~o- zmjE%GOr9rjpseJo+SW~5XXA@%@Gh0LPVFpfCOGpXcMEt6odLflo$ziuP!(9+G7Gni z{>C-@zHmuRcJg?^Rg1?#R-0qUz7d@M=3++OXh~%6iaZ3}>qN2D*I*pBNRZ~1)^YJy zn{I9q`P@3;`jep@8|PYMuzOl#>Cn5z;eV%hTdYYN!Jv+<5GQsfd;BngpE+Kh(5z8S zy3QP7;PM*P_2rM@tHV23#7|AI%1Qf@d6qelY_|3_9OD4T7U$>jDIIwSYFB#f=pedW zTi%k0b}P@+<1(~E+mC@N?<(P;`%C!QuG)c|;O3-@o2uDh!o%Spi$;FML?+0~Q;-Uj zz9x_=Vhd6{%^!=e|2|3}!UC7pwMw}48%#dlrt$yioUw33!mV^8zH=ia7kd_|)@{B^ zH}H#{vjXNZw;zNrSkX@0p;DRTZ*@gB(V-=5_z&6RDAsstDu44NUk_T`rAhE5e9~KS zC2?cX-#|gAnvE8NQO)ytQ5dbCh^4SHCi=tC>ca&$juzM`SQZ2;tAXgcU%}hewO&;0 z;J-5EeR^vKxbHEAnaDJmUB=3lsr~q!^kc8VeWZj8{tVEd8&l>zuSpIOTt~c zueY_p%Qpfa-DZ_1EjKjOsuYjH$KqILDc2UIkM=IJ$6r}#=H{lhY-yi1h}`~J-S6~A z;6FGCvl8F96Mu#19qrg_F!~Q1Z1xq&1VN)Dqed~a90XS?c1PwXl*67q^4BHC(#K^V z`RwyDhX!^;I(#NoBs8bop^7c`xp9CAkhq?tw`K&rNnVScSgL;Y=$H*l=9`ZyPjPY^ zyF8Hzp9$6f;~qC%TcT~`BX{>iv0^mLVEU%YQAGTGn<#5_03qco7i7Kyn~-g(AI|@A z0jdOFqN@#6hLxc;@Aj~9hR5-=hEP?DAD@5)n)E}1|51-w5={jsEqfuEk%2etzCC+>IP1?4ks}f**j#MXnPr65? z^Gg%J_*h6p{e%Ys+y0xA$DqYaX+Cv6Kjpa6UfxS2T&V08J?bMrN*zbCE$yF%%8_FO z=8w=B8(qgX(lS17mEZb2vD1;3`e)8-8Z7-(2rk#)Zkt=Tylo>aWs}saF-M@Zhfz0} z^i|Z076bCh;qj&MVeaDpHbThrNz>(U)~hsrZJS+u4sVAob5~N=Xv}{}Q@q_2z$l`2 zwVOk^Ta<{C;fp9S?A=ZPzF@O0J%$`jz^AyMV`K66<5T#qIyI7Y;ZuDogsR+d4B|(` zGWT^6b$C$9P%D>G2-v+{MK1QpDyBQx(8BnWb!Ci8u@fd>3M*7vZnt}m?b?t0<%U+? z=oeB9g&}NJt7Ft(>d&0S@Banvw7tNW&1#lwN*KBM#=@OeXWlvxqL@tcnBW*mYr>8- zvExpveuz3hy>=r|rwq?MkoWkK8kdHG>0;#&w_Fq{%&Bh409kbI=KX^m|i^YO_mgvFg9HWM%4XapL{`-bIF zro5c$LEqaic)C7{-m|9K3h4Z88g;>5O{xF1x2xjVmAm+g9rO=$m|$s9U4Sv<)f^n6 z7m{4deUNn_g_9Z%R}Xfez}&do+{mX1nM=FviEo$6&gM%I*~Yk?xvW zvCo7rJNPqWoI0`siMh#zB3EUrz)EPd$4mCG; zquIHNnmT(>$dLzas!U%O&wvBv7}Oh^dgOoG*`b!dRuFlA0kY2bZGVGnn@tvMfwMcm z^dOUs#{J#vj=QMzBA->C^-Fa9pylQXTzQM-yGu)~Js{Xn+mdslweojddB_N@^gLsf z-n;V#_ruYa5Zx@cgNyHnLtfmT{ZO=NpXe;Ybv2d)!*|1{y0+n*cnn z0Es^6kOf07{Y~F@*1u^@GO8T5q0h|IPn|E8$P&?iq4|}(#35F{KS-1d@muP9p@)r_ zBid|Izc*98wwu1&9h#ZZLTNg-bpbYKgIOoIG>;*8+ss;g0JVLF?8iIn%$f-51Tte5 z4gPNBwZ!3Ae<_bQw|Rxg3}2lU4E)QyfAY}2Uccn4ziaLTQNP|5tX{M+Pe!Dc{;G_- z>dV7feVHA-`Shp9xBWrIf1v_BZ;R!q($U|`>X2-?a-0sfOTY`XAa}xr<%b)C_x)Ys z77BuqFHKK!3TDEZdLN0Sa$l1s)O{kUSb5H1t=nJms)KEz@`q!m>U&v>FKwLn*tOR( z<B*lQ@+26=Ow3*hz zZD8sdASu@iQb5kFM=alzShg~LcE?u2u>>Iqn{)k}X$ikDr72tt1%>7}P89$*?u%*$ z-8$qC%Lf3tNGI#o&Snr(?ZsN)s@Hrz*?3)R=RBx(?~GKOBKANDSU)*)pY{J1vF7?A ziB8Iqm1Te$q>buWiG=QV*=z*DIjNG68w4(=0Y#5|C**Y?8WLL zdWNc8;xNK{%v&)fB)sFaJ99j+09VjT6eB%us4?Cy_uc;MS4%F%l-D5)+LWd%JnA+* zYBD|9RJ>KcK*igXzBj!VJbRKMdpM4>n(||9TGK7eGoB-fpR1Pv51S5xGB;m##slMR zU6($vwOraTIhuYvAM;)SmOBaA^Kr!frIPgWZg$ zW<abn=M}WAa-Xz^GyY( zRomb#00^@}Io&97PZH>B9>+%w=I04R(es+?@Lw=G3^S46W17p zcb9gHCjR9wV~@M=;>}i)4V=H|-RvocHXu;mh#HD&9_)z8(A0pLM`=NmZ?s1rFqe~8 z5N^4z1M$vi#Xq=-pfp6bHwG^nJ$kH8T0*I(?ltx@@YOG&JN=(S=!Q*VtDmFRr|e@m zUR4PDz#~`N&U+P0>*Ry zLGi}b^V`|Y)rNUgTG@+GRCCy?Gls@i4u zGW`7XqD{`^I^JJN-=+j~k=HKj$2Q|;(ji)DnpElXpV?leK zR1iUnP)?xtvEOdHM?MD)#D50b4u+>R)Cv)%d~1Te2d{2wyu z-f#Z^?JmA_EOmWf=#e)gxI?u~`)n7B)@neT7R~$^rf$h%WFDcWy4x0pH_Z*Cw8M z?Ry4?JQwz!HaZ;kPb)o2WDQY~C$W>J42aP#}=xI*KE_VHL}YulG^#1U~Q<6HEqI^t(l%zfz9k`bK&I^apJGid2bQoJ$^)ch{Gj?_ec?I5~EEVf?iauJRl_7p9t?bTi~dQ>N-8(8SJP#{HHdPm>f;~MZMzA1!hSgfQ$5qtn*nP4!mbX(4LjfTRLi4skjSo=;ephbE za&>T#;Lx*ELVhf!(_zVSP_uL@fl_ts(x>K}Ag4B=GlAkSZ0GKtsdfZLm84%9hJzD| zpy{K=_)bPk40F~Bf3Y(WLTW;%K1te7GzsrFjq$^I6CdB9#r58^5y z&U;{FcdI#&4_yLDAYcV5>r0;TWKN!zii4fe)0MSVN|p>M)9Tj-g8NkjncJ$?bqszU zgx`1#iBtvOLFxsd{+H#M(`#6*4+P?T3z93s)31RQ$nLYJG%z$VCubhKG!Xvf`WIpiC{Z zHHzbNxn@vV@C=P9_=i1vIuWEQkRGRqnlXG=NLC zE03E!J*9aZ$Ywr?71oZ9D#XlRYYc-0Q!nmu5l_@i9-3|D5Vv7+;Xkh#$JOA^MI7%J@%R`%jY&~ra!e_fQWB_@5oyGP(k|MrnXpMwzeug?d#tnO0&%WH_bxN77z6VY zE)}Nlx-PVBBw_N;GE7!T(~zwb3X%qDe-mqKKf>?a+R$Lsdb{-cH8R52rvD0Y5wXy(y+wc zW{jR?08tw?7%1w>Tv#n&Tm7}{$I3-dR2TMNCS%&nrmr*@-UnXlBr8q3)2~NR%jMdn z80vSX(@!q)aDv7@l|g^}XbwKkyY`wXAq2-Q}8h#Qn5oGU%>%#cihROKT;rBeg{_SBRPl z<)P%Dxv`E7*b8y3P;hy>X!VCys&EFf`z|j2!Zu?wTN$BK;uh^$y@aK~WMaVV+w zrC@nmealGM?`IPywl4DNu3HDltr_sucIM?JY)q4k1S_ap#Qffw1*oqX^`pyRYJff+j3`R1z%Z?z&UeWIU zbv>y}zQ}*`Eva!Zybly&WvmMS=HsY>()U8lKtjdc$x+a^ z#-a=V22{0;!(T8;u16SD)~eVBt&|S}93;xL@Hi>g%0uQGFISA$=S~cO-0-mY94H62 zBB{%ft!(h(>{@!wAT>5vIE|3<(Qxusrrs>P;W;TE+tdMZ{HKHutE$|unoZCoO7l;} zwQ}izHwC_}xT>c`!6F*)1%A9%2u0DknzVV6eOh3O*JE4y7)Qu%FMO3>HRR!qgZbve%byyfZE(`<$I0NJ32} zZQr8uPO6Lo$wk-3I(Yr+Uez7(4Y#IE(+o9>E$^R{V$h5l)SQi=lu3wlf31wqgwAAq zQoqlS`YIZ;BMNN0@YGu7m-0W29*ESx--<;r#J6~DX&+IaMeL-~H>5i}z0XLwP@nvg zse(AznUhe~N7!!~OWnv-Sjs1aJ1??0;10`mN{#dSmDJj)JzOT+ZW1+ZSDL2T%nDe;bB`*TX|& zsRT!6^=re%_?YcHx(Uk}O+void-Qj{@r_R#)`w4dMOa_d&NfG#UasfJ&QSFlRdWfy z9j#|XsgDXVV}%QU!1>+~!_W0sIW~$Gf_jqrUw;;k-r}YAlzK-s6qO*m?%7X@$~z|& z*1v`AfAnrB;Xn7cLzM-V?Bz|Y2*1{P>_>P@lVn3u(ZnX-&wuJP1H$hD)mzae7PqYi z4urHHIezH6|NRu5+_O`_7F&3Hgy1?cHEeT}5NigA7-(519pC?lrmJvk^8eb>Eg&f! zN=S)xjs`_QKn3X#=@w~5cNhpL4N?*VrKC2xOOWmwFlyw0#ru4J*Y*AfyRNfyKIgg5 z9W7nxk$NSRY@5~b@7KqZhf3cO|GJ}y1qd@Hyps&|teeRiJ{h%;N4!F>Dc$Os-POMV zK4v{OcW}%TJtr&{RH4mX&4_A$3dn)JQ)uZp;D%LxKx-gPMzwJ~2jZDPf^#GL(#Qo{%N3oDj_-UOb;t)19&XLI)$1+1G)F7l9mwa3 zyLT=v=O?Yl7)nZ1)HNUrr7R+-0f_<)H33S3)m-`l`W z{KTUjU#4NVI z{hCW>s18Y38OFuuQy?+XiG>c5fne!$7LgvC*2Hd%PC|<}O!KWKO1io$L(-8 zVEdZ+{#;(v@b=1i+fj}hJLUVaQD9gI@1OQUhmYbY@p^xGh#17t?I?&QUoui{VdYv) z{zVtTGTAuoZ(oy+?36L)oiO6F3wcaC!;S@9?yu;T_neEK$p<`0uau-cSnYetxRvoa<5O zIIS3GRgHmh1hj{V-8c~?1$E?=6eoN6Gua*`(R8zp?*;p84ZX@yZe&bU`0SPx-R)eg za0zn0soW=bLM z8|LJwDi^Q5&kqf>k@Szh5paSrjXljdo&t+( zoG4>5mHB_~2i$yadbhgGd1*j;9;}X-0!!KWP&p*yeROqd)?&{0)?-MN8%|qYN6Fi* zX{y;=JZZp0?h`oT=vmSN1iT2A~xJ?)x*6FvW(jg{X?;mL65%efF(AS_$LYATTpVatKWvG~oUA$1+WrmxS zQ3~K6eKZVRI~Z59k(McW9J%q zarNF}RD>?hts?@EF{k*J$T<)n`r*FL;jf8#2%!CXmwTZ>>PjD!%r%ZytBkcN3mUkd z6ScV0Ln5s(SNdUNhi|7GCE9CQPs!PXM#w66G-Rd3cRFditgd*h*IMS()>D)PL^!~G z1u%X3s`lO1d$ScD6p=E&xUt(o6yQOcA0tq#IONX#+X%}Myc)MswY6;9Pfjxw$?P-Rz*26o>$hT-Ev{29LnC$Yd0ZE-Kbi-B@3(#C<{7<(++ud z>~wQ_4+jKTf&FR2{F1rGzK$2XXqz^5*X#i7!Q{e9d&$ah`(t|bQ{e42QW<3Uf?khm zYB!KEGn{itA=r^=XHhnRq_{!WIytsIYIXEA?hkibxna3Z0CU!51VvmF|DIu?%7YhA zRQi;WKr__V3YAVA9C{?1a7zSOl75NJcOqWhZ3nUfm%CHp!zRS&+qYJwG@C)0o4Lej z9{JyU+NS9C5e#pMm)LJ5=H`oW;*$!P0B4k3$ypsK$8o7}9TCi*3EOf$B!bmkhZ?zr zhbE-oXdG=C-i-W|HFZ~SA#co;dNww`mS&K46Ohc^8YG+W_3I-q6Qo#9URG1CI6UDl zP~x7fixkP~dfPkC5&b!qwar?Psnu*Mvqx2~wLl2#KqM;D1^10>o54a*59^nvFy(ka z@Xr9|M!6)c8$tQ9mB7-Zi?LnUCLQn+j%c*oqZDxdPctaV;Kv(pwCa*{qv^ zt@hmUWVG|uQJ=b?`hh$GTX;QXzo2Mv%*Hy2|T>?$9~;DT&lHAVg_JK(2Ipl zQNy{eXSH0>(pPB)2Isnuc{?9L-mmD_d?o{1qFOj_@-8a}HFs=Df0{j@!QRsm=+FrE zOz(k)THJWWsp!3UwJ!Jl(F5aeaK4WeQ5blf7^l(m_>KJ#(k2Q$w0S3(W`mpYK@mr zcMe#mYfm-18aZ<0(4bzZtPCZ;Sj+j)wqrQCU9teQ8?X2sa_-ok| zVBPtRRhxLjafJl(S4yq3l%B+<#9_HbUX{&84A_hmy zZP|5Ju4`wTJuoM$ty@7zL#9=}#Y6IrBre&pzTsl#=Jd@ym{?3qZI)l&nf@P0c9uaa zF9Ry(gyXlBAM1=z_gyzCQqOxv9TH+CPUPTfADXzU&y{ZhUDsGF_4_rUgQ+V11Xr76 z_%}dPFrGFYDkE7)>tVI;bC1#9Q9MP%ItPvPtqG{B?gocpRO=SDKVSEJv>(P$dfO{vrObUD?5Fwvw@u=oRbSJ@-PM^)1!V(FQ0&( zVF<*tN*M@MdIn9n7e~7G>co0>gh0}|4Y~I!|4ep>58GhgGt-v~xJkXNhNiUjwlQ7f zGZC9}wTWwCFL6ls%C7e+61M^SI>kA zS9GFAcx+xCsKN(F%I;_%N>FSh)_UKhFk?bAn_esi@Ga3C#8^@4nt^|*cLr5QKoh7K z3BCl9^{u#yRn7#hVdq;(w2soPxJXl5kf)}LkLW!dLi#>{erj~42JE=+B(71Z2{ z{cf_>zmr^(&2tzTd6*nbPjIqLyG&{S>sa^OzXMNKrosj--r~KY20~^2jv&piT0bP( z)4gi6??KLs7~6_gk4xDG-FO~i2hXP@oci+&6vzQRZC`Oup*X~F<90#c0QV2czmdgU z*C%FM!yQ`VbNHR^EwDcI;DrD$ri6a?yA%a(NgoCONEGTXmD21*QPoqujL310jy^PT z&#gr5afmY$^|9pI4#_ONJb78F@TZ3efWBIpNwh7HH% za>;&Zw{;UgiRHJmE}Bi**fyCWdUaLpn|ePe5JUsxyZm8NQmzL5Hy5bN;|w*?P7l28 zydq{LUQ6-BbO3R_1)e*^xecNZ|F0o?d2>;t(&NhL&W+;oZe=!0iBn zh11_nk<}svP6zp$obzQ?xF55bkFdG;fU$w<3FlUNc2 z50f|6yaL}z?bb9GQzDiA7GaXiSr{5I^nT!A&juL8yqcPS)sE~g~jgt%gU~ANJcXs@mNWg zjfT){POnP&T2{Gc-s7=e@<=dTZFitvRDt>Orn3b_+Ki{Tzi!qqG>`mM7&Dg%XH5*o zH&E&DCyAi*R=HH*%SL^%j_?BgH2-yOD7EyIFz1ixH~ah?e6|*|gEmMO^=3`?_w~QZ zN7-DtA%Q*gcJ_HuVn~LZT6NWy$&uLLT;^uD_dhWR)9uM5Iz$o?FwhQ%Owrk*@2!>Ns} zFDb5{TRYr6oB}6oSic>!XEs#fJ}%U{!RUH~hg|Yb$>&3ncg|?TQF*uDD}5 z^S(}|NT0?OosF=Xda;#^-lp=@IJz>txeK~`4SVmNzp0kh{dJ-;R0+MMeBG4p93_EY z8$9{d98Cf5#a&7avAN(GSLe?;?L;ma=>VPOhS7dLtTGv8 zRGqV7V!Zp$#y-`hLa&R;K=`nAH#4O8W5736)18=&*X(giokU zP}&pncd8I}DveGvgoF{tU!RjQPGWj|>Ootk`HmLGWN00`^mHg&AQ-S_wjOV1s~n3Esii}pP6L@S`w4leQ7-c&)gyGIFO z)Ij{xuU@FjV|tuuXPfe;TdZ6@qIBcy;r^_0zx7`f0q$8cz8Iu2>6OL#qG11F)W40! zWr{y-8`iS?9ib0b8iwu+5Ql1rvT==XB2KJBFH_id8{W4GRitvE?j}(I52&i@lB0eZ zt*qBsePxby=-Eh({~m$#Me`m*snBlXiX+vgF1NDg3`o;bAbwUX`&?fiPx^|J^idu6 zZLK>;SZkomQuYAdw6wnhYCXK2*4>-3lG|+4rX#b?%(ZzYMvPQh;!^<8SMxtB^+W#I z=CNGN*KFCUl){^e@%EGkB&ibbQcz_I{)>|vN?}!JJBK8j!Nk>i6NWYnQx5N5ko73f z`~$vc{6uvpkNFQTRY!8Rln*mUq#pMnf&T!-_YW+)MS9~$SH~zaYzFHTYG?|dQT2q(m6|x2Q~(zKoNdY0ThS- zIyk}r(KFF ziN4)tEA1%7eK$gt5xCyAVc(D7h4w^)P~Xu4|9yfCu}e=1l+t%sQrjEbavP4sWnwyJ z3wy?`CA&?-59OYT>YYa{aqgh6K??6PS}(LuS>o2(lef(XK*FY!OSgnuuLG;$ znwgkeM{_ZMdyr&d=KHJ{X59fSz9r=x0w01^y^KHdlV8#knqMciNr%KCY8}|amg-`l zujLBPKAhGY+`3=4+;w7N9%aTvO9j}c>csU&#Sxn@(5xp_)8U>)8x=1-AGQTqE53=W zQ@eQA6D-OD!Z5+h&T_Z+pnhAcmw=uxCuTO**aH~LVjsxIuoIx1ZgH@5&d z_Jz294slwXy-XU@epH8cgF_!Iofruzt$(0YLZ!X8E{kyc$7$xcNpcy_N=1`DUqogE__*2)@1wFuDv*?nSAY{O;tjF9T5=SU_ zv<}!8jKaSQ`a84&l048&QAEL0RN%iiq|-eM#`fE9?_2$NKSoQ=)u zzxbod@0I+|Rc{5mSU*o1*|1+QTG8)skzcb~-~P-{i5&%hN|Lc;heaGMi>e-?d(X9_ z{f^o~me@0{Xh9xo!_V=5CCZH5-st{^5QmP{e31e$;?qw7J@yV1U|Wl@9*wSJ9_&{L z_$1$9F^te#52SrKdQW+29V%bo+w#kb^ve^>jgjvN-Yx-3?a169IVrK^k=IA}gtDo7 z2DroPD4W^1*ERh-2=g@X-@ZBeR35KgGn+qSI`_?utl8uTl_Gl}C7e_6#h^FGhFFYl z1@qiPNnB$5L|>cQV0eZpibz=y|LOR+3_ER0QglIC*9GLxPT9?MxE z{(5kecbM|}eSqg>QG^)j-LTe}K1M8Mc4v(ZF6{!H zC>Y$We|mhO#O$7`K<4;+#=&suzOj^gTQFd!fq@+bx&8^%rSm_?&nV+?bT+wpO$M@1 z($|DE0a4w$=V$t3RAL`(>4h{q5rm!bmJ6ifC$MC~Lu@6}rlx6efc#13Z{!aGL3l=hwe!abTNK(F)%$6nw6kS+NYdK)%niKI z*n9lwdib2(!NEbd$TaOoi>Uy28Jr@f&1pKQP09JhSd_M z$K#G_)NF*1tB+^gglS_NtC3g;%BEpMd>-N;T&6;YAr^@z|L!0NA1@P)po1-XH>4Uc@7PTHH_t`+1 zjBa;sNIFxfHhO^&%7}t*#n`lNIs=g_pVFby?EAcBT3y zb$_XaY$)z@<0D+F_iM*EhUaJx#^?$T67RSh(vXf54M}8)c8j!;;^hCFCxCL?YS0gn z0exEcrof!34m>uF=TWWl$J$Sdx5L9vj|t zs@$b&QVb$Px$4m28)s(8UCuSQPh@l{G_X@duv)FNC}zeQK|SvGIK!F&O(k|_L6&Dt zhBd73=feu%)rE3$W~FHkheiBSVh-Fgkk8rKR$%Yo=#y7necQS-1Xlg1a;Gf@N;P6~ zlK%kxmD?lt)}1+2SYxnEpRLWiz9{ASDUcC;651Q==M4B;$(TG#@hhDiu3n~S6v1v^ zCs8zH622L<%xr|Ec?aKs2>%e z);t*tijPOi*+>d*3hE}0$i&rx&!VghOgA3JrM#q#yPo9Tu=wK^Zm5UqNe{`Qf%^GA zARpJ5rZB^^6r529bGJCRYxi~?`&OfCQ-mT{vyLl4Dn{%w6G z4RX>P4=idXbWiC!|5n!Y)O>I<{z!;4@kIDKs(%m4E2;;?Ktw0J1${L!$dkw+Gfk)Y zsFiEVHZ=uy@27b5Zs+1H>UvMN_o7v`3IhS~MkDeEScfQqIqj)Ob2nc9J-ayxDc^h{ zACV07#53au{fMeq<~jYI8L_BeIF`RLu-6;V!ozLdXC7}GPaqWjffZydJ+==Uk4`HA zwRI=Nz`OqrfKZI11NQ$)1glv*8(ny)oKK8K@}&XT;YZ0a#TW4o6W$fqN|fPKMYw?3 z;<1GqZ16e^e@z7KzV>V8L<4!eydNTigdFoM4t=oX#rn;8y)?i{cp9ZiOETc@GV)2m zg1n#ZqzpUDjn!M}?4gnfe#`z>W{>De)W5xTwhRULl{ZAWaqrzNieX}1YLxfuh&qw9 zh$o7>7ZfBK8NpJ52m9arrCWm+5i34f^raN%gIDjYORTwa>fgbm#bl3Oo*og{`2XLt(tPgN~VN5 zFSjjIg9&6w#_wTUdKocYjYzJ!q$sI5UeDbG!b&3h`@5`hB}v1yli8O|0s&NZmXQid ziYjGkA&^qC)*xah4ZggIOQf}cWA_i}IGFTM1SS`KTy@GucyRM=8(vU|`@sjd@J5oK(ZG0|X_@`Vb!m4#=t_ocP z8IOz!@YXsG&1T+2o*R+%{Nku$`u0Gd-Ly>~8ikVC_nVahT#Xx2Qs`z9qW-M-EcK#n z{}ES-qgc)DdmwQlQ`x+kuv@vregkW#AbAYvCC;tz|)wi4$3-^wUyRN|Wm_1djB zA;mm;1+<;b%2kTummg|Z3;wY9|D+%`%Wjb3y82WMzT6BXYl5GJKx;T3B}Bx$Bt|Q_ z%J#Q=mKNFck{6?ex_@EJJT~@VDk=*I^SbNQqKGT7_3X5}>f>GAEr{+Ven+XN%T{!4 zP{V@-zgGkY{@c$B69`{l!;z_)(2y1JdO5x8maTI#1)tnWpv@yWGj;c4*S(j;9)N%C zX3!>kn^8(4#h5Hxj^pYbhxgzND7HZYyB8`4#UF4Q_Ag7rUJ{UpY<@UUMV7w7a|vC4 z8Nef3`r`h)mK?@^VDkF25{XT6C&bM_KF`|_;PPA(>S(x|?y>pq{^K-G^%>plRh89y zbBEF-dw!B_G`O?4W5$b*i82 znHPeC?f6qAW0(RGn!Sp$B1*N zQ~U?$JG^XpV)qvh0EJhH)2#3K5Qyd$_k?zD!#juxc~BG-Z?W?5iW)CS{Zr)Vmx6q1 z8{gj)Zacn*qn*BUZW`x(ayzr@&`=8Z{O@))4nGA!<0QEL=@v?3g8RvPW!Ngh&hn{< zMYUYlTJD(c)++cMH+V)nsj;zeT~K_=hRIP!Ow46{U_Ay3KKl0VFJSbZq&_BF4U} zR~|^He)Hz?H|WKS*PPG4forMlo(Dkb#6>$Jw8Bi;67+HZ4%8hdh`t;lj4n`Rf76(! zJ0cu%&F^;YK}W(KFT)e6pj)lSSMSa|q0|s7Pz?Gi_^}Tre$7Cb@0Rymks-^B*nL&1 zhb&^bH=doxjV+z|rV%q0-ij3*8YmQYOV6MzZjx6aRQ1VaRA^m2%%^8NZ0B zC@m#WU!tR{sJ~4M9W3U>$X}7w^ra1I)=1@GsNV-HK6Li)ke)w~Es7cc^*NQ_79FW$ zo9`Eu;7(KOX1(hDB(?}VOSMMA>NL~LrK6vY0>V&jpU5z!D47F71LrFvNra06qVIbv zr8pQDWZ=fVkI%NUA?^#UAH;q&`mIMvjeui*uHbU@h@YRCwSxDNQO$8D{?RK7C<@f; z+1XXTZ@*oYJnrXyO0!DvP7PjNc}4H`FIEJCes6O@l{*w-qA#~<`0~VljF0s4eCq7s zB?*m{%&Nfyu17V#keWHw5QvqB4eNxgM1a##U5QUTp)B%IyY9=lkCJFNaw;kh#^R#=#q~2@MaC}5!t~hV zOPA_t89@ydRRi|Dk8>cVG3%co*D~_s* zgTa&_S2YgxOe$us5@u!it%-_HV>g*5r%{4+)b3)|KaoXli$Jvl3#91|f;;vYAxKCVYPvFXpptN&f4HPdv#8Hm!JlOt~VPVXF*NgrRqEvVhOGR&C zvb#6-Yl(i0){U2JV?(b0kN#wTzhYTfl&u5QYE~ckpGpA<;29SKr}vJMMX)IoO}src z*hpe7jU$@5Z1pGh(?PC5Tw51{nCGsYrkwpweM$8uh*tae34z~bWv90Y}qSGP!6_RZSuBrQ>XmRBqD{Nqv*j45g4n=%6b$jKwm zj1ZqOMDh!8{)!5X+g>Hy;Gj}H!0FSlb&zkf|4I@5n3LNigh4FLSNLZ8EcH`_FW|S7 zxtrO;&m!S^dEmS=WHLesPog6>dhF-k1Kw`W(2s)!mkDaMWd$>nY(5-7D}UKZI_+?$zml_?=Mh-l z{JUXJM1pt1h`n3)*qjo{JfYcXj0@^4 z3^AvO6zPF^TJ`L~zSz`n*4H%UoV9$d!7A$skm?^-O3WY})OtPZm|8nJheqyum1ZeG zuC0I5B>4)X8(MIGccivm2Liu1ZOOZm2JTox7Awn!N>pOYO!?6zDA*jvEnvgCX71Tp z5T5rsh;x|Zau2Ej`nSvSkgKFor1zD*dBnIN+Yi|TqA{iXO+?+us@n>Z$fpC+4|2A5 zGkf(`)NO{Kf5ZAV4C_L94%Z0D@4oHG2S(Jjgn|J8hl-vt;L|--?huKAIR#J9gsGZ} zY-G(_URQ!V)}8F45{xpo_YJ1bq*G`hiq!0Gr?*$OmBlaoJPlfbpgZM6aTEmZdMe{!z~ z(xd_QZOR2c?XX}zK_f~gZk0QoRs1cxC-KwN-%2Xm{Q{d|#U=2)no#be$WBulHkl*l z0*jwKI?`Q=LLaPIdisrz9==C>D|Xioc-G2UXzU1mGal?gG0X3CJb0>ps4<(u_M$oU zK$-Ur2xsu^^R5#lO&Ktta;R!t+_0t$3-qQTG{LNTe)n7fMxo)thYgMD1+6Pl%fqd67P_wS*iYYZG{-&bgD1WUV3&)78FE?^4;eox?ky-Ct zX&6vB2W2Lu3{#`SPWK@S7!v}PTbDQX?}Bc`CON%53b)cheD4}7^>HyJdK|8{4H>1F zh7fHgC{&dWmsrzXbX&noTJ~_2`Kr6h0<1V8s6YRCe^=0;U3DM57k?aXU!5 z(C4FfMA$UD<;Jo$tiNOqKL}&h_?`*1k+vCVaVt=DhXzQ@=hnVvTRQVG`FUp< zS22@$EThjXr2zq%5kRJaN{kvc%-rad%On@VW%Ai z1?O*GWAv?SaG$6X)vKq#hzq>vL0$sY5&6B_8TYPSI>d+#_JZ@k0R3<4!a}T9sgf6L zan#k%SQa{?PZa}ucggUCg(AXI6P7C`V#mCgYd~aJtC{szO0rU_x@s70=qx}Hd}ha~qA z9HDJ%zAhlI*Nw+PNXVgCkp== zh}2IvkE1a=h3kCoc)ErqssF<+uxIzT(Gm}8LQ6C{Jpabb`dSbxmW)CsDw>Ypz;BN_ zqPXz&mB~&B&9qOptmsHF5OH)r+49aAm#5_z>48kV0^@8V}Js5N_6Yvnzp0CAi^ z`0draljp|5r?bz{Vbs{KGFaqqX>bUQ`g!H((+#_{ToJSqvY_ge3|!X;V(mcrKPu+| zlfYRYNmL`IRd8`aJ9QgyaeYo!xRoczZrB(by)n1wXA}D%o2v$+XU9KYKk5JX0l5bi z+1*T!+>|GdHAmdc;}XMe#9pBlVkSom5>UBx{U?hi_OLyYspFpU2hv^E2zVPU6n>MJ z!8~V9>Lz%pF;6YD!sKq`qnQxs6nt%za%E={+X&+J$~0a`xGOpRp|s^NLmWhf+VyVq z5T(K6Tpl?PTp})KP;hL+Zosyq7x;B9!F@vd1T!13n`XOzi|&R0q2AE=CQzYQlo>Q0 zl0vw#IwFx+MzO`w7#>|$(~;vG*RK$ zae25d=)MxwcGS_ey5z+y)_i4ur6O(U=vB}%!W&aTTjN`|GcRDN!a?%Oodl!&OtjB* zG0s`;lnz_t(n`uoxZhd)p%0SHBFMU^qkQ*dDECM{y-q;3mTNBZs!i0d{oP-p&P(xq z6_9=rS2O*jNaEE(&FqqGqrRB|?p8iL6qOKlVf#2?vZL|+;Yi>>$&@p6PnPwRxog!S zgj8LpO+!-ynV7NLMDO>u)JigsgF)TO8Gd{kgA{TbJiyGL(h8&<-B~3 z=rY_dbSl_R*WPM!U~%FDkH8G>eqB=V2z=xZKIfTDUQvj$mq4oF#GOs-d?R$oRCAm_ z$N<+1L|-s}{ZsSBa2TpOFiH3+k5Fk=2R^tips(;sHH-)1-RD77hl|3Y;(`4r0kk?Y>vQzF? zF`KN%2rHixi=rd-fVV*rL7=5?Ba+s@<(OmZ!kS-aII!$c@g0ZY^z-;-{V*M2=Bopq zTMsKH!&v{G(F+l`UZ~*$zM7bFnqdI@*}`HF!ojvXh;Fs>E5&;mp+||4RG;k{c1qhX z|Mew+CW*-Vo@kAB{2W)HCCvO~K*o3T0%CB8Qjsh4u&o|7`0G1v+`;A@8Zm| z!Tg_lzMi4s>f7Z!jem}8nom+N5C3|>PNP>fZIS-&2R%^ZPKFpan58r8k9Eq^1N*E?|n?B`7 z#V5CQwf`DHQ#jorj~88Qf`{r)3QB{ znas-=F!FvAj=g(bjS6Q;ZrkXcTPi&LlKT3D}D)Z$=C5X0yoE0-i}dA>8uhH`xTh zi01C1Kx;pG+olayvzl!?M0b8!V2ux{j9GKFN}G$s)KH-aB8)*xIP4dWR>YuvvOx8c_boY&+jH*zJ@l~ z+VFf~>;-+50BIu)fh#g^6BycaTD4UKtX8pH&FP`fYI(teCA3X#-$8(c1*H5((IJ#+ z7_L}vVh8YoJl(MZnukhF_!+0%$+vtmG}zb2S&ZahT|>DGCRbeJdV;vrMmTf|C=?uw zt6Bj6XWQ0{ylQ9 z9+dbPPyr$bmyt(}abkjj6KNOxgpD+KzD^G?4T4cXVKu!%Zhqu0Yw)afNN6b1c{of* zGU4GivM9>aR!v7mR^cqMG+B$*+yDULqyq3p_|SUGUFJYIZU}en8GrMtDo_I{tyaFDayff53n#_wj$m6K_(c?C?ImUo z+*72A){^DM8e}Isn9l=yJ8bXH-|c!FVC0!TE9GyVd0KTD%Qf6-w(cqT?Kqw(HQ#N+ z=x*K%ZIiA1W7RwOe-+;6D@@xKYu4Y&4DGyXtLQ*ojcpd1$OMZo0qmpY+$n2mN7dRA zv1gPeUK`CBSxry~y%I9k)`MVHa>(v+Yx|Mn1L55H$#&s4qo-)!;^ zA43122;xfcvxqbMbcNCXb`CBuG61uHSzV{RN3}T^y?>uh)bVdX>^8dr1~aeMcfXbT z33A?h>_i5mIML1jC|w?1HemoKo`)IWeAk!8T(p2fmxg?}Q2i#H1uh za1yxs)Aqx>9g1S3M%3&|TxZh6E>m6Y9M3vG&&l_nbU?dSoXj~nkR|oHyH1Zinfj8) z^_QTvh?&g*;r;98=(2+VC1(n7rMQlBMLnawJtYnQO@A{#`&RUsVFKQF)Mj$KX!=?1 zpFQdNH84~h;qSkfnH5x3S$RaaZn==0Xw`nG@wOixh@t4roHV5gIrW1j@^c2VopVkT zggz4a{HChG*|#wydMW}!D0ae2D?BTF*bD(NybxPWpDrUbhwuhh8_UQkgoH12SCZ|N z^xOiz1?=cT?#A7w@rv`1!`}v7z{1RB)=F&{QyJ7xZ;sNvNNEUN9PNevbwo~H6}z&% zOkKX48wpR_8E-u*!}0u)98NBfi~HpB{6cAi|7QDEa;_|6_uTpdd8-M8K^pj)LaCj` zY*{9leJ3nxd=HCK9v)uPD5RNNl>H;sqFy%@?S(%Zz9{;`Y^qIafy1iL#~PC@_Cmi(JK(e#_ zuSQ>JQ7#oFgDUMLQ(TxRt`FyS>Y3t|K6yuMFr6VzRxcM*?qrccKCd~qKYP8pjGDVOE9@|Bw6d&-+ zxAL0bzD>F!0L&yl27EPgsk&w+Nb#^;ZP+^d{nq#wqheeEwogI{>DgB?z{26mIy+i6 zPt?f|W(ruHOu01LP{FCTd*mDL>o6i-E#!#guK)}KznQIu?W56)hKo-x>D`oOYfQ`X zMj6G*l02eaTVGLzSec#+ZN|`wkE`6u8AN`8>Hz)zm+DpDV8jYI7P|im`2A3}-g!4Bmpo~ci z(|Rtk6kgvE;+!>qXqwXz4`jtCP?Z7PkN;^m)N0bGtj=L?e;=Yh zXGQ}3>@4e`yxju8TrUj>@-p`*BHjRu>xJ+Ia2l;k5#x8#<`jawWVti)UaWCBBbHI) zaLL6=rVYt|rvtdTn%*Ti4U!T6XW*X3+YhTPflm6mFc)D%sYl39)wy)t~{J7?N`incfjOn95d(E zLs~{{?bEA$QU;fiHoI;t($`4vQCektScWb=n>LNxBvZpI%uKlxpz>Kz&pfM>8~iY~ zn?NS-8(Sw3KoRL@*UW0yF&-BK{dP&3=+`9{#VXHab8c8meyd}(x@#9K?spoi*; zIa!-y8>@5i8M98vs;JQ&O9(m$RmWlOdTYlv`Ey72hfy26Ct%jXGHgLn^^zTf-{=i1 z7dwaz;d!^Iv}2zM2p+olgzo+lc@Z*^#`?3f<94>Q^49U4Vx8j&A_pks+zd^?pLl*i zGIPuBv?d;N4@r~?CZvlfvKPHaDr~U+t=Bc@jH~PpiRb=AfZCC;%xAN?wL)I(#Q{Mx zRkEU&jEs&gw8MMZZj+a^1MQqRpV#|Jd<{KJ*a=yQ3xNAt;nm-M$WQZ<_lo<$a&CeU zKLk16$p=R z%&VWmw&vDvUv~Qkb#85z@34&@c&xI)AscQU=3;pU@=iS!hO*-d{c%(0q816jt7TcjlDVfTZJNK+fH&K}0X^Y|0$3Ex_a+kK;P)X?=KvGI1 z28S3LrD1>pCV0ntzx%!SFPwGu+H0?0%`SIO)TG}u7KK?@vl?6Qj`)r>@B92-}%z}_|*AVSW~aRs2@K<#;drQu;TUH`y&D8BR|}THl0|s z<3~o1n`iyr3diNb}=lvzdPeCE^JU`>s^3u10@xfjqK9!c#yI!~i^Q65#B4>j&E(z`JH+r3No-T`MctWA)!+d% z#1ra6wAK~ZS^>Awq+(BoeR;=5D@KUq#LV#7@vj$mOIgz!4FA41*P!PF#{krzG^%r3 zu9eX*kcXxt#Z)cJ1*0y?CJiBbL82H->2FLeTRSwKC=mP^iDUhkwTVNfWSI`LfB!$p zcwNb{tTwgA9^D|X0WP21TSI+Y$5$)@+E}Uoi6an@8(dw&f7WdbNK~Xok+=GhQ?E@b zH4{%`2>CW%3$$PPqPA+;$ZBd(JVmtp?8_UGZrAbSR3zp%Uh`Pn8qhd&q7}}~=flZt zi~|<@bvtqgx0F}Tx6>5;YsSv<d2S_^Fc~`#peu?W8?YHcb73+?BqhxSs@l#7wyiD1yjo9MC{RRna_a$ ztDI?&X)8`NX)mv7>i`=OOi+?%+(*a7*iHo4sQR_Wa3tQHXoqS_pka+o=pzt zUwh487tf6=+(!C!c2cUpgroHNxMr}0xXvZG6; z4<6BhR@U0}?9t&g<*C)`seu&D2P}P4UKiuGI@v64w4|}uk`BxarXgyY?rwlA61SWEAf6u0v`h z4@Ix=?N0NluzFP#T_Sw)1w%inq0v&QW9QaBUl#Y-&W5?`^ms9c{*sAl-zUW*rb%O6Cfd}7v ze%iI$&ut$k82A%J#y%GO`XWkVvG%Bb?>{X)QR}-u{hPNbv9yyM5>1xj#bg=K_{h~_ zrL_!KF=ju}1`zH0jl)Y00pXxjZROsm@;xxA4vAyq7+vV7I5+M|n3SKs9?}kH`2&hd zw_AuSxeU-I*4X21RW5&N~!9!saRmA_RIfb3W@gliyCu$Io zrn&5;tESP(Aw&ar1s5E}Mely44GX?`U<5PiSJIE*R`EnrQhFv*e%66=GO-(|>Gp(7 zEFz318qt}u&$fzr-I)`5EM$I09g+7){YkIWRuf@)69qON_}k6#ZH*A^*;BodByRx9 zsWEfdE_EEath6%W%Uov*-C>sejpKBjtjXZe+r`ZCjwgiyd~TWDF@HOcSxew)t;@&Jq)k>_;-imu{4eb0Qrr3|3w|!>cn5wt52e}4*EYQ>$bi~Bb||>( z@e}ITeGljP5IlmVMQ`2rFiozTLyNB7Bon3uJx{!~u-(*mql^4q3tviRut(^HS)%#O z*`e6Lv~ej@_P@rCT>#%Iq%hOPY5DcF7;gcqXBHAFS{RTU4Sb355x&Ah$B$-^7-kySF!~8O>}yTIYOMmsh6~Ah+F~UCtha>lRI`&u zQr{YkdB6DDWjrajm8qh5PUuRD5CU~LIgme!cl%YyfPs<+Ou zRG0-?AT2BXsjU0#3fPqM4RO~a%v5YBknv35jBk7O9>@)qFGnj&7OMhkN^N~vS%1k1 za{LJj*xef)mS_JgHpds0H2XehQw-3UzT_b=gc|8?d~hI0C4^puMxQ0mzDe;k1_g3Y zuA5L9o|@AdEjJsI8Qv(PqOEJtZZ}|ftn}EM(b?a}owYAe960fp?+PfqB+RNeP{nv0 zapg*pQvEjfqo~&B#($JMs>@dgyaXlHy3Bf_OL?3hh(`TeZyDG-D-@6GL7Vf7r}AGjP8P5#pl! zr`PdwutWG5-mh>61{-@BruKX;Y^RI3Nv!?9%?@PH@5fBc~>`;RJGsp3p9teBVQjN=2~v;Y`wl_)*x@ z14w=LS}OEIl}UT0dvt-O!DGF-%G_ttIKx2Pb)L{$I?UY9M4y*VC&wGsft<&H3X%rbiZ#5lhI zDZXepgI}ui9a$Z0EV1B~SNJ^{#_SrI_?p}3L9#@Ris19~o1Hl86qt8$dn8FL@?w^$ z5j~ORl5M3nJAAm83X$RtkX6k&<9gHo&T3?sl@v0R7427b%MOuUUSqjc^YYHhE61Iv z#R%^yB9&%p05UbiQanTJi`t$TC~D;Q|8}qFeXQzJ@wU_O(SL{!96U~*jk;n4@_yV+jzqRa4d7EywFbam90@zD1) z^%{$4qT3&v_#V8Qdfg9)J$Mp{cRI79mDprr57+nvjOUl3FYjGrvalomczu|C?7kmi z{QAEUU5SxmJ6HtSdj`e8PQkC^v@-9TebU@uH6h)cUjvAKg3ACW49MpU>MdNm^ejJ| zdp&y*I8iP@rZMnAXAAb3D6DNMr|gpxzll{7x2(DvV9@3J@NEZO!Hz7vp3%g_qLMMm?vt)(Mm+@{QxD=%)U``3m{P0ese>y3XK z%DHKLd-e>ZdxJ*pSiOwHL;2ox3*~M|k^pk~CE4{Ndii33sa2oSdlu2K2J|A5B!S>| zmk-tuDQ)HRY~g2oL{_2VqrgRL8mQ&z{By`_YnqGN9sdWl_&|&mtJfNu#A9u*|A@x4 zw(Oiqgre(>V1O+9$A&=1=TmRcm*PV#WYBP5et_3`=WOce5>jr$s32!Nr_(Zq{B-T4 zdZ()tBIYn<#eFP+E8}c(Q@loSsJX8a#Ot*p)upC=j&;wdL)89-f;l{#@u4G{m_rVf zT7YpKLG4F1==n}~`IRvdS>Ny;cg^SL1D7-#_ghA^0HyP@|M0=IaYD`aG3Z3au=VrE zbb2~IX}(7&5k80B7RC2=SC20>OUC0LtfC?=z{D$?M#P3ip5Tu^ud&^|;Vx2uqmCOE zT$T;Jo675%9%N*^Fds#D@#E~iwGGZfR8Cyf{m3Zeo^t6QLhUv)OBtZ_4wzoZ%2gd z_YU3@1(L{2Q2?ndzp_CHjNp=NDsN~8YKK*D*a#Q+C&I5QocVecIE6lwX2ZU6Qmu@B zm`e@Io_&5$-I^YK{ikQ$;VB(xncI3lQbKD)>qSzhW3ya_zt4VP8GKOg?)Z_Sez`*^ zOVLu52J`bfgV$HbnS`iA3k|?2;d@P}0w7i)e=I*Ypc4kGd*PI)C6lJd7SOZ82U~vA z7^2obYSxH0aW}1X?K)Z*^xfpX)HHT;Z9vS6&mPzq13Od7Ua12k@*WGqX7Jq<7&FW< zd#(zn6Sp7SiKu1=7Mgvw`QQh?OCfD8d+pC3VsCJ+@{ui)cNF{{IHBy_u;F6t!i8s; zUCPf|>|AeX>L^_g66^;4wWtVZ%@T}b_s6HfXQ)huwB@V-_ zV_zINf3)?!s@AEke;5x6zw}in{GOnfk_wb*Rj|l-slo6?U0AAIvY^#-AY7JTSoS;e z6YH0WF{bOzQ!MTf)~ZpgKApo5_4$bX76X%TNK;>5r}Ak+f;om#FkQ_QOF#NG6p%ej zL4SNsOO68?woB%VHMuJ*ss%rj0_#l0+g%IyL>A6?YhE_FDG+SzC{F5)>8~^uDgDJ{qnV@DMl>P^vtg$7}g~vTrHURNPbW_ zv&nTxw8lRwAsj=}}Duy;E_FA0a;aTD8DHhEjQs-k7?Qyh+K;GuRQJDJ0RmNY18!IB}T&eNo>g zCA0D0n>tJ(y%GK}aVH{kvZOt>NU>Qhk(Kb~nl5f+^?DlDYg{nwD*DFZgz=B{6V#F% z8FNA1onzAIa*p}lJ5JqF@bSPN;j%AWt)X>yAm2-XkZ)cau!`me*ag_T?&Uu7&K%!^ z_k^0a)f3B{&tOL^)xlq?*P@0B0Dpe1WjHvdgNaj&L~=;U<4Dk(`XhMiXham~*^qbB z_A_Uw;9y@>g-w|w0&zNZ8f?kre1|Jv|9E~7N{*JvZ zq-c&iSW_MmuH^aY`J-LKZ<%OICeq<@O=8WHm2O{-Z#4}X=uLCxp&w)0&zbz&VLvl& z;`0@!En?}oDNp>^ljt`;mM>tfmD3)&mPKdyq;+5XWV!J(4Tbm1wHes~dqdC{+Jhcu z*E*4BrIz3+T~ZB@7IzSAaY=f4VF7)c2Q!`m!&dq}UlIQ!52zvvp0P)cduFJ}V(4W; zK;4eB>Xq%;$xu4V5cAp@w@I^D`s56Q(-qjaBr$Hn`9<<{0Z9G>`Hm@Y*NJrB`{!g_y!|Dq-D z$pM?7gw7YfVblIMmi@`yKKF_+S*fuwd>0Dw2@e2#pp^1}8Qi6^^Nl?kuZvT?J#kSD zhV#Zj&w>F`0yP7N{u6^eOS~*@=Ycmt6Pat4 zFR_Bp1N_e>vR}o2cMeli0=y#6e|_9XHl6x1T%(Emj6XO3Bs~%b0AAgVG7#oNnVc@B zbHJsfR{L2bV@2Qj0E{keUh3ygY4XwN(G1$2CWh}7EMRfnP9)+S#eVf{wTHWB8t@kX z$}BNKI4YQ5r$&GD&RRS5rxp*~=!_MJ6D~jFwC!Z_83ES&i@hj;QhShS3&N0xSGm6j zlp)wrF8-OZk=&WRIzMAu{=##uU&x@~-5+~Z!yP{9y0JjxK_=^V}2#`H>Dz zYpBx#;%1Zax(XU!|Bs2ze@5)jbX@5JvJe?{k3|w|7b*7J`JBe0tf0lb>zCBmN}HS- z-BDtWZKC6Ad}E>Xf8WLL!j{cCid##@T7RBFgr>*AygEIrg!tt|n0?r3&1o3RO) z%7L?f^YZb^j=j`+5Jx2&fg!w)L|NsKXV0qa%=bS(L1*20E-P(v`r`5hps3CzzP~Bh z_V*p17z%x%dzJ9mzNhY>1J)Sb*z^*1Y&Ta#pv}Dg#pE7tL>q$hd`n67COTXRLcOV- zsWEsoAMDmP{&eK~kxOUw``cuCIRQ8e7~Yo5j%ITJJ(BJhn;B;Y4(g<$R?6>{8ud^v zOo_d+`|MBSJu=!wz{)MdEtj)E59}Xy#ZJY3j;T0}yTIOE9*AM$7YX5D_Is;p=8Iw( zXQ}$Z6SH1tlj5$q^9~F5;;wUcriBI{$shTu{n@Z~_p0>4Jl;$C+B{D2>NR5k65#KL z217GQe%vimly{l(^5v~=Tt$f^WN3=yKi%1GD`Vu!vu}6FZYWQSuUT_%J>@|m`XLnxcF>FGjgr=D z<1i=&NSV!B+}KBdS#9K1UQk1mZ5_!<>*Q%-jf z*H@%28&{jsnnQ+NQez~POrv%qCxQH4w(2iKGaJ@oz#P8#7#Q0s1>RrlfB2vz1={*& zB2<4FD{!()Gx@!EXOF)0^#zNUEYH&cH;758ui!;NyVTq(KRBExGq-iQC2obM+-W|` z{#>K~Tj!+a;fpPrW!kDbU7$Z<*(9XacLWWv;wE zrSE{kem_p`*=|8d_bMxGK+!pp1;6~GK*Y8hUUXGMDeezAl%i#F&+HmtWC1Z{lqV_VyaDgr3XRCwJKk4tQeQmM5<1m;pU4Yfro%LaA?$08GUq^bwOuuu%X`RU>&q(XH>Vl441m( z131T#M+khjDF&0K^O$;@o}rR*spCHT-~T~Ba;u1<(j7YP?V@^p`VBrlO$r@3EDE8G0*oTt7#nLHcLX`HzvJR`gq z=WQvtOo!G7R54$SDhgwgn36ib&8e^e~-g9!6Lj z5;s+^P&kZy0akaFS|7XEG{^hZ^hCA|hVBnHOp6AD+h;|hd&`#Vc07u*EW z#(2=J)jP>^jP;?vt#Ok(?#iJh?;UtGJN7%j{|bi);Hy+=a} z<=g97#UGe$quvJNxz27AMdt9ZOUrg*YsNsJzH5Mwa_PC%goeroulv!=WH$bdY8n%q zUPV89A(x+Xg5bT)f1(6m(Bu#ct@6!*%-*LFEs<%T=J|*h_}zHjBE!vu09>C2^C~{=ehB2iJ=dkPaPvxFdJUW=3X5fL*4>j?BbpI{pS% zC>;rHrO7ICV+B@%4@Kc^g|kjo?2+_pJ{hlA_jUFNuhvjmGjtlsr+)WQJgX1pr22W*H zpNr1Aw%l-oh`10T7?dMV_g$nfTU$rid@`&;xx)MuR2FGR+m>__Xl8}NKtnIC#QphX zu6j-yhw{wH?md?E5bAuj*|CZBc_8A01nTOY@}c?h#}dV~GAMcbtffZE9QPp=c_g=y zx(-lS<)%RRL)NIpggxMe%`&hGm1i7Gz9X1l>Qr~pI1$Z8mRl-7<73lp&04uPk_Jh{ zz>S9wHr^LPU|?eATH{08v_(8j)HhdcHv6MTVCgxP@x-U2vj?C3WcpO7+DOB~14pLV z32D)eyT%GSfOh&&?VMPH0g%d_7Fj+O!0#QnOn?7S^O|JPA|L!vATQcDj!Qpj3i>#V zv8j;68A?j>$Nt*w^71Voq(=C5!G{p~yGJ`T80A3rPdP?D_&#{$#S2q6y1#AB)*uxG`ioA(Wo1Et)TgnrK`f*03WQo{->NtQ*M z4iS7B=?Y@fT{;7A*#tKugAKo)g|F;LpbXbvyZrYBJ{vdQ>9gNGn3gUBm;%4c84Tvz zd3I_TwCy|Hw3tHdb(Io`XuNjR-xJD8?kTCM4R=!sRg&!Ct2r?;ndE z*rm#B1*zXPj`DpiFW-|QYmaWE3^crEnl$*0KDFdiYt{X8!0bGC7?1h1j{_SkXW6fX zR=3J@Fez9`cAq_~{3gHv&3@B}I$8D6cQDrS6ZM84c6rBMCK_?3>-03Dw+s;3{Tf^g z?Yw$kn4?W=|}485!Sxu&m8W z6^7KWsmy0VwNAN71ufE`!OYUX!i(#pj||4}514CHqhFdA0c!f(j|;Vi?pHV5#dn%l zq-rwpvE6OZhyJVjN^9dEensGLs|Z|O0Z509%$Ha?MFQ8Dyh&=L_JsLrTic;IINH&> zeWC2&YPp_x_!4hF8k zC7AM^ESVmRF3973-kvv1cw}&;^&%YUm7MX^E2&+d)+{>sWIMPE-I@(t*-%qIQ9slq zV;Q_!&euhtIzNb>ya(y*m={R+5H7EgRx;N1<}~Kx8@OWgrpnE^h+V5H$d}`yce}l3 zj5g{P$40$Rd?#V~{$H^a=1WOY=`o*;p`Rjz9Pbx0lZ9Y~X94FEwfiR6{=gGjE9wmC z5Rv>9(N963g@cMno6j(rx#lG-xlR5tRMW^oF9cR$fttCDqFc)TY_!HyL@*%EieD-o zYU=$Flul{K3ftmY< zFHm~f`fJT=aCN+f7sj&#na^@wP>kg5D#I2b3D+wEBIXqJf`ArY`LBhSg>lt(NnZhI z2(*fdlfSlrTM0PQ@#elR?36KM#l3hfAu2+QK!ElDJ5jM?K0bDWiuUNqk*~PUNO(fn zYBQv03R)%L`}L^9w@^d{ysy%D<~px7AVKKw29j)?#$V1%tP=Jl>(?nLU(LedhBrP* zpKq&wnEvq$&B2R@Xr;4&7=Eul{{G=MH$XYn+fPD<>PBmFKPpO~nqanTz$4uY2DnWg zoQ?|~@(6hHejDf%h_`9q!G*0Ywl7!4OjLq>zu!jgd!&fVE99fTE_U)p{+YQze2XLR zN$E8Ox_51_NGXt%+f_y0^IW&GC0Gb|pZHJkt&b&-ZQq^|=b%)}YopTlhxoZ|h2dEMOXb9}-NRJXp5WO=yd14l1x6v+G17e8-4nx$A;yQqB0F8NOXV73f|a|CFje%7RYxQ0_1HPEp8XG%r@_TaZt@-Qhf z;jtD6VNz}u7sFAPQrVGXIIZ+xK9{~JsJ#PU$qKOF!MafTSHD#A<7-wdB763Ai~*;=y5EcF;V$-orIH$}&YG2a`%z$ujaS@`J@3`*Yg| zHNIPX_225AJ;W@N*gOjB+4-qEkOv=9r%?2>La6)WJvR=m)r0i81KLr!W)Jh9kiRb= zs1j^062xylvE$eVTh7zMpj}?H`WzHH36mUTn5cJDFi6A#@@VyZ8FzH2G8@Q=eGOX`HSk5W|P?Nd8OqVm$!pJ>T=Mz0yOE5WoFHawG@u`_!jko zQeNP18ffc=sH^mU)s`pf7}bgcBv@NeC!@kWWQnilFLnD?u&?_6xB$-JPT6|`iO{kTlFiw2`-_Kq)DqrPeplVv|bA~c>%`6gJ z?{k@ly|9EI@Q%&(2nD?#^z`wIuU8P5VMgKb^C zbN~3)FkfA2@l8boX}pT{;aV4CHJRlwB&l;&1!w8gz8(ZXhhb$G87lOAQX-Sw_tiO;y}iZPF+)?Ak}Xe;x7 zpg?9TWWa4j+UdXNacdiOG6j(@`AhnJBYI=E|3sDvD07{{ybN_IRea(M(Xu#IHOGE# zriYoWBORI-em&dFEb5-iOND^tfs3E^`qjM2$Wq6z1=iJ05eBLuJaO&;-+UAacZF_6WZ0GQ==#NFfs zoAtC{{>=Y4rJQcv#K{tvI)-07PKYFA%A9)#fLsJD zVHJ_B<0+U@w=&T6WesjLIVvin3d+2tIQVqHl^{r+iA{yBsPwh)ZFaL$`~HmGquRBRPYdz(o|8^j3g9~`Ea@#4H$Ma@j0rp&d zz}w>qYXsjBOc9i%dsZL@dz~bqM#)@aTa{5_Oj6qc$yGKTnRNT0rf}y$+$aG#%^*Z|VeJbL7IM z_hXP!S?+czwjvLdEB8L5h!Vw%LkD4IrT0v#>VIzeN((22PRTlgGs4H-9ifk_#ed=F zLi*sZ!mXiEa2wmrO9rb-bYcr%MKGMRq7m%-Y>ZNgSv(sOINrbN9WA&t)J<#uDc>ue+KngUGYJC*{N=QRux}11|ND_=+vu#89ck%`3s)MQ(rY-)|;HapM9zX{K1jQ%`UwHPv* z+3q+iHk)CUKUTu|M3q-*)4A`otZ2}_gzr#_j$J6o4@0VEx%5@wtgx36Zug{xYfflY zj)&4FpZS11+3pF)$F@PZ^OCi+uSj$gU*@D4Wa>HJL{mZOKq_+xsv-r6e=PDZRa`cr$!o|K0xvPj zZ%u8ziMY@C=xS^3pU|QH?mSws zTUqZdpTdfb+B4sFL~Tw3uinNW3WyUIa;Y%9LPG;16UTp>Wz5Izuv=0zgP#Ea7FR_# z_|^$mlLx~d$lzghAhvZ+g{k3yo(=VRzYoM7tD*Q#?x_x%#V>#2Ixz!=hh|plqE&a? zT4-?h)cD;PH{FVF0=Y>qsk{&TRn^1icGY||hE%t4Z1YXNlz?j_9dIER=f2rizLNXq zVNk99d32gdu}f`Wc6wq%-f>3_J&%(by3CzoNYw|Gynib7g!IAc>iE2nq=bg=g4MrU z+S4Bj(7#)a360triHlzE5vl}=C)rKYzu8GJ)*~v1t#YFRYn*p5_kSJ#nVOZYj!c2B zw8)*H%*edXWU)ogM6?=uVlwOAI zQ*TJ__8xI(U-a#LL7W8n(%f3+U{-U6^Mug1{$h!xe0$5fpU+Bf8S&m^kaVslpQwGd z`xENJkRN}br+Vhr!j`XrCi#**=#~Q_*yH{##hqS&jf);eyxiHyehG3Smzd@0M84k|8Id9vtNCrwRTF)j z93~4zsl1ix_X7BVGnTCy?At_NFJ?7)HzPWa}Bl;_I!2b-H7gi zi3mn$6Ei_#+nC2pE|0Lfzl!>U2OSY*Mh!Nrp;D^S}3V@pfuIv-E>E zu>`dG7V-9n`JA;Ttw057HZK32S+Zp^Wnd2o4Tz)P(nAgPPaXX zs(iZOS?)i#nks*7;#$b|2NY=)kaVJ_)2CnsnrfSZs;}g_&tD+gs%A0ze5LUBwjzYn zIPp)a=};FGjsC8Ir!)s;U;tbDsp7}j%LJ2lZ1J^%jiBYBbmqa_%bJn$N#@%%Bcv^0 z*`+DJ9G8=e<-+u#`gW=PCXLe0&u9(5acbRH+u?>w_RqD*3Iqnk3S9Ks({e_rWau2P zzw;pFd8fLGd6yzics!;JBX4p@iMcCltL3+IkSszSAB^N=Cxcu_ko9mW|8m&rIa=xO z4l|A*1}@?Ct&10hz{2y&11Bx^^tIT80_R0Ejhzl{=1YJgIQUm%&+>uTM6rb-fA-n% z>t}WiG9zgQpZAnq>s*cTRJRgVuFWutXQ)jEZpWhU;7=g%F3-mlio%~rcKA8&JVH4Q zJPL;%+!ZIB9HaMTw+Zp)1yEu87jv{5P;M%~a zdwr3x8N^jvfIWDWm#bF3pz!{ED(LU4sc||*abs@>?*$#A-Tc*ZNyoMBs2oEIT%d2p ziZ6meW_z&z%UIRPSqetb{WVB=_QX0SX5dINykwStTa9SYl>nnAw>>&wCv-h`_eo1> zRm#Iij7{nBY3}*VcXh#*S%G}|;(l()EGhnayw~)dwv>y-Wr6SNne5KlvY?JYreF$4 zvINi$aysvMGTZSh>1@s^`i0dVE`0Eu*j%%w>o^ETPRoKp${iuxoWPi7`h{w7lDO#Or|?|ZuL#o-^Ia1c z=35m<8OoP2C%ePL_TLA&l2bJ9@+TP1PYmAmDz$Af%+-0C%_=695}f&9Scsyfkrf$s z+coO4CJs*3R8De&6}(u0o8eTmMk&z++JUhhkU#5no~oU~E1TjT8gI!zHg=_5ySi;> za^vBmfkJrLfV%BY8r!gIHTiA3yk7P9S^-Vr7XijYqFrn0vHJBI@n|_vmskIXM60BA z$~__t|9l&f7q)4|<4?Qa0MxJsU#}fFX{va60Z?FDh|aYZyk)*iA6DyQ@XY!@Pv6XV zuleTi_f;T4Z23`_d3#7sCj1mHl+PqDxfJ|u%zYEscC^TKRHlbr`pWakAYkTD(R81p zmNgs~N0fhUL*Hdlla_8x^d8b5(BzfAqHAvHWblq^pwIcb@(z_kA4VF>4f08u`!Gy- zz@t-8g;@0gOa_-T*|^KZ3%8J5;IZfVFFp{ls*;I6Jw%_ z&UbR+#*0;CyrQQv5LJ-23d9g{(b2PKwq{&Ppoa-lW%?cHB&JMtls8+m!il%mAs3 zekN#}9Ut=C-6$c+V-;1N4W|&*>DB}xVUJz=xW3*}t7Tm1Y%@h9>?tS&YC*4(zg=+F zDSY2fgAQ-7Dn@zc9{5yhUO!%G{kyWebDO3KKK#(A+|hs3oK@TtVm0@yE-OHV*DB6R zRgVV*p;O!3U_0hS?Q8;4zK&Zhwj7BxHr1+n$QE|$S&S_kPG6K6lVo-HjEZf1laUGU zkRtCA6*wGN!NxKqbnWx7^kzg704qwSopZ47I=k|=5b;a?d212Lcf*vfMcK#SHAm#> zZOOD8v{=8cbY{D9Cp~DIBdz(1iAyvonyTxlrNA*Lyays zHdvl!VDOg&%k=u`yVr$Ga7~A60U_ z2dh1N=t;t#t=ib6eC|JWpxE1(*`GB1c5E=Ek=eWCoa1T7w@m%6_IwFV(nZcFvS@hM ziYSf7pdUr+5{aOcsWfzqRD|M_f3K1cYqlgslJZ|q$4a|vG}a9>qyISipm7eL%+`6| zg!>H+^QRtbDTj-elUV(ZshFw&*^QgDrhNRk$6XNLRv0bRHvoB%M++I+d23{`c_;6{ zqu|$NKtKFvC_PB5+aE<7%>woXJeijLN=AaV#4o5zab5iRYhimOz+)&z23f9-`3#2A zJqpo*`V~?)Svjn6gTI_}Xn7=sgQl;XxQ+`F#XnA>DgtL~q4Xs0`c-OZAvkUy`v{`5 z`UA&$)53tByN-`noN6@h0Yma&ZX2YXx-}%@BTgvusGtUHyYSBL2D6{Q8v$$y#ZA_# zcdwZXC=AEs%6Z!bmusdV#>#aMcU$uiaaM0uKr0W}<~$`tJ_&_h`{(aC@V(V&zd*|T zsAe)|TD4i<;t+Y`EXg%H#trZsz4@k-GjJ^-uq{NY=Ggh&?Fsg)AJM)GjGcsa#4)Rh z$?x53)SYLO-jtDAhwP;2xOCq=9+=jN8kl&B}%Xs4)|2ig5DR=%I9^8av&{{!^|&KwXzLrJoWbrSndvtJPUu zF*qFXqZw2ql;hLFSe0&VygQ<1J@fbq1Wb+Gm-tSw6VUn@DKoX@zS6;VbONDy@2TNU zH>m-QZw(OwRvL)%Cru|)P|?`g>!#jvT39c{rYGf5_!18SyEG} zf=94)g*T0qpDNIes13KQ6zFkk%Xu{APZ)4P`IvctKbWNa&fWEJ7n%1lO--SWov15g z7m4b(SHIX@2DtBA!a6Eg8?|06=N@d`kTv$j^sT#Y4P@#*_3wvsD<-8@ zC?E??UQ zMc7~SH3z))5AfG-%$Ad(5xb5~U;9-Y)tLniG5i_R|;#2@@x5#BQ#FOjp@yvel?J)GP{^yIX^qgKu`BaQ5 z`JL^7jrXs=7hW2yG}_5Is_Q$@K4#!J;3E1LDTmKU7yA%&DOJLM;`2}}d+nhgT3ng& z`xG=7f3zK~@Gy1ngnYHnoUZ0qC#5_J@YE&;A2eWwis){ZCMDgGI`gXl!!o9&h+I6z zQl>)y1xq^E92ZF*4qvL(ZbmUUZ0 zb3?_BDn1&PyjoLI=KZK^d0LUJ>kgb{ z{&A7gU9_Y9a8W=dCrPj;byy7MAT&7b={HwJL0kCmLds(~e4&z702Lt0R#*+saj&}g zJd_ryD98^$NHovnpSxGnwQQ=U^IPfCMOnxG>Xs=s#R{tr6wO?Qe{VX_;I_$sE9(@U zeKx4E7n;=$gukZFV_f>#f;4suNjgfh6G?12wXiqXzbI#R5+dFIc(H~okX3i9&*v%F z(mu+JzB?OJB}CAj2S53~K-Jj>D|IY;8a*R-Jnw4=0Ec~QbleQL0z_SIQq3}vqLrO^ z`pF;~#C5vhftm1v=IaM}k!F4m=K}2_&tF``no#o{%NAA_n)@#gu%1THQS&e5R5@8s z|Gu4V?(ogUex)X)QzAj>@^t1cal`8Nu{bL}tF=fJSC*S8Lf|bVsNVLRuNfd2K;npx z9v)p@^KVg_m@Ei>*?KFRX48m;rTpTJa=8gsk7Klvd$l8SbFZUVOKEl}amd2SCxBew zR@JGD$F7aT%cKR^#Y2}Gg;YR61(q&}!3=2Pus?$hk1rqYag%^RKf&~KkI3v8$g8j1 z4!4o^4*SM5RjJS23|9d15ae2^@|DM}a$?4|1U0_<%Epcm92TwHuCP7Q64y3By%f zJ9c#`3#JUEFoHcNuB=?)eQ^Bw?!YC><#G~b09Cxe!w(CVD4FVuQ6MxmLbi5`gpmVB z{x+<1`O|@(ag?TqkK2y~9!nJ?zy-B#sIB^rUe@Vwg@2-s60`KN$~Ch``J6rIx2rl9 zdJNHDHllsq4oR7vkdUiBId8|+?-?Q>KKPV8!LBky+g&MOI`C_`ilu4 ziT(LfXk9H}j!O}XGhY}8HxEFFu^lOLv%O567L{zY@Y)-;GadwA*LrjaB1ELfdLvOkXwZWgWlCC zC^dpIz`mS3Ph?qkQ#TWzdIK6;hvfRud#5(rY867$jA1l2!V@R89J>ohBSnS>%eqgS zmq=1$Q6X0)|9@p2*pRa0X0-Ro3^%1RG=@&JrToM%`P^UK2{Z2eBtTY8rk2d8_N0=_5(oQmEb#ga1?}%3-X2KP#tG2 zKXy&$WKfa7|KaH?!=mnkt|{q8q`NzmE~Po5F(pE$sxTYD;*AXSO; zUB{oue}6k6<2w#JevXJTk#|T;-!EEW_dYE<9mE*e%~09zmpXeOW7`wTzfF&PfRQ!a zZTfBL6ng*-<s?D@s{vZrZIL*nrVRI%W%lv_H+_>iAwRU zrwIG*$|LAYhk-OH{?UiM@U%yEv{%k|uZ&nx%s`|yN>h(-5ifw4?eV~DziSm&5Ozb) z>O64$qP8m+3}Pq<{_K`nKap7&^wg4`c(Vn)vzT|Tx-*2xt+xPF&g;C^KMj)U9eos2Fyg4Nt@-@z03{FGhtK)K-=k+^GAS%J5M85as`FT^cKjVclNxulerE@bX( zj%AN}{%{zyR<@&Dm+bR-!!0XV9ke%p#r0H)75bN@=+;-c7j|7R-RN;8u{a$N!bssk zm3DzW+?09OW-j;FcS_8!dGrHPuckD`pGI1RGI;R2ueJkl70ah*Hhjj)!rq_%PW9{R zl-4&3#jl3onbmi=le2ij+v|qqM3@3^#Hgi}kXSMNnL(!ae97vwap7gx<(E$IzMNub zQ>C@2NjY?ObGFSuQ?J)~x>>|W!zB-?Ab&KvT4_8=PgJ^Jt%_#&d% z86MSt{E`fpUTmgLiq4A!fCY}feoOy&O_U^#mi1!Ge5gl8 z_M|x!u3mq5ZLWQnYFH4w?zb(B+5CbDr&)rf_?aeh|ADj^sr_jhq0tZ+o|*Y*>H*@y z=eIQ(cx-7JiR?t0zh0tyFr-50Ql%v@3T$SD8zcMRoNLsU0uKkjaXPX7*_ z9$JZ`*baV9qVW2~g*HX$_3_xGnn{_O;B1?n;_V}W_GPA{%(ySad`3;RVADoId3kqfdpFJXma96D3? z5*w|)GHO2J5*V9t9V93>T(jJDT^cVC0I~dU>AntPYKV8k0|rPVwJv$4$(}#JEspKH zT84Ua)9)w}umW4>LE7mrEnF#0{s{+2yKMd+7vORh$isr|5L&huZFXy@rxO|El6bUA z@E<2rJM58Ea-^)~yCaFh5>$WsD3PrH@L|U*4NjnjaeJG&aVLQ>2pPM5rMoD=2fO-+ zZ#aUjUzhb$h9J*sl@dL=p-|KpBCWbz`pAx=8^*AIbY7L#_D8921e1sJJFsX@2Zh$YL+o%;9iNdQ)D8D` zG9%shkcLHG?sE&3!6nN6K2HwAQ|slUZlsIA(VYXB0x3=+3g}7NXWxSQKiww%yRgL+ zY4a$i{7$J9ilE1w7jz41tv51~weF1*{(10mV?ch^X=z`R$hQHuv@n798l1kO8g%u? z)E&Vy_UhU5{3Wu@>vA&*A6L2T@Xp8nnAXPobDr13?p<@R*0!3g7%ef^iP5>(<4Wr) zFaN=9`Gn~5O`0Bje4X`pLv0}P2LI2^0kLY~&5vHr_Lqn?W1I-PeFixgO!S| zEuqoQ%FC(i4G)VGbRS+8>J!(_5=}4u5#y-OV66RE7~oCleFng9`)7D)a#i-(4jUGX zd7EqBn|F3j!@u{f{BJM5{fvN)_}DY~=lgzoT8#9)tJU8XQ@1@yV_u#K0^K(C`qxTVNnSP%ha%b6$?r;t>eaP0xZ4}}dVr+|L-ylfJ`&dfY zX0BzOJjw8FcnC{jRIr`XmK34vG9D)cfQJDgvg+l@p<162Y%jLCL~b2Rn=F1 zCs3wp0Uh>G?9ae%Hmm*DxK42t6h|J~G#_&05Xpf9eE(}!u5plxq9~MD(D2Tsgz0tEzal!j};&VbF8o)|gqe>GK}u(V9>G_BjG~JPO;+*S1?HFn&vYf8c=9Gu(+B<{Q84RQZHry^ z(#X3w+}3|B-#>`^l?QH_Qxj1Q<9*qA5C!#Znb*i(BMAUWC}$6mQ0HnoJxm7~o>G|L z{KD5OlCUjZi>$OCfq-hiRePC!xKFsk+a~HGivJnn%xVCtXCl3 z#d>#%w5N@tm2)NHPuk=QA$Kk$v7q9Gj}O?r`Eq1%@D45XVYdqRL;HFn+4> zb{?&Mp-i@A&PS@4G!<x0!c`hT5?FP4OOOYE$%O_AGf~?K^c)kVvVh)m}YN*h@B0ygk}%AsuqglpSWp%(K~0@T|&Ov$2pF9&uh3ry}BM_N1*{`vW+arFWb2 zV7L@;lQpUWCZ)8Txea47s%WrPUwYtrrRNQdP|5V-p1wA`syDjQi0$olsjT?r)2|pg zW!KJgy>nQHZ&7MuK7A%}oOyKlOCfpcHtiV`OMX5NaaapudEZ-!QFF;kSMFblZf^Xt zh=E%y9fZ^rg`iHL99ygPA9@Pzp-xL)jdBI-UNsooF#74FzOO9vtVEG+kwgCnezDK}MN~{N@<>(2J6F7{t z7L50=LStQP!(qExt~ z1~C=NYp$!flPQjhB5?H`#wC*st#lqggh>G-cUkh>JRgm zDHrTVT{v<2E)s%nhY|=1?g~h)Sf=2ia&;#QY>2veDDr?W)eV}Am;pQ&{v3c$zV}hA zmD>~`alJfi>=j$UYC{a>Ifh2kn((M4J?w8%A}EF3)z>(NjJZik#LIPkVg|Z*rg6Rc zaQP@{bU%|OYQkGKWNjKBNq~9@lxLdzn=j(Oew^TWwc8sfWd?sxT@yy`B>NZj+MEp? zgY8afAe*GXM$gH(1v6s-t>ISGUr9j}zkDWf z{8Bics(+rh+OwKoPr7Y^r>1(e9+j3emMP!EvqwdDkx_+Gtacl&+hF`SEr=K^RfH@C z?3n9_N2j<*i{dQ&WGvp&V0JAvD_fM49eRpH-9CUUb(Ecv31bzy-W5OdxH)T!+pC0y ztXHP&?otfRyu>Vgu4y-gw6WjkItR@e;vC5qug(6z_V$rYE5e*;`@hJpIQy6DR2TX3ugHnyNq5RSLy^jZ4OFAYM)Dl&lYq)vbxPpo&*NFj!M$;bZ1%KexYF_b;#>({1%y-UW1u=*HTPh8~De` zMi-bdO0}^TcB#kzW*GzlOfI#)DrWf=>$@_j;EHCK3o-T_;ujegF1GggoFpL+=zqxA zYY$s=$?rS-tY*dl1}QfxLE-Xc(5wnlAXrrNV$l^{0iOM!)C;{?x3@g84hEHZ3wtzi z5k+*+PDnD1qX9RB_Vp}MNM^K(Mfr^muc0v7=~f;mw+AfEf4$~sevQ5%?V#t?wt>f- zpbo96Axz2zvtsL1ZmDuc5Cu(0s7{gpDov4R(Btggs7z17Tf_aReaAk?do(Ssa!9jU zpPMw{hf5=`&|i32&D#nlsh?$R!vHOkBt|As+WW0H7HV>8O*`=g-FMTE`Ylg`xCThe zSAwFZ8;nd8S}$A=};u4g^m3~pJla&g*X0QKup82T*GP~1LpBa`^D z@B^;b=lWEsFT_c(sv|-p??Z7<*TL~7~5mS;+eyn?QH{3V( zNnShe9lX0}toxlt!lfRME@~B?|884t*QH$pARL0W0YB0?g2g~74HuVMSZ13aH?n*m zUDvRjCmU&#q;bxQku|}G`1L76;MN<}meg3+%wirR){S2^;D3s?BX>&$+ANDiH0_f} z`cm;I7desEGp$4XV^typ7?$U)-qdxo3<>31&a!kF%wDCRg))CLpr_|rG9Y^`W~7sz z%8q$;v>tH;z6rY1TR!1@qNZx!v$d5Mgkr_Kbm7C?b-048ug@kLg;pjSsvek>a&}i27Q5)nl5y{EaqJ{e|G{`{>!SIuE>a;!Y$*gR z%8x-m<+{QTS96aN)~pP3Eb(Ww>}WdfAbna-^fUVe&U(&}GCw#Uc%Kn(UW<(~y z5ts1<09m|Hgh(RFabfjr_B`{BKL@$&uKA_Y02z<|}g+3(^@FHJV z;UAqmy#eOvl@}YDLVR27WbPlUKI^Jcv2CF#fO!!l7o-%|$7}gnzr=Mo9EH|zR%bAJ zIM`)NAi66JII_)OAhtbaYmoHaS?!MkI%MR&^W=1<&Y{3#6ykB>-S7)C8?y8@K!3~R zW~8%eI|ifh+4czU2&vEjA-<}7I<=9Lo{%uI09>A# zda48uCOr{qzf_`HVjXAH88k+$oy7g~p_b|G|7S3C{m?k6*(A!N?}K{tZ~i5Z+adK9 zq=~7a)Zi<$(tgpAb?$I$<_=FcC1 zxp&U>(36b}i`o#hp2qPDDh|wvwKb+iDXy=^9ayzi);$4Bx_O5tH`v6V_h!ZBehQ%g~NX0c_%8+=`BL&;Yzn;$8atY`?97fh^| zZ~oxO8yG^x`2!PL4#xtl2z4I6H~V%5-Ul{$R#_tGSuH;06E#YdUoWw4@X!kcEKhsw zUXQ)#B(?)fI%X9&YDmkOGuO`%yf+J=u5T`WbF-3EX{7_*17a0jbd@Q3&}4%7JN7W2 z6T2-PqLqe?1j$6@aM$LDBjHl5n%h(8v~Z-=a8S~%(33Sa-hRWYHq+869FlD-Et{loA|N=Kkyn{EfX1`=A)+_g`O8JItF5B$W3y21SH(vp2e%Tf@=eXu_1loL zB_s3;I|V$^3yN@`c!&p-qgzNS^!o8H9}0)KU<}Z;PkU&81-Xw72SD!!=aczb|YMdbSLv%P25hX!Zl%68W z%BO0;FB9=)$J9-Y=kTO=;L@PBOfqKUTVoET%Q0qg%|=f>sQIx(x?Rs3@c8xUdGD*8G_{09pe0)ABwfec>ZZ&&ago^II?mpCXePSLc>T)>>q1I`wUTi9LtJow7 z*{fnX!fHPX-l~{`ks^tj)?deuZF1QjH%_{3_GJ^AG;ld@mObhI9B@^hgBspr3xg*2JZJg`2n0#y% zl->bm^jJ;!F5}C4it}EBQdOBY|3cI+>SW~C#h)4 z$j;y^hlCm4bb$Rt;a-7sVWQcxRhA;DQrhh|0<@3DV=F%(9e`I6y_FyfO{*ha?M@eA z!B;#(oioaX`2@(eMag0^c!)i(;$5#d5Vk5c)8{F{>pUvjiYj?c7iB73sAJJERos*8-X2`OLR1otE-wRK1Ak_Dsd?yA& zm9?}=1ms5_K+ilRx28uD;6g93NoXbFQpb``*s2Ou7}mb1bU(G;gVfxXceqvvE=Jon zWyd3-)I#G&%eeC&b0s}zN7cI|x}b5?I=GL_tczL(Yf+b1@@7s*Ot(Owuw->^?sen}32Z^sBKx!duN}Q<8mI!8%?)+So;5 z%Ofu&P}Wm#H9=$eX4OORo>y;svWDI&=L^mJN=?pV$%1Q!dDZqO+EnY8 zGY@NPONU6yFP2kf`5jTd|8m!SFt0}kSpYFakq&%=d?Q80_P)dfOB$CszwRIOc_Ksj&N(yIsU=M8b@CcbG!3&iA8UPq5sBJ~{&NIQGT05b{ojx?F4A?3(^!~7s}&v(!4ye1GlX69KgXoN zSABfm=uplsxgLf|PRu5SQ;xyjq29`ZABA}B%)i4*V}kb|Mg&;w6piyb6Rl2f6Oyw; zWSgpBdmUDFiCO{d%d{UM&+c+hZGe$;-k4Ml4w^}O$c0prm5!M{^^SSp>+e{Lx5x#> zQ)53|Dws>Hu1XJsHU5lim1Cd*uzX#jj@*z=5wKu1D@+@_thhmNW{{x_Lhg6^J1Azmj*EhpUvSH4E6w84sDYn#eg zt$r&)1>$UikR7RS1&R`^$-(Ygy|wPh?&@J@7GLocNTWRgDo;as`U6X~me~@p^X z#C>>mvzKKa8PVJsP?u;WR`~7CdOz7LIA`ziUj##QgIBX~SI)B~Kx+8_a`~v5-&uIp zwwxp=Ox8kBU834=4YWvUl=d8E^K#Ro(LC;mKO!2-E@3{@rsF92r-sRIBI2IaDO#^0 zBMOM5OIfFh#zTA=@I9D~o{=c?E=XlzhRjR_YBW9JqQj~FxDBE34=cq(kUdrsU2lMj zakod|FS)b^i|fwI4)#h8geVk5BNlM>_b2kJuZvvmo(Gj(R46VsvAb~L=($3+7tgzy z071w-R9xxaYxC!l7UR+4sQuu~>)Q97KaRvm8veZu>;3dykRaO~z)|vA)s$=R)mpnD zT8ldhq_KO_IIfTS@(Tlwc=?K2y9+|5e@vuK#;;>G`Z<172gh)o%A4v(L+&8r9!`S%e-LS~R%M zv+X6g?pXI>M*w-n4X$GW#z_4XnBsgY#PjZM7=;*FY$2}#(HDzuE=NaV?4=0QNC|I3 z3~MzBWh2N=xV1Z_zAn&TYPx2XdxZ7uM3S)7U3p!oVx_2Krs%o_*So5hp>1`$-64*qQOH_2GbGi8u@gNa7;=c{Rx%Ay7w;X7~75%P}ggA z^~zablh>5C4HDndq{wHQZQi{Nc_kH#p#a!EB+861UQqe*W^|3lKay>@5OL6VD2_8k zsW>4@)$Z#f&P2H}7oc6A38q$K5j#C3j?7BAGK^HgpP?W5<{#A`L<|gBToJd`C``-< z)q4PJ36zA@-Zr#ukpV?IP4CBpiuiKpGCH~|h48M(yI@{pim#UT`(r6rBJG03ps`pk z8ke=XRIQ&H4`+cFk97}?$+J3azBFSQa3YaPs|ACpnq%elRO+r{*;-odxL)SQnU{N$ zre!!oeZAG^4_!C+cIkA^wN_-}8tZl*tZyQy}bd77OhW<{roHs@8uuAQ_fHI1A1uE!h?phDYZ~ia%_qsLk*X1 zyp`JZfO-!SmuE5L7otG{w-9|Kjb%$}y&D=2h?5k!3wCe%N`==n%QCDilOlfdZ`Lk| zKm;RKz3i~(!>UK81zBNeqpEI>;*aOY8<|jaju(r$!RY*IB*=?!uHd5HUwsz_{pN}Q zZQPonAdWTXWF&xr?XqZ*(d?E0x71*#L{nw$ev4?N03>KXkQ9l4)Cb1SqYx z!>SwSkEhOYjwqtO8bkCrYs7%+A&Q{NZXK>$aApJ-k)B%rMwq&nryfAKerk{WP#PDR zxPyw%4&Usb<6Jo0(Nky@mVS?){p|2mN!4S(pt_+9TA(~d)9n~Mq5HYS=80#N&-EmAVK?=LFiPa8vrcAi}E) zP+aKke-)e0&0l$-Scu%Wg!D4hC9g>;0&avX*qhPhEyE3$8wg zW7MX`g3&n$Y4%7uAe1&6SysmzRO%?b&VO=JH9yZV?o>gzo>=e2)DdgQl8t5v>fJGi z_}*4Oa&A|~##JJe8)xBZB582rSXYxMcv{fAE|;1lFqiv}LiH}2@>y&*u(-ek5AGw~>h*zcF|Kr& z^JbV@KMz@iWr!q0H;R}B1IaCc2>qZo>HHorI57%tU}F5<2vCvL9S8X*S-XPw79O&a z@4g~X^0I~CvGw#l-1guj^dR^bq|$Fmz8%3YAdQ+UhB78 zt5K!M)*66=e6vUgIrj(HNyG>=itujyX$*W^$S-DJN42`XJvO?U=MZh@1^)T&jP!_J zJgFq6v!Ll+9az}tQlO<_H9;*%QBQs9wdxOqHuH;0#oJV&CQX4?h`{fA>uZcF-*n_fJH9GG7vuDHaTkjowS?aHJt+8lerSBDf8$J22aR*El#KS8- zOiFiYp|MM^_axnea8CnP&WwyPBS5o3xv{Q>0=bChGpvJNbICdL*|OgZY+Cc$#`Fiq zz7K9S#UzR{e}L?DdY5ZQF?nkGm)GXu1S~t&a}Kv&r5@DP!~E}CP5f@jODYjxPJaLV z(=gr&UR#L%2gY7q-`%gdc<3^J){9qV(1JFgcw&ZPyr~HG$aH?>HbfAQrDT&v4cX`R zjGFShkh*Ki7J1((BBxW-nu>5#+v?QGtO*Vu1}${@Rr|NH+%bGl<%08lCP+wc`*K#L zoivQ)2i9=pqBq1;qZQz=<^Ab!p^Zs*|}D6USc+u(8YK!O@iohb8Yt!Mas=%(xgc zQaS`4Waa05Tm0l{})=*#D`u33`e6h zrSE#;VWM29yqZyn&>xPIOu-$Lj1f50Yht?Pn_ECPDBxlPSKg+%9iwVJhOBgQT=tGSBd%x*OC$G1Q(cX(gN#BVS_oRrd9-*bO!iA;{Fug$JRiWE&}I2j zg11i;DXQ_mNY9q=!OEYi_~)I+D8xEi!Ja@-fO zcNC#YGFN7?SN`GU8>DG*p)-e1c)DFWAq3W=&}VS zx72>pbj$>DY_Ew8hp0E^f}kGX=6pW-FA%N!-uH`g7kiw}0<%R$?U&6_q|39ChoO7p&=7Y7)Mq&3eEoO{<0hhLd26s4sx>|Vyv4ex&x|b^LjJr+ah}{WlLHaW4_oql zBk~ZI)!S&F99X7(4;THalNf}}btm-O4;@PBRJPF+1;jV^pH~n8p{NQkX<%@mlZ`nD zyC3XrRHKHPc`Nc)9iXqx^o$Vn_R=efHBR&0pQq{t7Z9&Scfej?I!#l(lrGjGE+C8| zo(3Jew^8ggLo0uX51PAlC@(+IZ3(Juj0pS9+}lPPtC zLfc$ycSIzOPr|1-i#==YD!pJ0C9SmXu%eHSX#%dEfW_T928HE@4-vobu08dat1r!0 zSS{+Nwi!L<)wtrd(OZ+aeyn4Yx|4qYefdTgWQ!=zLD*b$hfEyVN9(9pOGG=S#NSt< zw^;;WDB$$f)V>I=kB1mU$=-;S5B-AB(3sCXGP%~?$+CxJ@ZB{W6ugulp>cD(QmmC| zx+KQd^|<9g3?E|os%Fd;#}##ArblqKEJfRw7}AJwe#3qsP<}G+R!{(C32xlrd5CDl z$A;gszyyASo3h1Wc@8&=5ux2{M1IEB(*Jd9gZYkuM%D@rFBSO;Y-T5iC+p)|(FHAC zG~E`vrZ~_!eUk~i1wnm%yA^^^!5(eIi5vB9c2U#4&gal8)#U(BMf4aKI zlUWeO3#QTXh$nLow7PnMHn5x%#ZcPA!jjV=XV#LCeM#``Ln${3mGvM}30>S~(XtVr zE!}iJ5IY)HO{JSVw{E;R3#927U+5lcIYG<4z^H#`DhO8dwn2K2%W8~$_oJ{RcJr|2 zx5x~m`Ts!=6w4K$LOf0^sj?-u#ixy(?W^0>CMt}98 zZaWzH3#>+sLXoy=Af@;(tsE`|{$WA)VW=UdiU(bf*HDp-dsUN$P-&~-m81tDl8c}P z?FsmXM-=n`vJJRfG6uoNQ$$otYAutXW$ywoLPQd}j}*hreyr8DQ_zlsSl@_6QEmu}3#&+e7^T%;fGpK1g4IqQ9dbu;2`h4lPZfe63DY1Lrj0eLIc?K-*lb zC}*k>CyTwr(n9s!&oiKnI*35WZjIAa)V>DISRU#}x{N~!Rt!Zk_(0b(CeKaY-xIO6 z9#G(FV}=a0RE+nApOEOV7y8<)TT~>cBgBo?{;V{vpXIRR3!V@=)%BrwFLwTw@V*Xr z|DZTsdzRDfv~EXP9fO6+EjQVUD}OB##>&0Jd~;gsMsYfA9gcoTB_y77;cL1s^i*7X z3WGU9%H+#Jn5B&y8<35;O*RCz%vV(IQvi+&=uRHg8PQWYRM*y(UCzK=of zCn14ZkLPpxEo;g!e~mJmhUk-J$aNc zy!P-I7&*s7er!MC`H|?58UOv>68_b+Ur0rGVP4JCwPDsTtQ+~-ZC0oBZ|(k`qwX&Y z1-<4+Yk~*epSUgDF#T})x@@F@-qhdZ_W)iF-H!>rT9v*$J8qyMKRpn0V&U9mrAO*s z?)&$iWws`(3G@Uaye$;(HDTP@qFde@xiy3~0t}^|YPAv=Z)W^=okJcrO6w~@@A&}| zOuFrJuRq?H^^S#NrTtAn4XWLjRLrGw1UvDJIzrBpFR|lJbeu(<87-s$#+Uzv9p9II z$>Lz|5`5mFI(5pgmli z`Re51jrOlg6}^R;I!(6ic-^^XCI&EG(mcvgDhQ;Y3WTDuT{_qZ~4nGN-hp|S;r)v0HpOs`|237$pj^OfROvF$+{@F(kmm|RiMui{KGAK zY8Pn-5n=OH{fZdg+=>q@rP0~M3GMttydfnLK#Koe`CM^*wF6bn^LYT%H6Wu4YuGw~ zKmcNgMxK&S@;KMA5=Qt7sp^;;EBl{gQ~{t2recQ|`S@x+7IqbyxUFH;Rb4NijATFM zr~ERJ?UyME^EI#`PpWlG<)$&GfINsH?sqig6F$|0maMDmrXw6+37|Usyx9B4@vif z!;L!BPrZMe+^T}9u(}Kb;13(<%BkI1AvW8}QGuH0)@9HH5{+8yFF|ytFjxPTv)LR| z@%88EoF4&Y=3$-7n8soZi1@$u;~5gT`Y##JZYK(|w7O`OihOYSZji!q+;k13Pq1x7 zicB%wk(%ax(KB8Kfb+fQyU?rehyw^9V4z9H5W#i+6ytJAnjjJl%3VY{SW#O6->|u} zahO@GS!9z}lNMFf4hQI+z;&|##iYD-UMB?UELs0$cp5`&_T=D)tQFW1c=0KXL1vS3 zb|JUbMXfs590VyE8%R8mGElM=EW}I_i0s$i>=REOaA}?~cK)l4o&q;|sRJg@Ry?QcYm!WEJjtZ9*Ww_&bfBp4WUki^{@kIL3G#W(0I0hPk z;kG4!tGn>;O|Z(;-$$jUU?z4e4(^dWD7P-N;*gsQ{%};LO>9cYs>vRCHD6_uHUh8? z#M1~IPMQMjjmx>WvQg^)m60n2?bu55KUXD}Mm15@?=ieGiP_1OT?j13 zHuY`lNk9e9hU56*pI?=-T#dPy$9$C@#+9T9ZjBwcH6IHdNySvjlVt$>5g4vJOGRZm z(FdF$kDYDkq}Emi%dd|H&0C+ZI-;{wH0BiZ$Q8^iKAv=Wq4=(eqm$aV{D z0<2GvT9%yX`u_g9Mcpz-{RPNeI9V4dR#%Y8X0M_aQWSov*W&D5G2M1N8y<8@$S;+) zyR1?%x7?fc4yleGHR&82=EfXl;3I90fi?h#BiMhams)*j4D6Od(Pi#grh1yi%5nE`0*1vWtb4=Quvuh& zv@3ridL!(~wth8|Wo!^oTcUt56}U~UAFrhcbI){c;`5U=&C(n!#UQ^>v(fa7y1eov zCKXip}meqaOnK9Ghl!_5CmA_%HEN>Y}l`{NhP2X+86 zY$!njF;-S&z?r2T=uG|mIQ$OuAGNb|uH{AX$;;=+1)NYw4}A|v@g60-`Knpyc87>N zz@d!^Ygmi+61?no{jQ_mi8=61OXFwUeZSCx+OG!hYxKi^;DBj_(&Mtq#B+G%rP&^A zHdcx}+!)hWJXyGruSoRW8U#t;-O?Mb&pdp4>Gt==%^L%E#H~9OGt!=g_FA(Xgs)Q; zVB(s97m%+hSpswq%{q z`I&Y1Xy5Yz`Dp})7xTU7@%;#T0M+2!K45ut)q5>94nM zQmy(MTIvbEG@H9S&&MM{eN+935t=2lwzJ|g&ZQcy@lGwjLohpEC)7+9)aZ1`>h|^b$Gt`bu#5ciWpCV#d{oO|3y&goDXXHGZ{a$L3Y-zua((i`pq_o^NMp%(| zq9(z4zRH7oEkek?G{{o+esMbzHoWprWWQyRJH8)wynFe5{g56MFd*o)+qT)D2Zz!^F2wnB)@2$Jue%ZGgb?26 zf{!FBAAFua1u#}CLX`0Nf&MWomw;Fm*;1$3G~@Xi*ss2yI;wd`4Wx6DQ5#=Gq8O+Y zL!;i6jQkQ0YHZzl_!ofE9%(uJj62O76vEQ7Y8rcO+~TLV1zyrp=m(r(&gHn8*k2Nr z{)qQodf<4+uq9wPl?h+H#+xfqjpGlI%U#^vWyn_PX#X|nquv|vH1nNI>aY?qHjJy> z+Mu1d`S#_2N;|Yt8uqU7n0idw)^TO@R@d6k1&*DV99^-apM@IWqFM%hc?J!{XZ$0U`?pRA2*GCu~U z=9;~tnt9ATa`d5>=*S4W7wUl?{<7wnOxz?}(2d#Y3`tX2XD z4)r#QxIwPR;(t-?;@`O zvcd`=?elo+*J-nLT-%e{59FE5>s51Q!LnuBjuk^-DV5db$*yLB>`BxK%48UkIq z60}Oz*A|xNj7P*T!M?%g*UGTRVu51~ohH%h=7A7BeHG%!kfRbUY@`6x=vBHX!7q*? z?jjob{eDImH@P3HBeMI5dXIXiIIFv@@{#_X4$~u^CD@fr1$WOOP>zN82p>aw@vq=& z$9*N~5iwAp)m8mLQ;mdX`}Ox1y}qXk4@ygadMJc({M5~9C3x=JZcQtyc&=4e56S-3 z$~t(BWu|f=Te~8b4iiwJM%E(VQq03OG}`t*;Ec)i48D(YL+c^)Bo=w>jlZ#%xjreI z=0&-h@5nbG_q2#RM|~1+v;!qQqhwUv;1w-15NT&7@BqMeMRD$seDC2>H&#(J13q}6U)0VU=9 zoF3WG-Gm{O-~UeYlD=`W9poE0)B`9E*3G(^4-Qkcr7ni2irIyzlR5*WRB6Ci(Odm? zA+M~)g;u9%F9imtoydlVUp9BCCDIojVOq%*n>JYKFOi~`$AtWe&-otrN}J%!UKDXt zABu)g%`^8G6ZgM~js02Hqf54bNt}+z3y2b*%%r$sq1^!4`C!JWdq-cpEyQ>ISgt*~*_y58(CEA*ZI1**aoNW;2X^S5cd#q>DQXAes! zh@CAv*V11(-HnEZEV&QcS0Ym^VBHo+Rn9}}V-TTqOj6Zr?*^I_;r=E)<4^F^Xhh~{mkT{qRY(Y|@bF`0br4$TUigH=Cw0s8O!!yNlVpxAt#5vF zlxY;Q;^%m1O7($b@D*BOYG

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## health/health.proto - - - - - -### HealthCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) | | | - - - - - - - - -### HealthCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [HealthCheck](#health.HealthCheck) | repeated | | - - - - - - - - -### HealthWatchRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interval_seconds | [int64](#int64) | | | - - - - - - - - -### ReadyCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) | | | - - - - - - - - -### ReadyCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ReadyCheck](#health.ReadyCheck) | repeated | | - - - - - - - - - - -### HealthCheck.ServingStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SERVING | 1 | | -| NOT_SERVING | 2 | | - - - - - -### ReadyCheck.ReadyStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| READY | 1 | | -| NOT_READY | 2 | | - - - - - - - - - -### Health - - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Check | [.google.protobuf.Empty](#google.protobuf.Empty) | [HealthCheckResponse](#health.HealthCheckResponse) | | -| Watch | [HealthWatchRequest](#health.HealthWatchRequest) | [HealthCheckResponse](#health.HealthCheckResponse) stream | | -| Ready | [.google.protobuf.Empty](#google.protobuf.Empty) | [ReadyCheckResponse](#health.ReadyCheckResponse) | | - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesRequest -rpc processes - - - - - - - - -### ProcessesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Recover -The recover message containing the recover status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RecoverRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| source | [RecoverRequest.Source](#machine.RecoverRequest.Source) | | | - - - - - - - - -### RecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Recover](#machine.Recover) | repeated | | - - - - - - - - -### RemoveBootkubeInitializedKey -RemoveBootkubeInitializedKeyResponse describes the response to a RemoveBootkubeInitializedKey request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RemoveBootkubeInitializedKeyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_JOIN | 3 | | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RecoverRequest.Source - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| ETCD | 0 | | -| APISERVER | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| Recover | [RecoverRequest](#machine.RecoverRequest) | [RecoverResponse](#machine.RecoverResponse) | | -| RemoveBootkubeInitializedKey | [.google.protobuf.Empty](#google.protobuf.Empty) | [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - -### ReadFileRequest -The request message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### ReadFileResponse -The response message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | - - - - - - - - -### WriteFileRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | -| data | [bytes](#bytes) | | | -| perm | [int32](#int32) | | | - - - - - - - - -### WriteFileResponse -The response message containing the requested logs. - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | -| ReadFile | [ReadFileRequest](#securityapi.ReadFileRequest) | [ReadFileResponse](#securityapi.ReadFileResponse) | | -| WriteFile | [WriteFileRequest](#securityapi.WriteFileRequest) | [WriteFileResponse](#securityapi.WriteFileResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.10/reference/cli.md b/website/content/v0.10/reference/cli.md deleted file mode 100644 index d65f92065..000000000 --- a/website/content/v0.10/reference/cli.md +++ /dev/null @@ -1,2181 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.10.0-alpha.2/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string the uncompressed kernel image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.21.0") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config contexts - -List contexts defined in Talos config - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config merge - -Merge additional contexts from another Talos config into the default config - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config - -Manage the client configuration - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List contexts defined in Talos config -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another Talos config into the default config -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl convert-k8s - -Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). - -### Synopsis - -Command converts control plane bootstrapped on Talos <= 0.8 to Talos-managed control plane (Talos >= 0.9). -As part of the conversion process tool reads existing configuration of the control plane, updates -Talos node configuration to reflect changes made since the boostrap time. Once config is updated, -tool releases static pods and deletes self-hosted DaemonSets. - -``` -talosctl convert-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --force skip prompts, assume yes - -h, --help help for convert-k8s -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use - a control plane node, common in a single node control plane setup, use port 6443 as - this is the port that the API server binds to on every control plane node. For an HA - setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch string patch generated machineconfigs - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl recover - -Recover a control plane - -``` -talosctl recover [flags] -``` - -### Options - -``` - -h, --help help for recover - -s, --source string The data source for restoring the control plane manifests from (valid options are "apiserver" and "etcd") (default "apiserver") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. Pod-checkpointer is handled in a special way to speed up kube-apisever upgrades. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.21.0") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl convert-k8s](#talosctl-convert-k8s) - Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl recover](#talosctl-recover) - Recover a control plane -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.10/reference/configuration.md b/website/content/v0.10/reference/configuration.md deleted file mode 100644 index e5c123cbc..000000000 --- a/website/content/v0.10/reference/configuration.md +++ /dev/null @@ -1,5055 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: -```bash -talosctl gen config --version v1alpha1 -```` - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
- -
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
- -
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk characteristics like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - - -Valid values: - - - - init - - - controlplane - - - join -
- -
- -
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
- -
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.21.0 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
- -
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
- -
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
- -
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk characteristics like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
- -
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
- -
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
- -
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
- -
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
- -
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- -
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - - -
- -
- - - - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
- -
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
- -
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- -
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
- -
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.21.0 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
- -
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.21.0 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
- -
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.21.0 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
- -
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.21.0 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
- -
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" -``` - - -
- -
- -
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image. -``` - - -
- -
- -
- -externalCloudProvider ExternalCloudProviderConfig - -
-
- -External cloud provider configuration. - - - -Examples: - - -``` yaml -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- -
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
- -
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the extraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
- -
- -inlineManifests ClusterInlineManifests - -
-
- -A list of inline Kubernetes manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -``` - - -
- -
- -
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
- -
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.21.0 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.21.0 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
- -
- -extraMounts []Mount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
- -
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
- -
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- -
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
- -
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk characteristics like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
- -
- -diskSelector InstallDiskSelector - -
-
- -Look up disk using disk characteristics like model, size, serial and others. -Always has priority over `disk`. - - - -Examples: - - -``` yaml -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
- -
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
- -
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
- -
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## InstallDiskSizeMatcher -InstallDiskSizeMatcher disk size condition parser. - -Appears in: - - -- InstallDiskSelector.size - - -``` yaml -4GB -``` -``` yaml -'> 1TB' -``` -``` yaml -<= 2TB -``` - - - -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - - -- InstallConfig.diskSelector - - -``` yaml -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -size InstallDiskSizeMatcher - -
-
- -Disk size. - - - -Examples: - - -``` yaml -size: 4GB -``` - -``` yaml -size: '> 1TB' -``` - -``` yaml -size: <= 2TB -``` - - -
- -
- -
- -name string - -
-
- -Disk name `/sys/block//device/name`. - -
- -
- -
- -model string - -
-
- -Disk model `/sys/block//device/model`. - -
- -
- -
- -serial string - -
-
- -Disk serial number `/sys/block//serial`. - -
- -
- -
- -modalias string - -
-
- -Disk modalias `/sys/block//device/modalias`. - -
- -
- -
- -uuid string - -
-
- -Disk UUID `/sys/block//uuid`. - -
- -
- -
- -wwid string - -
-
- -Disk WWID `/sys/block//wwid`. - -
- -
- -
- -type InstallDiskType - -
-
- -Disk Type. - - -Valid values: - - - - ssd - - - hdd - - - nvme - - - sd -
- -
- - - - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
- -
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
- -
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
- -
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.21.0 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.21.0 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
- - - - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.21.0 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.21.0 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.21.0 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
- -
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.21.0 -``` - - -
- -
- -
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.21.0 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.21.0 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.15 -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "urls". -The "name" key supports the following options: "flannel", "custom", and "none". -"flannel" uses Talos-managed Flannel CNI, and that's the default option. -"custom" uses custom manifests that should be provided in "urls". -"none" indicates that Talos will not manage any CNI installation. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
- -
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
- -
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
- -
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - - -Valid values: - - - - flannel - - - custom - - - none -
- -
- -
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. -Should be present for "custom", must be empty for "flannel" and "none". - -
- -
- - - - - -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - - -- ClusterConfig.externalCloudProvider - - -``` yaml -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - -
- -
- -enabled bool - -
-
- -Enable external cloud provider. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -manifests []string - -
-
- -A list of urls that point to additional manifests for an external cloud provider. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- - - - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
- -
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
- -
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - - -- SystemDiskEncryptionConfig.state - -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
- -
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
- -
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - -
- -
- - - - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
- -
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
- -
- -slot int - -
-
- -Key slot number for luks2 encryption. - -
- -
- - - - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - - -- EncryptionKey.nodeID - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
- -
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
- -
- -path string - -
-
- -The path of the file. - -
- -
- -
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
- -
- -aliases []string - -
-
- -The host alias. - -
- -
- - - - - -## Device -Device represents a network interface. - -Appears in: - - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
- -
- -cidr string - -
-
- -Assigns a static IP address to the interface. -This should be in proper CIDR notation. - -> Note: This option is mutually exclusive with DHCP option. - - - -Examples: - - -``` yaml -cidr: 10.5.0.0/16 -``` - - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
- -
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
- -
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
- -
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. -> -> Note: To configure an interface with *only* IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false -> in order for Talos to skip configuration of addresses. -> All other options will still apply. - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
- -
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
- -
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
- -
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- -
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
- -
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
- -
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
- -
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
- -
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
- -
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
- -
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
- -
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
- -
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- -
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - - -- Device.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
- - - - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
- -
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - - -- Device.vlans - - - -
- -
- -cidr string - -
-
- -The CIDR to use. - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
- -
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - - - -## Route -Route represents a network route. - -Appears in: - - -- Device.routes - -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
- -
- -gateway string - -
-
- -The route's gateway. - -
- -
- -
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
- -
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
- -
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - - -- APIServerConfig.extraVolumes - -- ControllerManagerConfig.extraVolumes - -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
- -
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
- -
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - - - -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - -
- -
- -name string - -
-
- -Name of the manifest. -Name should be unique. - - - -Examples: - - -``` yaml -name: csi -``` - - -
- -
- -
- -contents string - -
-
- -Manifest contents as a string. - - - -Examples: - - -``` yaml -contents: /etc/kubernetes/auth -``` - - -
- -
- - - - diff --git a/website/content/v0.10/reference/kernel.md b/website/content/v0.10/reference/kernel.md deleted file mode 100644 index de2285852..000000000 --- a/website/content/v0.10/reference/kernel.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automtic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.interface` - - The network interface to use for pre-configuration booting. - - If the node has multiple network interfaces, you may specify which interface - to use by setting this option. - - Keep in mind that Talos uses indexed interface names (eth0, eth1, etc) and not - "predictable" interface names (enp2s0) or BIOS-enumerated (eno1) names. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. - - diff --git a/website/content/v0.10/reference/platform.md b/website/content/v0.10/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.10/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.10/single-board-computers/_index.md b/website/content/v0.10/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.10/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.10/single-board-computers/bananapi_m64.md b/website/content/v0.10/single-board-computers/bananapi_m64.md deleted file mode 100644 index bc48c4c61..000000000 --- a/website/content/v0.10/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.10/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.10/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index a0b7e8f2a..000000000 --- a/website/content/v0.10/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.10/single-board-computers/rock64.md b/website/content/v0.10/single-board-computers/rock64.md deleted file mode 100644 index 27827e8ae..000000000 --- a/website/content/v0.10/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.10/single-board-computers/rockpi_4.md b/website/content/v0.10/single-board-computers/rockpi_4.md deleted file mode 100644 index 70888807e..000000000 --- a/website/content/v0.10/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Boot Talos from an SSD Drive - -> Note: this is only tested on Rock PI 4c - -Rock PI 4 has an M2 slot which supports NVMe disks. -It is possible to run Talos without any SD cards right from that SSD disk. - -The pre-installed SPI loader won't be able to chain Talos u-boot on the SSD drive because it's too outdated. -The official docs on booting from the SSD also propose using an outdated SPI to flash u-boot. - -Instead, it is necessary to update u-boot to a more recent version for this process to work. -The Armbian u-boot build for Rock PI 4c has been proved to work: [https://users.armbian.com/piter75/](https://users.armbian.com/piter75/). - -### Steps - -- Flash any OS to the SD card (can be Armbian for example). -- Download Armbian u-boot and update SPI flash: - -```bash -curl -LO https://users.armbian.com/piter75/rkspi_loader-v20.11.2-trunk-v2.img -sudo dd if=rkspi_loader-v20.11.2-trunk-v2.img of=/dev/mtdblock0 bs=4K -``` - -- Optionally, you can also write Talos image to the SSD drive right from your Rock PI board: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -sudo dd if=metal-rockpi_4-arm64.img.xz of=/dev/nvme0n1 -``` - -- remove SD card and reboot. - -After these steps, Talos will boot from the SSD and enter maintenance mode. -The rest of the flow is the same as running Talos from the SD card. diff --git a/website/content/v0.10/single-board-computers/rpi_4.md b/website/content/v0.10/single-board-computers/rpi_4.md deleted file mode 100644 index 56c665a79..000000000 --- a/website/content/v0.10/single-board-computers/rpi_4.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and use [Raspberry Pi Imager](https://www.raspberrypi.org/software/) -to install the bootloader on it (select Operating System > Misc utility images > Bootloader > SD Card Boot). -Alternatively, you can use the console on Linux or macOS. -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -```bash -curl -LO https://github.com/raspberrypi/rpi-eeprom/releases/download/v2020.09.03-138a1/rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0 /mnt -sudo bsdtar rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached to the port closest to the power/USB-C port, -the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -> Note: if you have an HDMI display attached and it shows only a rainbow splash, -> please use the other HDMI port, the one closest to the power/USB-C port. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.10/virtualized-platforms/_index.md b/website/content/v0.10/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.10/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.10/virtualized-platforms/hyper-v.md b/website/content/v0.10/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.10/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.10/virtualized-platforms/kvm.md b/website/content/v0.10/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.10/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.10/virtualized-platforms/proxmox.md b/website/content/v0.10/virtualized-platforms/proxmox.md deleted file mode 100644 index ce202be6e..000000000 --- a/website/content/v0.10/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,182 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the \_out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.10/virtualized-platforms/vmware.md b/website/content/v0.10/virtualized-platforms/vmware.md deleted file mode 100644 index 5e2de0532..000000000 --- a/website/content/v0.10/virtualized-platforms/vmware.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat init.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.10/virtualized-platforms/xen.md b/website/content/v0.10/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.10/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.11/_index.md b/website/content/v0.11/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.11/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.11/bare-metal-platforms/_index.md b/website/content/v0.11/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.11/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.11/bare-metal-platforms/digital-rebar.md b/website/content/v0.11/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 593aa769e..000000000 --- a/website/content/v0.11/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created join.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview.](/../../guides/metal/overview) - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/bare-metal-platforms/equinix-metal.md b/website/content/v0.11/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index eeeeedc32..000000000 --- a/website/content/v0.11/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the Equinix Metal CLI installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `controlplane.yaml`, and `join.yaml` -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config join.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file join.yaml -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/bare-metal-platforms/matchbox.md b/website/content/v0.11/bare-metal-platforms/matchbox.md deleted file mode 100644 index 4dc8c8de2..000000000 --- a/website/content/v0.11/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/bare-metal-platforms/sidero.md b/website/content/v0.11/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.11/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.11/cloud-platforms/_index.md b/website/content/v0.11/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.11/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.11/cloud-platforms/aws.md b/website/content/v0.11/cloud-platforms/aws.md deleted file mode 100644 index ce1391263..000000000 --- a/website/content/v0.11/cloud-platforms/aws.md +++ /dev/null @@ -1,256 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: --with-examples=false --with-docs=false -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Take note that the generated configs are too long for AWS userdata field if the `--with-examples` and `--with-docs` flags are not passed. - -At this point, you can modify the generated configs to your liking. - -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 4 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/cloud-platforms/azure.md b/website/content/v0.11/cloud-platforms/azure.md deleted file mode 100644 index 63e8f5056..000000000 --- a/website/content/v0.11/cloud-platforms/azure.md +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create the controlplane nodes -for i in $( seq 0 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/cloud-platforms/digitalocean.md b/website/content/v0.11/cloud-platforms/digitalocean.md deleted file mode 100644 index 6ae079584..000000000 --- a/website/content/v0.11/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-1 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/cloud-platforms/gcp.md b/website/content/v0.11/cloud-platforms/gcp.md deleted file mode 100644 index 7a4621d2c..000000000 --- a/website/content/v0.11/cloud-platforms/gcp.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create the control plane nodes. -for i in $( seq 1 3 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 3 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/cloud-platforms/openstack.md b/website/content/v0.11/cloud-platforms/openstack.md deleted file mode 100644 index 101b40f09..000000000 --- a/website/content/v0.11/cloud-platforms/openstack.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 1 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/join.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/guides/_index.md b/website/content/v0.11/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.11/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.11/guides/advanced-networking.md b/website/content/v0.11/guides/advanced-networking.md deleted file mode 100644 index c1d95e68b..000000000 --- a/website/content/v0.11/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.11/guides/air-gapped.md b/website/content/v0.11/guides/air-gapped.md deleted file mode 100644 index 8358e2c93..000000000 --- a/website/content/v0.11/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.11.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.11/guides/configuring-certificate-authorities.md b/website/content/v0.11/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.11/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.11/guides/configuring-containerd.md b/website/content/v0.11/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.11/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.11/guides/configuring-corporate-proxies.md b/website/content/v0.11/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.11/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.11/guides/configuring-network-connectivity.md b/website/content/v0.11/guides/configuring-network-connectivity.md deleted file mode 100644 index adf1fe692..000000000 --- a/website/content/v0.11/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.11/guides/configuring-pull-through-cache.md b/website/content/v0.11/guides/configuring-pull-through-cache.md deleted file mode 100644 index 3b2e05fbc..000000000 --- a/website/content/v0.11/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `quay.io`, `gcr.io`, and `ghcr.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.11/guides/configuring-the-cluster-endpoint.md b/website/content/v0.11/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index 6348d4215..000000000 --- a/website/content/v0.11/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.11/guides/configuring-wireguard-network.md b/website/content/v0.11/guides/configuring-wireguard-network.md deleted file mode 100644 index 27dc41aa3..000000000 --- a/website/content/v0.11/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > join.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - cidr: 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.11/guides/converting-control-plane.md b/website/content/v0.11/guides/converting-control-plane.md deleted file mode 100644 index d7ec2ead6..000000000 --- a/website/content/v0.11/guides/converting-control-plane.md +++ /dev/null @@ -1,257 +0,0 @@ ---- -title: "Converting Control Plane" -description: "How to convert Talos self-hosted Kubernetes control plane (pre-0.9) to static pods based one." ---- - -Talos version 0.9 runs Kubernetes control plane in a new way: static pods managed by Talos. -Talos version 0.8 and below runs self-hosted control plane. -After Talos OS upgrade to version 0.9 Kubernetes control plane should be converted to run as static pods. - -This guide describes automated conversion script and also shows detailed manual conversion process. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Conversion - -First, make sure all nodes are updated to Talos 0.9: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready control-plane,master 58m v1.20.4 172.20.0.2 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-2 Ready control-plane,master 58m v1.20.4 172.20.0.3 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-3 Ready control-plane,master 58m v1.20.4 172.20.0.4 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-worker-1 Ready 58m v1.20.4 172.20.0.5 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -``` - -Start the conversion script: - -```bash -$ talosctl -n convert-k8s -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -current self-hosted status: true -gathering control plane configuration -aggregator CA key can't be recovered from bootkube-boostrapped control plane, generating new CA -patching master node "172.20.0.2" configuration -patching master node "172.20.0.3" configuration -patching master node "172.20.0.4" configuration -waiting for static pod definitions to be generated -waiting for manifests to be generated -Talos generated control plane static pod definitions and bootstrap manifests, please verify them with commands: - talosctl -n get StaticPods.kubernetes.talos.dev - talosctl -n get Manifests.kubernetes.talos.dev - -in order to remove self-hosted control plane, pod-checkpointer component needs to be disabled -once pod-checkpointer is disabled, the cluster shouldn't be rebooted until the entire conversion process is complete -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: -``` - -Script stops at this point waiting for confirmation. -Talos still runs self-hosted control plane, and static pods were not rendered yet. - -As instructed by the script, please verify that static pod definitions are correct: - -```bash -$ talosctl -n get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 1 - phase: running -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "2" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system - spec: - containers: - - command: -... -``` - -Static pod definitions are generated from the machine configuration and should match pod template as generated by Talos on bootstrap of self-hosted control plane unless there were some manual changes applied to the daemonset specs after bootstrap. -Talos patches the machine configuration with the container image versions scraped from the daemonset definition, fetches the service account key from Kubernetes secrets. - -Aggregator CA can't be recovered from the self-hosted control plane, so new CA gets generated. -This is generally harmless and not visible from outside the cluster. -The Aggregator CA is _not_ the same CA as is used by Talos or Kubernetes standard API. -It is a special PKI used for aggregating API extension services inside your cluster. -If you have non-standard apiserver aggregations (fairly rare, and you should know if you do), then you may need to restart these services after the new CA is in place. - -Verify that bootstrap manifests are correct: - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Make sure that manifests and static pods are correct across all control plane nodes, as each node reconciles -control plane state on its own. -For example, CNI configuration in machine config should be in sync across all the nodes. -Talos nodes try to create any missing Kubernetes resources from the manifests, but it never -updates or deletes existing resources. - -If something looks wrong, script can be aborted and machine configuration should be updated to fix the problem. -Once configuration is updated, the script can be restarted. - -If static pod definitions and manifests look good, confirm next step to disable `pod-checkpointer`: - -```bash -$ talosctl -n convert-k8s -... -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: yes -disabling pod-checkpointer -deleting daemonset "pod-checkpointer" -checking for active pod checkpoints -2021/03/09 23:37:25 retrying error: found 3 active pod checkpoints: [pod-checkpointer-655gc-talos-default-master-3 pod-checkpointer-pw6mv-talos-default-master-1 pod-checkpointer-zdw9z-talos-default-master-2] -2021/03/09 23:42:25 retrying error: found 1 active pod checkpoints: [pod-checkpointer-pw6mv-talos-default-master-1] -confirm applying static pod definitions and manifests [yes/no]: -``` - -Self-hosted control plane runs `pod-checkpointer` to work around issues with control plane availability. -It should be disabled before conversion starts to allow self-hosted control plane to be removed. -It takes around 5 minutes for the `pod-checkpointer` to be fully disabled. -Script verifies that all checkpoints are removed before proceeding. - -This last confirmation before proceeding is at the point when there is no way to keep running self-hosted control plane: -static pods are released, bootstrap manifests are applied, self-hosted control plane is removed. - -```bash -$ talosctl -n convert-k8s -... -confirm applying static pod definitions and manifests [yes/no]: yes -removing self-hosted initialized key -waiting for static pods for "kube-apiserver" to be present in the API server state -waiting for static pods for "kube-controller-manager" to be present in the API server state -waiting for static pods for "kube-scheduler" to be present in the API server state -deleting daemonset "kube-apiserver" -waiting for static pods for "kube-apiserver" to be present in the API server state -deleting daemonset "kube-controller-manager" -waiting for static pods for "kube-controller-manager" to be present in the API server state -deleting daemonset "kube-scheduler" -waiting for static pods for "kube-scheduler" to be present in the API server state -conversion process completed successfully -``` - -As soon as the control plane static pods are rendered, the kubelet starts the control plane static pods. -It is expected that the pods for `kube-apiserver` will crash initially. -Only one `kube-apiserver` can be bound to the host `Node`'s port 6443 at a time. -Eventually, the old `kube-apiserver` will be killed, and the new one will be able to start. -This is all handled automatically. -The script will continue by removing each self-hosted daemonset and verifying that static pods are ready and healthy. - -## Manual Conversion - -Check that Talos runs self-hosted control plane: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 2 true -``` - -Talos machine configuration need to be updated to the 0.9 format; there are two new required machine configuration settings: - -* `.cluster.serviceAccount` is the service account PEM-encoded private key. -* `.cluster.aggregatorCA` is the aggregator CA for `kube-apiserver` (certficiate and private key). - -Current service account can be fetched from the Kubernetes secrets: - -```bash -$ kubectl -n kube-system get secrets kube-controller-manager -o jsonpath='{.data.service\-account\.key}' -LS0tLS1CRUdJTiBSU0EgUFJJVkFURS... -``` - -All control plane node machine configurations should be patched with the service account key: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/serviceAccount", "value": {"key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURS..."}}]' -patched mc at the node 172.20.0.2 -``` - -Aggregator CA can be generated using OpenSSL or any other certificate generation tools: RSA or ECDSA certificate with CN `front-proxy` valid for 10 years. -PEM-encoded CA certificate and key should be base64-encoded and patched into the machine config at path `/cluster/aggregatorCA`: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/aggregatorCA", "value": {"crt": "S0tLS1CRUdJTiBDRVJUSUZJQ...", "key": "LS0tLS1CRUdJTiBFQy..."}}]' -patched mc at the node 172.20.0.2 -``` - -At this point static pod definitions and bootstrap manifests should be rendered, please see "Automated Conversion" on how to verify generated objects. -Feel free to continue to refine your machine configuration until the generated static pod definitions and bootstrap manifests look good. - -If static pod definitions are not generated, check logs with `talosctl -n logs controller-runtime`. - -Disable `pod-checkpointer` with: - -```bash -$ kubectl -n kube-system delete ds pod-checkpointer -daemonset.apps "pod-checkpointer" deleted -``` - -Wait for all pod checkpoints to be removed: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -pod-checkpointer-8q2lh-talos-default-master-2 1/1 Running 0 3m34s -pod-checkpointer-nnm5w-talos-default-master-3 1/1 Running 0 3m24s -pod-checkpointer-qnmdt-talos-default-master-1 1/1 Running 0 2m21s -``` - -Pod checkpoints have annotation `checkpointer.alpha.coreos.com/checkpoint-of`. - -Once all the pod checkpoints are removed (it takes 5 minutes for the checkpoints to be removed), proceed by removing self-hosted initialized key: - -```bash -talosctl -n convert-k8s --remove-initialized-key -``` - -Talos controllers will now render static pod definitions, and the kubelet will launch any resulting static pods. - -Once static pods are visible in `kubectl get pods -n kube-system` output, proceed by removing each of the self-hosted daemonsets: - -```bash -$ kubectl -n kube-system delete daemonset kube-apiserver -daemonset.apps "kube-apiserver" deleted -``` - -Make sure static pods for `kube-apiserver` got started successfully, pods are running and ready. - -Proceed by deleting `kube-controller-manager` and `kube-scheduler` daemonsets, verifying that static pods are running between each step: - -```bash -$ kubectl -n kube-system delete daemonset kube-controller-manager -daemonset.apps "kube-controller-manager" deleted -``` - -```bash -$ kubectl -n kube-system delete daemonset kube-scheduler -daemonset.apps "kube-scheduler" deleted -``` diff --git a/website/content/v0.11/guides/customizing-the-kernel.md b/website/content/v0.11/guides/customizing-the-kernel.md deleted file mode 100644 index 22b76a959..000000000 --- a/website/content/v0.11/guides/customizing-the-kernel.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -Build and push your own kernel: - - ```sh - git clone https://github.com/talos-systems/pkgs.git - cd pkgs - make kernel-menuconfig USERNAME=_your_github_user_name_ - - docker login ghcr.io --username _your_github_user_name_ - make kernel USERNAME=_your_github_user_name_ PUSH=true - ``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM ghcr.io/talos-systems/installer:latest -COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -To build the image, run: - -```bash -DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . -``` - -> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.11/guides/customizing-the-root-filesystem.md b/website/content/v0.11/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.11/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.11/guides/deploy-metrics-server.md b/website/content/v0.11/guides/deploy-metrics-server.md deleted file mode 100644 index 0471cdbfc..000000000 --- a/website/content/v0.11/guides/deploy-metrics-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v0.11/guides/disaster-recovery.md b/website/content/v0.11/guides/disaster-recovery.md deleted file mode 100644 index 286b70080..000000000 --- a/website/content/v0.11/guides/disaster-recovery.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --on-reboot` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's `EPHEMERAL` partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v0.11/guides/disk-encryption.md b/website/content/v0.11/guides/disk-encryption.md deleted file mode 100644 index 04b3fbfd8..000000000 --- a/website/content/v0.11/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.11/guides/editing-machine-configuration.md b/website/content/v0.11/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.11/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.11/guides/managing-pki.md b/website/content/v0.11/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.11/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.11/guides/rbac.md b/website/content/v0.11/guides/rbac.md deleted file mode 100644 index a3a48f2d5..000000000 --- a/website/content/v0.11/guides/rbac.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Role-based access control (RBAC) ---- - -Talos v0.11 introduced initial support for role-based access control (RBAC). -This guide will explain what that is and how to enable it without losing access to the cluster. - -## RBAC in Talos - -Talos uses certificates to authorize users. -The certificate subject's organization field is used to encode user roles. -There is a set of predefined roles that allow access to different [API methods](../../reference/api/): - -* `os:admin` grants access to all methods; -* `os:reader` grants access to "safe" methods (for example, that includes the ability to list files, but does not include the ability to read files content); -* `os:etcd:backup` grants access to [`/machine.MachineService/EtcdSnapshot`](../../reference/api/#machine.EtcdSnapshotRequest) method. - -Roles in the current `talosconfig` can be checked with the following command (using [`yq` v4](https://github.com/mikefarah/yq)): - -```sh -$ yq eval '.contexts[.context].crt' talosconfig | base64 -d | openssl x509 -noout -text - -Certificate: - Data: - [...] - Subject: O = os:reader - [...] -``` - -RBAC is enabled by default in new clusters created with `talosctl` v0.11 and disabled otherwise. - -## Enabling RBAC - -First, both the Talos cluster and `talosctl` tool should be [upgraded](../upgrading-talos/) to v0.11. -Then the `talosctl config new` command should be used to generate a new client configuration with the `os:admin` role. -Additional configurations and certificates for different roles can be generated by passing `--roles` flag: - -```sh -talosctl config new --roles=os:reader reader -``` - -That command will create a new client configuration file `reader` with a new certificate with `os:reader` role. - -After that, RBAC should be enabled in the machine configuration: - -```yaml -machine: - features: - rbac: true -``` diff --git a/website/content/v0.11/guides/resetting-a-machine.md b/website/content/v0.11/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.11/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.11/guides/storage.md b/website/content/v0.11/guides/storage.md deleted file mode 100644 index 7e53db95e..000000000 --- a/website/content/v0.11/guides/storage.md +++ /dev/null @@ -1,220 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -In Kubernetes, using storage in the right way is well-facilitated by the API. -However, unless you are running in a major public cloud, that API may not be hooked up to anything. -This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. -There are a _lot_ of options out there, and it can be fairly bewildering. - -For Talos, we try to limit the options somewhat to make the decision-making easier. - -## Public Cloud - -If you are running on a major public cloud, use their block storage. -It is easy and automatic. - -## Storage Clusters - -Redundancy in storage is usually very important. -Scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. - -Running a storage cluster can be a very good choice when managing your own storage, and there are two project we recommend, depending on your situation. - -If you need vast amounts of storage composed of more than a dozen or so disks, just use Rook to manage Ceph. -Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. -Ceph also bundles in an S3-compatible object store. -The down side of Ceph is that there are a lot of moving parts. - -> Please note that _most_ people should _never_ use mount-many semantics. -> NFS is pervasive because it is old and easy, _not_ because it is a good idea. -> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. - -If your storage needs are small enough to not need Ceph, use Mayastor. - -### Rook/Ceph - -[Ceph](https://ceph.io) is the grandfather of open source storage clusters. -It is big, has a lot of pieces, and will do just about anything. -It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. -It comes bundled with RadosGW, an S3-compatible object store. -It comes with CephFS, a NFS-like clustered filesystem. -And of course, it comes with RBD, a block storage system. - -With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. - -So if Ceph is so great, why not use it for everything? - -Ceph can be rather slow for small clusters. -It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. -Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. - -Troubleshooting Ceph can be difficult if you do not understand its architecture. -There are lots of acronyms and the documentation assumes a fair level of knowledge. -There are very good tools for inspection and debugging, but this is still frequently seen as a concern. - -### Mayastor - -[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. -(Despite the name, Mayastor does _not_ require you to have NVME drives.) -It is fast and lean but still cluster-oriented and cloud native. -Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. - -Unlike Ceph, Mayastor is _just_ a block store. -It focuses on block storage and does it well. -It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. - -Mayastor is new, maybe _too_ new. -If you're looking for something well-tested and battle-hardened, this is not it. -If you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. - -### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -This can be done with `talosctl edit machineconfig` or via config patches during `talosctl gen config`. - -- Under `/machine/sysctls`, add `vm.nr_hugepages: "512"` -- Under `/machine/kubelet/extraMounts`, add `/var/local` like so: - -```yaml -... -extraMounts: - - destination: /var/local - type: bind - source: /var/local - options: - - rbind - - rshared - - rw -... -``` - -- Either using `kubectl taint node` in a pre-existing cluster or by updating `/machine/kubelet/extraArgs` in machine config, add `openebs.io/engine=mayastor` as a node label. -If being done via machine config, `extraArgs` may look like: - -```yaml -... -extraArgs: - node-labels: openebs.io/engine=mayastor -... -``` - -### Deploy Mayastor - -Using the [Mayastor docs](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) as a reference, apply all YAML files necessary. -At the time of writing this looked like: - -```bash -kubectl create namespace mayastor - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-rbac.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/nats-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/csi/moac/crds/mayastorpool.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/csi-daemonset.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/mayastor-daemonset.yaml -``` - -### Create Pools - -Each "storage" node should have a "MayastorPool" that defines the local disks to use for storage. -These are later considered during scheduling and replication of data. -Create the pool by issuing the following, updating as necessary: - -```bash -cat < - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -This document mostly applies only to Talos 0.9 control plane based on static pods. -If Talos was upgraded from version 0.8, it might be still running self-hosted control plane, current status can -be checked with the command `talosctl get bootstrapstatus`: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 1 false -``` - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.11/guides/upgrading-kubernetes.md b/website/content/v0.11/guides/upgrading-kubernetes.md deleted file mode 100644 index ee4a20d26..000000000 --- a/website/content/v0.11/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To upgrade from Kubernetes v1.20.1 to v1.20.4 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.20.1 --to 1.20.4 -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -updating "kube-apiserver" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:01 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:05 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:55:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-controller-manager" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:56:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-scheduler" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:56:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:56:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:57:08 retrying error: config version mismatch: got "2", expected "3" -updating daemonset "kube-proxy" to version "1.20.4" -``` - -Script runs in two phases: - -1. In the first phase every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. - Messages `config version mismatch` indicate that script is waiting for the updated container to be registered in the API server. -2. In the second phase script updates `kube-proxy` daemonset with the new image version. - -If script fails for any reason, it can be safely restarted to continue upgrade process. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -## Kubelet - -Upgrading Kubelet version requires Talos node reboot after machine configuration change. - -For every node, patch machine configuration with new kubelet version, wait for the node to reboot: - -```bash -$ talosctl -n patch mc -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -Once node boots with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.20.4 -``` diff --git a/website/content/v0.11/guides/upgrading-talos.md b/website/content/v0.11/guides/upgrading-talos.md deleted file mode 100644 index 9380383b7..000000000 --- a/website/content/v0.11/guides/upgrading-talos.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Upgrading from Talos 0.9 - -TBD - -### After Upgrade to 0.10 - -TBD - -### After Upgrade to 0.11 - -TBD - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.11.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.11.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -TBD diff --git a/website/content/v0.11/guides/vip.md b/website/content/v0.11/guides/vip.md deleted file mode 100644 index 12205537d..000000000 --- a/website/content/v0.11/guides/vip.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.11/introduction/_index.md b/website/content/v0.11/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.11/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.11/introduction/getting-started.md b/website/content/v0.11/introduction/getting-started.md deleted file mode 100644 index cc6ab38a5..000000000 --- a/website/content/v0.11/introduction/getting-started.md +++ /dev/null @@ -1,460 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../../introduction/quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.11.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.11.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.11.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.11.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.11.0/boot-amd64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.11.0/boot-amd64.tar.gz) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.11.0/boot-ard64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.11.0/boot-ard64.tar.gz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](https://talos.dev/docs/v0.11/reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `join.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Join - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Join. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Join Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Join Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `join.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp join.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. -The author of this document does not set a default node. - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.11/introduction/quickstart.md b/website/content/v0.11/introduction/quickstart.md deleted file mode 100644 index 7b8bbb1e5..000000000 --- a/website/content/v0.11/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.11.0) containerd://1.4.3 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.11.0) containerd://1.4.3 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.11/introduction/system-requirements.md b/website/content/v0.11/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.11/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.11/introduction/what-is-new.md b/website/content/v0.11/introduction/what-is-new.md deleted file mode 100644 index 1f770bb77..000000000 --- a/website/content/v0.11/introduction/what-is-new.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: What's New in Talos 0.11 -weight: 5 ---- - -## Networking Configuration - -Talos networking configuration was [completely rewritten](../../learn-more/networking-resources/) to be based on controllers -and resources. -There are no changes to the machine configuration, but any update to `.machine.network` can now -be applied in immediate mode (without a reboot). -Talos should be setting up network configuration much faster on boot now, not blocking on DHCP for unconfigured -interfaces and skipping the reset network step. - -## Talos API RBAC - -Limited [RBAC support](../../guides/rbac/) in Talos API is now enabled by default for Talos 0.11. -Default `talosconfig` has `os:admin` role embedded in the certificate so that all the APIs are available. -Certificates with reduced set of roles can be created with `talosctl config new` command. - -When upgrading from Talos 0.10, RBAC is not enabled by default. -Before enabling RBAC, generate `talosconfig` with `os:admin` role first to make sure that administrator still has access to the cluster when RBAC is enabled. - -List of available roles: - -* `os:admin` role enables every Talos API -* `os:reader` role limits access to read-only APIs which do not return sensitive data -* `os:etcd:backup` role only allows `talosctl etcd snapshot` API call (for etcd backup automation) - -## Default to Bootstrap workflow - -The `init.yaml` is no longer an output of `talosctl gen config`. -We now encourage using the bootstrap API, instead of `init` node types, as we -intend on deprecating this machine type in the future. -The `init.yaml` and `controlplane.yaml` machine configs are identical with the -exception of the machine type. -Users can use a modified `controlplane.yaml` with the machine type set to -`init` if they would like to avoid using the bootstrap API. - -## Component Updates - -* containerd was updated to 1.5.2 -* Linux kernel was updated to 5.10.45 -* Kubernetes was updated to 1.21.2 -* etcd was updated to 3.4.16 - -## CoreDNS - -Added the flag `cluster.coreDNS.disabled` to coreDNS deployment during the cluster bootstrap. - -## Legacy BIOS Support - -Added an option to the `machine.install` section of the machine config that can enable marking MBR partition bootable -for the machines that have legacy BIOS which does not support GPT partitioning scheme. - -## Multi-arch Installer - -Talos installer image (for any arch) now contains artifacts for both `amd64` and `arm64` architecture. -This means that e.g. images for arm64 SBCs can be generated on amd64 host. diff --git a/website/content/v0.11/introduction/what-is-talos.md b/website/content/v0.11/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.11/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.11/learn-more/_index.md b/website/content/v0.11/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.11/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.11/learn-more/architecture.md b/website/content/v0.11/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.11/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.11/learn-more/components.md b/website/content/v0.11/learn-more/components.md deleted file mode 100644 index eed0fdee7..000000000 --- a/website/content/v0.11/learn-more/components.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.11/learn-more/concepts.md b/website/content/v0.11/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.11/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.11/learn-more/control-plane.md b/website/content/v0.11/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.11/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.11/learn-more/controllers-resources.md b/website/content/v0.11/learn-more/controllers-resources.md deleted file mode 100644 index d46cfae4e..000000000 --- a/website/content/v0.11/learn-more/controllers-resources.md +++ /dev/null @@ -1,229 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, -listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v0.11/learn-more/faqs.md b/website/content/v0.11/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.11/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.11/learn-more/networking-resources.md b/website/content/v0.11/learn-more/networking-resources.md deleted file mode 100644 index f9e58a549..000000000 --- a/website/content/v0.11/learn-more/networking-resources.md +++ /dev/null @@ -1,394 +0,0 @@ ---- -title: "Networking Resources" -weight: 10 ---- - -Starting with version 0.11, a new implementation of the network configuration subsystem is powered by [COSI](../controllers-resources/). -The new implementation is still using the same machine configuration file format and external sources to configure a node's network, so there should be no difference -in the way Talos works in 0.11. - -The most notable change in Talos 0.11 is that all changes to machine configuration `.machine.network` can be applied now in immediate mode (without a reboot) via -`talosctl edit mc --immediate` or `talosctl apply-config --immediate`. - -## Resources - -There are six basic network configuration items in Talos: - -* `Address` (IP address assigned to the interface/link); -* `Route` (route to a destination); -* `Link` (network interface/link configuration); -* `Resolver` (list of DNS servers); -* `Hostname` (node hostname and domainname); -* `TimeServer` (list of NTP servers). - -Each network configuration item has two counterparts: - -* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); -* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. - -| Resource | Status | Spec | -|--------------------|------------------------|----------------------| -| `Address` | `AddressStatus` | `AddressSpec` | -| `Route` | `RouteStatus` | `RouteSpec` | -| `Link` | `LinkStatus` | `LinkSpec` | -| `Resolver` | `ResolverStatus` | `ResolverSpec` | -| `Hostname` | `HostnameStatus` | `HostnameSpec` | -| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | - -Status resources have aliases with the `Status` suffix removed, so for example -`AddressStatus` is also available as `Address`. - -Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. - -## Observing State - -The current network configuration state can be observed by querying `*Status` resources via -`talosctl`: - -```sh -$ talosctl get addresses -NODE NAMESPACE TYPE ID VERSION ADDRESS LINK -172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 -172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 -172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 -172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 -172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo -172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo -``` - -In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and -addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). - -Talos networking controllers watch the kernel state and update resources -accordingly. - -Additional details about the address can be accessed via the YAML output: - -```sh -$ talosctl get address eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressStatuses.net.talos.dev - id: eth0/172.20.0.2/24 - version: 1 - owner: network.AddressStatusController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - address: 172.20.0.2/24 - local: 172.20.0.2 - broadcast: 172.20.0.255 - linkIndex: 4 - linkName: eth0 - family: inet4 - scope: global - flags: permanent -``` - -Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. - -Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. -For example: - -```sh -$ talosctl get resolvers -NODE NAMESPACE TYPE ID VERSION RESOLVERS -172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] -``` - -## Inspecting Configuration - -The desired networking configuration is combined from multiple sources and presented -as `*Spec` resources: - -```sh -$ talosctl get addressspecs -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 -172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 -172.20.0.2 network AddressSpec lo/::1/128 2 -``` - -These `AddressSpecs` are applied to the Linux kernel to reach the desired state. -If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. - -`*Spec` resources can't be manipulated directly, they are generated automatically by Talos -from multiple configuration sources (see a section below for details). - -If a `*Spec` resource is queried in YAML format, some additional information is available: - -```sh -$ talosctl get addressspecs eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressSpecs.net.talos.dev - id: eth0/172.20.0.2/24 - version: 2 - owner: network.AddressMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.AddressSpecController -spec: - address: 172.20.0.2/24 - linkName: eth0 - family: inet4 - scope: global - flags: permanent - layer: operator -``` - -An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. - -## Configuration Merging - -Spec resources described in the previous section show the final merged configuration state, -while initial specs are put to a different unmerged namespace `network-config`. -Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. - -Let's take `HostnameSpec` as an example. -The final merged representation is: - -```sh -$ talosctl get hostnamespec -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: HostnameSpecs.net.talos.dev - id: hostname - version: 2 - owner: network.HostnameMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.HostnameSpecController -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that the final configuration for the hostname is `talos-default-master-1`. -And this is the hostname that was actually applied. -This can be verified by querying a `HostnameStatus` resource: - -```sh -$ talosctl get hostnamestatus -NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME -172.20.0.2 network HostnameStatus hostname 1 talos-default-master-1 -``` - -Initial configuration for the hostname in the `network-config` namespace is: - -```sh -$ talosctl get hostnamespec -o yaml --namespace network-config -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: default/hostname - version: 2 - owner: network.HostnameConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-172-20-0-2 - domainname: "" - layer: default ---- -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: dhcp4/eth0/hostname - version: 1 - owner: network.OperatorSpecController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that there are two specs for the hostname: - -* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); -* another one from the layer `operator` that defines the hostname as `talos-default-master-1` (DHCP). - -Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. -Here is the order of precedence from low to high: - -* `default` (defaults provided by Talos); -* `cmdline` (from the kernel command line); -* `platform` (driven by the cloud provider); -* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); -* `configuration` (derived from the machine configuration). - -So in our example the `operator` layer `HostnameSpec` overwrites the `default` layer producing the final hostname `talos-default-master-1`. - -The merge process applies to all six core networking specs. -For each spec, the `layer` controls the merge behavior -If multiple configuration specs -appear at the same layer, they can be merged together if possible, otherwise merge result -is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). - -`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. - -## Network Operators - -Network operators provide dynamic network configuration which can change over time as the node is running: - -* DHCPv4 -* DHCPv6 -* Virtual IP - -Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. - -Operators are configured with `OperatorSpec` resources which describe when operators -should run and additional configuration for the operator: - -```sh -$ talosctl get operatorspecs -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: OperatorSpecs.net.talos.dev - id: dhcp4/eth0 - version: 1 - owner: network.OperatorConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - operator: dhcp4 - linkName: eth0 - requireUp: true - dhcp4: - routeMetric: 1024 -``` - -`OperatorSpec` resources are generated by Talos based on machine configuration mostly. -DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. -This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. - -Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: - -```sh -$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 -``` - -## Other Network Resources - -There are some additional resources describing the network subsystem state. - -The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: - -```sh -$ talosctl get nodeaddresses -NODE NAMESPACE TYPE ID VERSION ADDRESSES -10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] -``` - -* `default` is the node default address; -* `current` is the set of addresses a node currently has; -* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). - -`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. - -Another important resource is `Nodename` which provides `Node` name in Kubernetes: - -```sh -$ talosctl get nodename -NODE NAMESPACE TYPE ID VERSION NODENAME -10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v -``` - -Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. - -`NetworkStatus` aggregates the current state of the network configuration: - -```sh -$ talosctl get networkstatus -o yaml -node: 10.100.2.23 -metadata: - namespace: network - type: NetworkStatuses.net.talos.dev - id: status - version: 5 - owner: network.StatusController - phase: running - created: 2021-06-24T18:56:00Z - updated: 2021-06-24T18:56:02Z -spec: - addressReady: true - connectivityReady: true - hostnameReady: true - etcFilesReady: true -``` - -## Network Controllers - -For each of the six basic resource types, there are several controllers: - -* `*StatusController` populates `*Status` resources observing the Linux kernel state. -* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. -* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. -* `*SpecController` applies merged `*Spec` resources to the kernel state. - -For the network operators: - -* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. -* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. - -## Configuration Sources - -There are several configuration sources for the network configuration, which are described in this section. - -### Defaults - -* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; -* hostname is set to the `talos-` where `IP` is the default node address; -* resolvers are set to `8.8.8.8`, `1.1.1.1`; -* time servers are set to `pool.ntp.org`; -* DHCP4 operator is run on any physical interface which is not configured explicitly. - -### Cmdline - -The kernel command line is parsed for the following options: - -* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; -* `talos.hostname=` option is used to set node hostname; -* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. - -### Platform - -Platform configuration delivers cloud environment-specific options (e.g. the hostname). - -### Operator - -Network operators provide configuration for all basic resource types. - -### Machine Configuration - -The machine configuration is parsed for link configuration, addresses, routes, hostname, -resolvers and time servers. -Any changes to `.machine.network` configuration can be applied in immediate mode. - -## Network Configuration Debugging - -Most of the network controller operations and failures are logged to the kernel console, -additional logs with `debug` level are available with `talosctl logs controller-runtime` command. -If the network configuration can't be established and the API is not available, `debug` level -logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v0.11/learn-more/philosophy.md b/website/content/v0.11/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.11/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.11/learn-more/talosctl.md b/website/content/v0.11/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.11/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.11/learn-more/upgrades.md b/website/content/v0.11/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.11/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.11/local-platforms/_index.md b/website/content/v0.11/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.11/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.11/local-platforms/docker.md b/website/content/v0.11/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.11/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.11/local-platforms/firecracker.md b/website/content/v0.11/local-platforms/firecracker.md deleted file mode 100644 index 2d541a922..000000000 --- a/website/content/v0.11/local-platforms/firecracker.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Firecracker -description: "Creating Talos Kubernetes cluster using Firecracker VMs." ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.9.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.9.5/cni-plugins-linux-amd64-v0.9.5.tgz -L -o cni-plugins-linux-amd64-v0.9.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.9.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.11.0`: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/vmlinuz -L -o _out/vmlinuz -curl https://github.com/talos-systems/talos/releases/latest/download/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.11/local-platforms/qemu.md b/website/content/v0.11/local-platforms/qemu.md deleted file mode 100644 index 1a5589b6d..000000000 --- a/website/content/v0.11/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.11.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.11.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.11.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.11/local-platforms/virtualbox.md b/website/content/v0.11/local-platforms/virtualbox.md deleted file mode 100644 index 801ea730f..000000000 --- a/website/content/v0.11/local-platforms/virtualbox.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.11/reference/_index.md b/website/content/v0.11/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.11/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.11/reference/api.md b/website/content/v0.11/reference/api.md deleted file mode 100644 index b1c6d006e..000000000 --- a/website/content/v0.11/reference/api.md +++ /dev/null @@ -1,3475 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FeaturesInfo](#machine.FeaturesInfo) - - [FileInfo](#machine.FileInfo) - - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) - - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) - - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) - - [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | -| INPUT_DESTROY_READY | 4 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FeaturesInfo -FeaturesInfo describes individual Talos features that can be switched on or off. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### GenerateClientConfiguration - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | -| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | -| key | [bytes](#bytes) | | PEM-encoded generated client key. | -| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | - - - - - - - - -### GenerateClientConfigurationRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| roles | [string](#string) | repeated | Roles in the generated client certificate. | -| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | - - - - - - - - -### GenerateClientConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesResponse -rpc processes - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### RemoveBootkubeInitializedKey -RemoveBootkubeInitializedKeyResponse describes the response to a RemoveBootkubeInitializedKey request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RemoveBootkubeInitializedKeyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | -| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_JOIN | 3 | | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| RemoveBootkubeInitializedKey | [.google.protobuf.Empty](#google.protobuf.Empty) | [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | -| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| created | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| updated | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| tail_events | [uint32](#uint32) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.11/reference/cli.md b/website/content/v0.11/reference/cli.md deleted file mode 100644 index e454ea835..000000000 --- a/website/content/v0.11/reference/cli.md +++ /dev/null @@ -1,2216 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --bad-rtc launch VM with bad RTC state (QEMU only) - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.11.0-alpha.2/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-join string patch generated machineconfigs (applied to 'join' type) - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.21.2") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config contexts - -List defined contexts - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config info - -Show information about the current context - -``` -talosctl config info [flags] -``` - -### Options - -``` - -h, --help help for info -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config merge - -Merge additional contexts from another client configuration file - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config new - -Generate a new client configuration file - -``` -talosctl config new [] [flags] -``` - -### Options - -``` - --crt-ttl duration certificate TTL (default 87600h0m0s) - -h, --help help for new - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config - -Manage the client configuration file (talosconfig) - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config info](#talosctl-config-info) - Show information about the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file -* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl convert-k8s - -Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). - -### Synopsis - -Command converts control plane bootstrapped on Talos <= 0.8 to Talos-managed control plane (Talos >= 0.9). -As part of the conversion process tool reads existing configuration of the control plane, updates -Talos node configuration to reflect changes made since the boostrap time. Once config is updated, -tool releases static pods and deletes self-hosted DaemonSets. - -``` -talosctl convert-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --force skip prompts, assume yes - -h, --help help for convert-k8s -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use -a control plane node, common in a single node control plane setup, use port 6443 as -this is the port that the API server binds to on every control plane node. For an HA -setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-join string patch generated machineconfigs (applied to 'join' type) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. Pod-checkpointer is handled in a special way to speed up kube-apisever upgrades. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.21.2") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl convert-k8s](#talosctl-convert-k8s) - Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.11/reference/configuration.md b/website/content/v0.11/reference/configuration.md deleted file mode 100644 index 3f9d62ee9..000000000 --- a/website/content/v0.11/reference/configuration.md +++ /dev/null @@ -1,5140 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: -```bash -talosctl gen config --version v1alpha1 -```` - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
- -
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
- -
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk characteristics like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - - -Valid values: - - - - init - - - controlplane - - - join -
- -
- -
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
- -
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.21.2 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
- -
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
- -
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
- -
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk characteristics like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
- -
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
- -
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
- -
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
- -
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
- -
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- -
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - - -
- -
- -
- -features FeaturesConfig - -
-
- -Features describe individual Talos features that can be switched on or off. - - - -Examples: - - -``` yaml -features: - rbac: true # Enable role-based access control (RBAC). -``` - - -
- -
- - - - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
- -
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
- -
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- -
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
- -
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.21.2 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
- -
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.21.2 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
- -
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.21.2 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
- -
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.21.2 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
- -
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" -``` - - -
- -
- -
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - - -
- -
- -
- -externalCloudProvider ExternalCloudProviderConfig - -
-
- -External cloud provider configuration. - - - -Examples: - - -``` yaml -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- -
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
- -
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the extraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
- -
- -inlineManifests ClusterInlineManifests - -
-
- -A list of inline Kubernetes manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -``` - - -
- -
- -
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
- -
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.21.2 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.21.2 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
- -
- -extraMounts []Mount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
- -
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
- -
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- -
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
- -
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk characteristics like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
- -
- -diskSelector InstallDiskSelector - -
-
- -Look up disk using disk characteristics like model, size, serial and others. -Always has priority over `disk`. - - - -Examples: - - -``` yaml -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
- -
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
- -
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
- -
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -legacyBIOSSupport bool - -
-
- -Indicates if MBR partition should be marked as bootable (active). -Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. - -
- -
- - - - - -## InstallDiskSizeMatcher -InstallDiskSizeMatcher disk size condition parser. - -Appears in: - - -- InstallDiskSelector.size - - -``` yaml -4GB -``` -``` yaml -'> 1TB' -``` -``` yaml -<= 2TB -``` - - - -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - - -- InstallConfig.diskSelector - - -``` yaml -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -size InstallDiskSizeMatcher - -
-
- -Disk size. - - - -Examples: - - -``` yaml -size: 4GB -``` - -``` yaml -size: '> 1TB' -``` - -``` yaml -size: <= 2TB -``` - - -
- -
- -
- -name string - -
-
- -Disk name `/sys/block//device/name`. - -
- -
- -
- -model string - -
-
- -Disk model `/sys/block//device/model`. - -
- -
- -
- -serial string - -
-
- -Disk serial number `/sys/block//serial`. - -
- -
- -
- -modalias string - -
-
- -Disk modalias `/sys/block//device/modalias`. - -
- -
- -
- -uuid string - -
-
- -Disk UUID `/sys/block//uuid`. - -
- -
- -
- -wwid string - -
-
- -Disk WWID `/sys/block//wwid`. - -
- -
- -
- -type InstallDiskType - -
-
- -Disk Type. - - -Valid values: - - - - ssd - - - hdd - - - nvme - - - sd -
- -
- - - - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
- -
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
- -
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - -
- -
- -disabled bool - -
-
- -Disable coredns deployment on cluster bootstrap. - -
- -
- -
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
- -
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.21.2 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.21.2 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
- - - - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.21.2 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.21.2 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.21.2 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
- -
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.21.2 -``` - - -
- -
- -
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.21.2 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.21.2 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "urls". -The "name" key supports the following options: "flannel", "custom", and "none". -"flannel" uses Talos-managed Flannel CNI, and that's the default option. -"custom" uses custom manifests that should be provided in "urls". -"none" indicates that Talos will not manage any CNI installation. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
- -
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
- -
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
- -
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - - -Valid values: - - - - flannel - - - custom - - - none -
- -
- -
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. -Should be present for "custom", must be empty for "flannel" and "none". - -
- -
- - - - - -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - - -- ClusterConfig.externalCloudProvider - - -``` yaml -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - -
- -
- -enabled bool - -
-
- -Enable external cloud provider. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -manifests []string - -
-
- -A list of urls that point to additional manifests for an external cloud provider. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- - - - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
- -
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
- -
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - - -- SystemDiskEncryptionConfig.state - -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
- -
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
- -
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - -
- -
- - - - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
- -
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
- -
- -slot int - -
-
- -Key slot number for luks2 encryption. - -
- -
- - - - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - - -- EncryptionKey.nodeID - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
- -
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
- -
- -path string - -
-
- -The path of the file. - -
- -
- -
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
- -
- -aliases []string - -
-
- -The host alias. - -
- -
- - - - - -## Device -Device represents a network interface. - -Appears in: - - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
- -
- -cidr string - -
-
- -Assigns a static IP address to the interface. -This should be in proper CIDR notation. - -> Note: This option is mutually exclusive with DHCP option. - - - -Examples: - - -``` yaml -cidr: 10.5.0.0/16 -``` - - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
- -
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
- -
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
- -
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. -> -> Note: To configure an interface with *only* IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false -> in order for Talos to skip configuration of addresses. -> All other options will still apply. - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
- -
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
- -
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
- -
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- -
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
- -
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
- -
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
- -
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
- -
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
- -
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
- -
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
- -
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
- -
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- -
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - - -- Device.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
- - - - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
- -
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
- -
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
- -
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - - -- Device.vlans - - - -
- -
- -cidr string - -
-
- -The CIDR to use. - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
- -
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - - - -## Route -Route represents a network route. - -Appears in: - - -- Device.routes - -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
- -
- -gateway string - -
-
- -The route's gateway. - -
- -
- -
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
- -
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
- -
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - - - -## FeaturesConfig -FeaturesConfig describe individual Talos features that can be switched on or off. - -Appears in: - - -- MachineConfig.features - - -``` yaml -rbac: true # Enable role-based access control (RBAC). -``` - -
- -
- -rbac bool - -
-
- -Enable role-based access control (RBAC). - -
- -
- - - - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - - -- APIServerConfig.extraVolumes - -- ControllerManagerConfig.extraVolumes - -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
- -
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
- -
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - - - -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - -
- -
- -name string - -
-
- -Name of the manifest. -Name should be unique. - - - -Examples: - - -``` yaml -name: csi -``` - - -
- -
- -
- -contents string - -
-
- -Manifest contents as a string. - - - -Examples: - - -``` yaml -contents: /etc/kubernetes/auth -``` - - -
- -
- - - - diff --git a/website/content/v0.11/reference/kernel.md b/website/content/v0.11/reference/kernel.md deleted file mode 100644 index 65192d7a5..000000000 --- a/website/content/v0.11/reference/kernel.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automtic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. diff --git a/website/content/v0.11/reference/platform.md b/website/content/v0.11/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.11/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.11/single-board-computers/_index.md b/website/content/v0.11/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.11/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.11/single-board-computers/bananapi_m64.md b/website/content/v0.11/single-board-computers/bananapi_m64.md deleted file mode 100644 index bc48c4c61..000000000 --- a/website/content/v0.11/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.11/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.11/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index a0b7e8f2a..000000000 --- a/website/content/v0.11/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.11/single-board-computers/pine64.md b/website/content/v0.11/single-board-computers/pine64.md deleted file mode 100644 index bc30430b3..000000000 --- a/website/content/v0.11/single-board-computers/pine64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64" -description: "Installing Talos on a Pine64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-pine64-arm64.img.xz -xz -d metal-pine64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-pine64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.11/single-board-computers/rock64.md b/website/content/v0.11/single-board-computers/rock64.md deleted file mode 100644 index 27827e8ae..000000000 --- a/website/content/v0.11/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.11/single-board-computers/rockpi_4.md b/website/content/v0.11/single-board-computers/rockpi_4.md deleted file mode 100644 index 70888807e..000000000 --- a/website/content/v0.11/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Boot Talos from an SSD Drive - -> Note: this is only tested on Rock PI 4c - -Rock PI 4 has an M2 slot which supports NVMe disks. -It is possible to run Talos without any SD cards right from that SSD disk. - -The pre-installed SPI loader won't be able to chain Talos u-boot on the SSD drive because it's too outdated. -The official docs on booting from the SSD also propose using an outdated SPI to flash u-boot. - -Instead, it is necessary to update u-boot to a more recent version for this process to work. -The Armbian u-boot build for Rock PI 4c has been proved to work: [https://users.armbian.com/piter75/](https://users.armbian.com/piter75/). - -### Steps - -- Flash any OS to the SD card (can be Armbian for example). -- Download Armbian u-boot and update SPI flash: - -```bash -curl -LO https://users.armbian.com/piter75/rkspi_loader-v20.11.2-trunk-v2.img -sudo dd if=rkspi_loader-v20.11.2-trunk-v2.img of=/dev/mtdblock0 bs=4K -``` - -- Optionally, you can also write Talos image to the SSD drive right from your Rock PI board: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -sudo dd if=metal-rockpi_4-arm64.img.xz of=/dev/nvme0n1 -``` - -- remove SD card and reboot. - -After these steps, Talos will boot from the SSD and enter maintenance mode. -The rest of the flow is the same as running Talos from the SD card. diff --git a/website/content/v0.11/single-board-computers/rpi_4.md b/website/content/v0.11/single-board-computers/rpi_4.md deleted file mode 100644 index c2bff5617..000000000 --- a/website/content/v0.11/single-board-computers/rpi_4.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and use [Raspberry Pi Imager](https://www.raspberrypi.org/software/) -to install the bootloader on it (select Operating System > Misc utility images > Bootloader > SD Card Boot). -Alternatively, you can use the console on Linux or macOS. -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -```bash -curl -Lo rpi-boot-eeprom-recovery.zip https://github.com/raspberrypi/rpi-eeprom/releases/download/v2021.04.29-138a1/rpi-boot-eeprom-recovery-2021-04-29-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0p1 /mnt -sudo bsdtar rpi-boot-eeprom-recovery.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached to the port closest to the power/USB-C port, -the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -> Note: if you have an HDMI display attached and it shows only a rainbow splash, -> please use the other HDMI port, the one closest to the power/USB-C port. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.11/virtualized-platforms/_index.md b/website/content/v0.11/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.11/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.11/virtualized-platforms/hyper-v.md b/website/content/v0.11/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.11/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.11/virtualized-platforms/kvm.md b/website/content/v0.11/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.11/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.11/virtualized-platforms/proxmox.md b/website/content/v0.11/virtualized-platforms/proxmox.md deleted file mode 100644 index 6eaf27444..000000000 --- a/website/content/v0.11/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.11.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". - -### With DHCP server - -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -### Without DHCP server - -To apply the machine configurations in maintenance mode, VM has to have IP on the network. -So you can set it on boot time manualy. - - - -Press `e` on the boot time. -And set the IP parameters for the VM. -[Format is](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt): - -```bash -ip=:::::: -``` - -For example $CONTROL_PLANE_IP will be 192.168.0.100 and gateway 192.168.0.1 - -```bash -linux /boot/vmlinuz init_on_alloc=1 slab_nomerge pti=on panic=0 consoleblank=0 printk.devkmsg=on earlyprintk=ttyS0 console=tty0 console=ttyS0 talos.platform=metal ip=192.168.0.100::192.168.0.1:255.255.255.0::eth0:off -``` - - - -Then press Ctrl-x or F10 - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplan.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.11/virtualized-platforms/vmware.md b/website/content/v0.11/virtualized-platforms/vmware.md deleted file mode 100644 index 10c975864..000000000 --- a/website/content/v0.11/virtualized-platforms/vmware.md +++ /dev/null @@ -1,203 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Control Plane Nodes - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint ,, -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.11/virtualized-platforms/xen.md b/website/content/v0.11/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.11/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.12/_index.md b/website/content/v0.12/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.12/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.12/bare-metal-platforms/_index.md b/website/content/v0.12/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.12/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.12/bare-metal-platforms/digital-rebar.md b/website/content/v0.12/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 7c85d83b7..000000000 --- a/website/content/v0.12/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview](../overview). - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/bare-metal-platforms/equinix-metal.md b/website/content/v0.12/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index dec278033..000000000 --- a/website/content/v0.12/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the Equinix Metal CLI installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `controlplane.yaml`, and `worker.yaml` -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config worker.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file worker.yaml -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/bare-metal-platforms/matchbox.md b/website/content/v0.12/bare-metal-platforms/matchbox.md deleted file mode 100644 index 89bc4e627..000000000 --- a/website/content/v0.12/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `controlplane.yaml`, and `worker.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/worker.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/bare-metal-platforms/sidero.md b/website/content/v0.12/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.12/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.12/cloud-platforms/_index.md b/website/content/v0.12/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.12/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.12/cloud-platforms/aws.md b/website/content/v0.12/cloud-platforms/aws.md deleted file mode 100644 index bebabefb9..000000000 --- a/website/content/v0.12/cloud-platforms/aws.md +++ /dev/null @@ -1,267 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Official AMI Images - -Official AMI image ID can be found in the `cloud-images.json` file attached to the Talos release: - -```bash -curl -sL https://github.com/siderolabs/talos/releases/download/v0.12.0/cloud-images.json | \ - jq -r '.[] | select(.region == "us-east-1") | select (.arch == "amd64") | .id' -``` - -Replace `us-east-1` and `amd64` in the line above with the desired region and architecture. - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: --with-examples=false --with-docs=false -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Take note that the generated configs are too long for AWS userdata field if the `--with-examples` and `--with-docs` flags are not passed. - -At this point, you can modify the generated configs to your liking. - -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 4 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://worker.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/cloud-platforms/azure.md b/website/content/v0.12/cloud-platforms/azure.md deleted file mode 100644 index bfdf828f0..000000000 --- a/website/content/v0.12/cloud-platforms/azure.md +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create the controlplane nodes -for i in $( seq 0 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./worker.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/cloud-platforms/digitalocean.md b/website/content/v0.12/cloud-platforms/digitalocean.md deleted file mode 100644 index 832178e3f..000000000 --- a/website/content/v0.12/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-1 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file worker.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/cloud-platforms/gcp.md b/website/content/v0.12/cloud-platforms/gcp.md deleted file mode 100644 index b027ba56f..000000000 --- a/website/content/v0.12/cloud-platforms/gcp.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create the control plane nodes. -for i in $( seq 1 3 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 3 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./worker.yaml -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/cloud-platforms/openstack.md b/website/content/v0.12/cloud-platforms/openstack.md deleted file mode 100644 index b60f66b6d..000000000 --- a/website/content/v0.12/cloud-platforms/openstack.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 1 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/worker.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/guides/_index.md b/website/content/v0.12/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.12/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.12/guides/advanced-networking.md b/website/content/v0.12/guides/advanced-networking.md deleted file mode 100644 index 8361db677..000000000 --- a/website/content/v0.12/guides/advanced-networking.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - addresses: - - 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo - addresses: - - 192.168.0.21/24 - - 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - addresses: - - "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.12/guides/air-gapped.md b/website/content/v0.12/guides/air-gapped.md deleted file mode 100644 index 4ae31568d..000000000 --- a/website/content/v0.12/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.12.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.12/guides/configuring-certificate-authorities.md b/website/content/v0.12/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.12/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.12/guides/configuring-containerd.md b/website/content/v0.12/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.12/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.12/guides/configuring-corporate-proxies.md b/website/content/v0.12/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.12/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.12/guides/configuring-network-connectivity.md b/website/content/v0.12/guides/configuring-network-connectivity.md deleted file mode 100644 index 94ea517bf..000000000 --- a/website/content/v0.12/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.12/guides/configuring-pull-through-cache.md b/website/content/v0.12/guides/configuring-pull-through-cache.md deleted file mode 100644 index 3b2e05fbc..000000000 --- a/website/content/v0.12/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `quay.io`, `gcr.io`, and `ghcr.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.12/guides/configuring-the-cluster-endpoint.md b/website/content/v0.12/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index d3d0bfd3b..000000000 --- a/website/content/v0.12/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. controlplane.yaml and worker.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.12/guides/configuring-wireguard-network.md b/website/content/v0.12/guides/configuring-wireguard-network.md deleted file mode 100644 index 6102d3966..000000000 --- a/website/content/v0.12/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > worker.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - addresses: - - 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.12/guides/customizing-the-kernel.md b/website/content/v0.12/guides/customizing-the-kernel.md deleted file mode 100644 index 22b76a959..000000000 --- a/website/content/v0.12/guides/customizing-the-kernel.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -Build and push your own kernel: - - ```sh - git clone https://github.com/talos-systems/pkgs.git - cd pkgs - make kernel-menuconfig USERNAME=_your_github_user_name_ - - docker login ghcr.io --username _your_github_user_name_ - make kernel USERNAME=_your_github_user_name_ PUSH=true - ``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM ghcr.io/talos-systems/installer:latest -COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -To build the image, run: - -```bash -DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . -``` - -> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.12/guides/customizing-the-root-filesystem.md b/website/content/v0.12/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.12/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.12/guides/deploy-metrics-server.md b/website/content/v0.12/guides/deploy-metrics-server.md deleted file mode 100644 index 0471cdbfc..000000000 --- a/website/content/v0.12/guides/deploy-metrics-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v0.12/guides/disaster-recovery.md b/website/content/v0.12/guides/disaster-recovery.md deleted file mode 100644 index 286b70080..000000000 --- a/website/content/v0.12/guides/disaster-recovery.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --on-reboot` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's `EPHEMERAL` partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v0.12/guides/disk-encryption.md b/website/content/v0.12/guides/disk-encryption.md deleted file mode 100644 index 04b3fbfd8..000000000 --- a/website/content/v0.12/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.12/guides/editing-machine-configuration.md b/website/content/v0.12/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.12/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.12/guides/managing-pki.md b/website/content/v0.12/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.12/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.12/guides/rbac.md b/website/content/v0.12/guides/rbac.md deleted file mode 100644 index 0a8848f35..000000000 --- a/website/content/v0.12/guides/rbac.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Role-based access control (RBAC) ---- - -Talos v0.11 introduced initial support for role-based access control (RBAC). -This guide will explain what that is and how to enable it without losing access to the cluster. - -## RBAC in Talos - -Talos uses certificates to authorize users. -The certificate subject's organization field is used to encode user roles. -There is a set of predefined roles that allow access to different [API methods](../../reference/api/): - -* `os:admin` grants access to all methods; -* `os:reader` grants access to "safe" methods (for example, that includes the ability to list files, but does not include the ability to read files content); -* `os:etcd:backup` grants access to [`/machine.MachineService/EtcdSnapshot`](../../reference/api/#machine.EtcdSnapshotRequest) method. - -Roles in the current `talosconfig` can be checked with the following command (using `talosctl` v0.12+): - -```sh -$ talosctl config info - -[...] -Roles: os:admin -[...] -``` - -RBAC is enabled by default in new clusters created with `talosctl` v0.11+ and disabled otherwise. - -## Enabling RBAC - -First, both the Talos cluster and `talosctl` tool should be [upgraded](../upgrading-talos/). -Then the `talosctl config new` command should be used to generate a new client configuration with the `os:admin` role. -Additional configurations and certificates for different roles can be generated by passing `--roles` flag: - -```sh -talosctl config new --roles=os:reader reader -``` - -That command will create a new client configuration file `reader` with a new certificate with `os:reader` role. - -After that, RBAC should be enabled in the machine configuration: - -```yaml -machine: - features: - rbac: true -``` diff --git a/website/content/v0.12/guides/resetting-a-machine.md b/website/content/v0.12/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.12/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.12/guides/storage.md b/website/content/v0.12/guides/storage.md deleted file mode 100644 index 7e53db95e..000000000 --- a/website/content/v0.12/guides/storage.md +++ /dev/null @@ -1,220 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -In Kubernetes, using storage in the right way is well-facilitated by the API. -However, unless you are running in a major public cloud, that API may not be hooked up to anything. -This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. -There are a _lot_ of options out there, and it can be fairly bewildering. - -For Talos, we try to limit the options somewhat to make the decision-making easier. - -## Public Cloud - -If you are running on a major public cloud, use their block storage. -It is easy and automatic. - -## Storage Clusters - -Redundancy in storage is usually very important. -Scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. - -Running a storage cluster can be a very good choice when managing your own storage, and there are two project we recommend, depending on your situation. - -If you need vast amounts of storage composed of more than a dozen or so disks, just use Rook to manage Ceph. -Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. -Ceph also bundles in an S3-compatible object store. -The down side of Ceph is that there are a lot of moving parts. - -> Please note that _most_ people should _never_ use mount-many semantics. -> NFS is pervasive because it is old and easy, _not_ because it is a good idea. -> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. - -If your storage needs are small enough to not need Ceph, use Mayastor. - -### Rook/Ceph - -[Ceph](https://ceph.io) is the grandfather of open source storage clusters. -It is big, has a lot of pieces, and will do just about anything. -It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. -It comes bundled with RadosGW, an S3-compatible object store. -It comes with CephFS, a NFS-like clustered filesystem. -And of course, it comes with RBD, a block storage system. - -With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. - -So if Ceph is so great, why not use it for everything? - -Ceph can be rather slow for small clusters. -It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. -Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. - -Troubleshooting Ceph can be difficult if you do not understand its architecture. -There are lots of acronyms and the documentation assumes a fair level of knowledge. -There are very good tools for inspection and debugging, but this is still frequently seen as a concern. - -### Mayastor - -[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. -(Despite the name, Mayastor does _not_ require you to have NVME drives.) -It is fast and lean but still cluster-oriented and cloud native. -Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. - -Unlike Ceph, Mayastor is _just_ a block store. -It focuses on block storage and does it well. -It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. - -Mayastor is new, maybe _too_ new. -If you're looking for something well-tested and battle-hardened, this is not it. -If you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. - -### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -This can be done with `talosctl edit machineconfig` or via config patches during `talosctl gen config`. - -- Under `/machine/sysctls`, add `vm.nr_hugepages: "512"` -- Under `/machine/kubelet/extraMounts`, add `/var/local` like so: - -```yaml -... -extraMounts: - - destination: /var/local - type: bind - source: /var/local - options: - - rbind - - rshared - - rw -... -``` - -- Either using `kubectl taint node` in a pre-existing cluster or by updating `/machine/kubelet/extraArgs` in machine config, add `openebs.io/engine=mayastor` as a node label. -If being done via machine config, `extraArgs` may look like: - -```yaml -... -extraArgs: - node-labels: openebs.io/engine=mayastor -... -``` - -### Deploy Mayastor - -Using the [Mayastor docs](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) as a reference, apply all YAML files necessary. -At the time of writing this looked like: - -```bash -kubectl create namespace mayastor - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-rbac.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/nats-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/csi/moac/crds/mayastorpool.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/csi-daemonset.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/mayastor-daemonset.yaml -``` - -### Create Pools - -Each "storage" node should have a "MayastorPool" that defines the local disks to use for storage. -These are later considered during scheduling and replication of data. -Create the pool by issuing the following, updating as necessary: - -```bash -cat < - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.12/guides/upgrading-kubernetes.md b/website/content/v0.12/guides/upgrading-kubernetes.md deleted file mode 100644 index abd787fc1..000000000 --- a/website/content/v0.12/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,309 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To check what is going to be upgraded you can run `talosctl upgrade-k8s` with `--dry-run` flag: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.21.3 --to 1.22.0 --dry-run -checking for resource APIs to be deprecated in version 1.22.0 -WARNING: found resources which are going to be deprecated/migrated in the version 1.22.0 -RESOURCE COUNT -validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 -mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 -customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 -apiservices.v1beta1.apiregistration.k8s.io 54 -leases.v1beta1.coordination.k8s.io 4 - -discovered master nodes ["10.5.0.2"] -updating "kube-apiserver" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-apiserver: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating "kube-controller-manager" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-controller-manager: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating "kube-scheduler" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-scheduler: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating daemonset "kube-proxy" to version "1.22.0" -skipped in dry-run -``` - -To upgrade Kubernetes from v1.21.3 to v1.22.0 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.21.3 --to 1.22.0 -checking for resource APIs to be deprecated in version 1.22.0 -discovered master nodes ["10.5.0.2"] -updating "kube-apiserver" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-apiserver: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating "kube-controller-manager" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-controller-manager: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating "kube-scheduler" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-scheduler: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating daemonset "kube-proxy" to version "1.22.0" -``` - -Script runs in two phases: - -1. In the first phase every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. - Messages `config version mismatch` indicate that script is waiting for the updated container to be registered in the API server. -2. In the second phase script updates `kube-proxy` daemonset with the new image version. - -If script fails for any reason, it can be safely restarted to continue upgrade process. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -## Kubelet - -Upgrading Kubelet version requires Talos node reboot after machine configuration change. - -For every node, patch machine configuration with new kubelet version, wait for the node to reboot: - -```bash -$ talosctl -n patch mc -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -Once node boots with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.20.4 -``` diff --git a/website/content/v0.12/guides/upgrading-talos.md b/website/content/v0.12/guides/upgrading-talos.md deleted file mode 100644 index 999996f63..000000000 --- a/website/content/v0.12/guides/upgrading-talos.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Upgrading from Talos 0.11 - -Only for clusters bootstrapped with Talos <= 0.8: please make sure control plane was converted to use static pods -(first introduced in Talos 0.9), as Talos 0.12 drops support for self-hosted control plane. - -### After Upgrade to 0.12 - -There are no special items to follow after the upgrade to Talos 0.12, please see section on machine configuration changes -below. - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.12.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.12.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -There are two new machine configuration fields introduced in Talos 0.12 which are not being used in Talos 0.12 yet, -but they will be used to support additional features in Talos 0.13: - -* `.cluster.id`: 32 random bytes, base64 encoded -* `.cluster.secret`: 32 random bytes, base64 encoded - -Values of these fields should be kept in sync across all nodes of the cluster (control plane and worker nodes). - -These fields can be added to the machine configuration of the running Talos cluster upgraded to Talos 0.12 with the following commands -(doesn't require a reboot): - -```bash -$ CLUSTER_ID=`dd if=/dev/urandom of=/dev/stdout bs=1 count=32 | base64` -32+0 records in -32+0 records out -32 bytes copied, 0,000180749 s, 177 kB/s -$ CLUSTER_SECRET=`dd if=/dev/urandom of=/dev/stdout bs=1 count=32 | base64` -32+0 records in -32+0 records out -32 bytes copied, 0,000180749 s, 177 kB/s -$ talosctl -n patch mc --immediate --patch "[{\"op\": \"add\", \"path\": \"/cluster/id\", \"value\": \"$CLUSTER_ID\"},{\"op\": \"add\", \"path\": \"/cluster/secret\", \"value\": \"$CLUSTER_SECRET\"}]" -patched mc at the node -``` - -Repeat the last command for every node of the cluster. diff --git a/website/content/v0.12/guides/vip.md b/website/content/v0.12/guides/vip.md deleted file mode 100644 index 12205537d..000000000 --- a/website/content/v0.12/guides/vip.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.12/introduction/_index.md b/website/content/v0.12/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.12/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.12/introduction/getting-started.md b/website/content/v0.12/introduction/getting-started.md deleted file mode 100644 index 8a89aa0fe..000000000 --- a/website/content/v0.12/introduction/getting-started.md +++ /dev/null @@ -1,460 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.12.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.12.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.12.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.12.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.12.0/boot-amd64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.12.0/boot-amd64.tar.gz) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.12.0/boot-ard64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.12.0/boot-ard64.tar.gz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](../../reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `worker.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Worker - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Worker. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Worker Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Worker Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `worker.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp worker.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. -The author of this document does not set a default node. - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.12/introduction/quickstart.md b/website/content/v0.12/introduction/quickstart.md deleted file mode 100644 index 37e276c61..000000000 --- a/website/content/v0.12/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.12.0) containerd://1.4.3 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.12.0) containerd://1.4.3 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.12/introduction/support-matrix.md b/website/content/v0.12/introduction/support-matrix.md deleted file mode 100644 index b8a6c9447..000000000 --- a/website/content/v0.12/introduction/support-matrix.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Support Matrix -weight: 6 ---- - -| Talos Version | 0.12 | 0.11 | -|----------------------------------------------------------------------------------------------------------------|------------------------------------|------------------------------------| -| Release Date | 2021-08-30 | 2021-07-08 (0.11.0) | -| End of Community Support | 2021-10-12 | 2021-09-15 | -| Enterprise Support | [offered by Talos Systems Inc.](https://www.talos-systems.com/support/) | -| Kubernetes | 1.22, 1.21, 1.20 | 1.21, 1.20, 1.19 | -| Architecture | amd64, arm64 | -| **Platforms** | | | -| - cloud | AWS, GCP, Azure, Digital Ocean, OpenStack | -| - bare metal | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | -| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | -| - SBCs | Raspberry Pi4, Banana Pi M64, Pine64, and other | -| - local | Docker, QEMU | -| **Cluster API** | | | -| [CAPI Bootstrap Provider Talos](https://github.com/talos-systems/cluster-api-bootstrap-provider-talos) | >= 0.2.0 | >= 0.2.0 | -| [CAPI Control Plane Provider Talos](https://github.com/talos-systems/cluster-api-control-plane-provider-talos) | >= 0.1.1 | >= 0.1.1 | -| [Sidero](https://www.sidero.dev/) | >= 0.3.0 | >= 0.3.0 | -| **UI** | | | -| [Theila](https://github.com/talos-systems/theila) | ✓ | ✓ | diff --git a/website/content/v0.12/introduction/system-requirements.md b/website/content/v0.12/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.12/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.12/introduction/what-is-new.md b/website/content/v0.12/introduction/what-is-new.md deleted file mode 100644 index 3c239a85c..000000000 --- a/website/content/v0.12/introduction/what-is-new.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: What's New in Talos 0.12 -weight: 5 ---- - -### Security - -* `etcd` PKI moved to `/system/secrets` -* `kubelet` bootstrap CSR auto-signing scoped to `kubelet` bootstrap tokens only -* enforce default `seccomp` profile on all system containers -* run system services apid, trustd, and etcd as non-root users - -### Performance - -* machined uses less memory and CPU time -* more disk encryption options are exposed via the machine configuration -* disk partitions are now aligned properly with minimum I/O size -* Talos system processes are moved under proper cgroups, resource metrics are now available via the kubelet -* OOM score is set on the system processes making sure they are killed last under memory pressure - -### etcd - -New etcd cluster members are now joined in [learner mode](https://etcd.io/docs/v3.4/learning/design-learner/), which improves cluster resiliency -to member join issues. - -### Machine Configuration - -Machine configuration is validated now for unsupported keys. -This change allows to catch issues with YAML indentation. - -### Networking - -* multiple static addresses can be specified for the interface with new `.addresses` field (old `.cidr` field is deprecated now) -* static addresses can be set on interfaces configured with DHCP - -### Kubernetes Upgrades - -`talosctl upgrade-k8s` now checks if cluster has any resources which are going to be removed or migrated to the new version after upgrade -and shows that as a warning before the upgrade. -Additionally, `upgrade-k8s` command now has `--dry-run` flag that only prints out warnings and upgrade summary. - -### Sysctl Configuration - -Sysctl Kernel Params configuration was completely rewritten to be based on controllers and resources, -which makes it possible to apply `.machine.sysctls` in immediate mode (without a reboot). -`talosctl get kernelparams` returns merged list of KSPP, Kubernetes and user defined params along with -the default values overwritten by Talos. - -### Equinix Metal - -Added support for Equinix Metal IPs for the Talos virtual (shared) IP (option `equinixMetal` under `vip` in the machine configuration). -Talos automatically re-assigns IP using the Equinix Metal API when leadership changes. - -### Support for Self-hosted Control Plane Dropped - -> **Note**: This item only applies to clusters bootstrapped with Talos <= 0.8. - -Talos 0.12 completely removes support for self-hosted Kubernetes control plane (bootkube-based). -Talos 0.9 introduced support for Talos-managed control plane and provided migration path to convert self-hosted control plane -to Talos-managed static pods. -Automated and manual conversion process is available in Talos from 0.9.x to 0.11.x. -For clusters bootstrapped with bootkube (Talos <= 0.8), please make sure control plane is converted to Talos-managed -before upgrading to Talos 0.12. -Current control plane status can be checked with `talosctl get bootstrapstatus` before performing upgrade to Talos 0.12. - -### Cluster API v0.3.x - -Cluster API v0.3.x (v1alpha3) is not compatible with Kubernetes 1.22 used by default in Talos 0.12. -Talos can be configued to use Kubernetes 1.21 or CAPI v0.4.x components can be used instead. - -### Join Node Type - -Node type `join` was renamed to `worker` for clarity. -The old value is still accepted in the machine configuration but deprecated. -`talosctl gen config` now generates `worker.yaml` instead of `join.yaml`. - -### Component Updates - -* Linux: 5.10.58 -* Kubernetes: 1.22.1 -* containerd: 1.5.5 -* runc: 1.0.1 -* GRUB: 2.06 -* Talos is built with Go 1.16.7 diff --git a/website/content/v0.12/introduction/what-is-talos.md b/website/content/v0.12/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.12/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.12/learn-more/_index.md b/website/content/v0.12/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.12/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.12/learn-more/architecture.md b/website/content/v0.12/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.12/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.12/learn-more/components.md b/website/content/v0.12/learn-more/components.md deleted file mode 100644 index eed0fdee7..000000000 --- a/website/content/v0.12/learn-more/components.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.12/learn-more/concepts.md b/website/content/v0.12/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.12/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.12/learn-more/control-plane.md b/website/content/v0.12/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.12/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.12/learn-more/controllers-resources.md b/website/content/v0.12/learn-more/controllers-resources.md deleted file mode 100644 index d46cfae4e..000000000 --- a/website/content/v0.12/learn-more/controllers-resources.md +++ /dev/null @@ -1,229 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, -listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v0.12/learn-more/faqs.md b/website/content/v0.12/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.12/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.12/learn-more/networking-resources.md b/website/content/v0.12/learn-more/networking-resources.md deleted file mode 100644 index f9e58a549..000000000 --- a/website/content/v0.12/learn-more/networking-resources.md +++ /dev/null @@ -1,394 +0,0 @@ ---- -title: "Networking Resources" -weight: 10 ---- - -Starting with version 0.11, a new implementation of the network configuration subsystem is powered by [COSI](../controllers-resources/). -The new implementation is still using the same machine configuration file format and external sources to configure a node's network, so there should be no difference -in the way Talos works in 0.11. - -The most notable change in Talos 0.11 is that all changes to machine configuration `.machine.network` can be applied now in immediate mode (without a reboot) via -`talosctl edit mc --immediate` or `talosctl apply-config --immediate`. - -## Resources - -There are six basic network configuration items in Talos: - -* `Address` (IP address assigned to the interface/link); -* `Route` (route to a destination); -* `Link` (network interface/link configuration); -* `Resolver` (list of DNS servers); -* `Hostname` (node hostname and domainname); -* `TimeServer` (list of NTP servers). - -Each network configuration item has two counterparts: - -* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); -* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. - -| Resource | Status | Spec | -|--------------------|------------------------|----------------------| -| `Address` | `AddressStatus` | `AddressSpec` | -| `Route` | `RouteStatus` | `RouteSpec` | -| `Link` | `LinkStatus` | `LinkSpec` | -| `Resolver` | `ResolverStatus` | `ResolverSpec` | -| `Hostname` | `HostnameStatus` | `HostnameSpec` | -| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | - -Status resources have aliases with the `Status` suffix removed, so for example -`AddressStatus` is also available as `Address`. - -Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. - -## Observing State - -The current network configuration state can be observed by querying `*Status` resources via -`talosctl`: - -```sh -$ talosctl get addresses -NODE NAMESPACE TYPE ID VERSION ADDRESS LINK -172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 -172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 -172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 -172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 -172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo -172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo -``` - -In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and -addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). - -Talos networking controllers watch the kernel state and update resources -accordingly. - -Additional details about the address can be accessed via the YAML output: - -```sh -$ talosctl get address eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressStatuses.net.talos.dev - id: eth0/172.20.0.2/24 - version: 1 - owner: network.AddressStatusController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - address: 172.20.0.2/24 - local: 172.20.0.2 - broadcast: 172.20.0.255 - linkIndex: 4 - linkName: eth0 - family: inet4 - scope: global - flags: permanent -``` - -Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. - -Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. -For example: - -```sh -$ talosctl get resolvers -NODE NAMESPACE TYPE ID VERSION RESOLVERS -172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] -``` - -## Inspecting Configuration - -The desired networking configuration is combined from multiple sources and presented -as `*Spec` resources: - -```sh -$ talosctl get addressspecs -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 -172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 -172.20.0.2 network AddressSpec lo/::1/128 2 -``` - -These `AddressSpecs` are applied to the Linux kernel to reach the desired state. -If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. - -`*Spec` resources can't be manipulated directly, they are generated automatically by Talos -from multiple configuration sources (see a section below for details). - -If a `*Spec` resource is queried in YAML format, some additional information is available: - -```sh -$ talosctl get addressspecs eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressSpecs.net.talos.dev - id: eth0/172.20.0.2/24 - version: 2 - owner: network.AddressMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.AddressSpecController -spec: - address: 172.20.0.2/24 - linkName: eth0 - family: inet4 - scope: global - flags: permanent - layer: operator -``` - -An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. - -## Configuration Merging - -Spec resources described in the previous section show the final merged configuration state, -while initial specs are put to a different unmerged namespace `network-config`. -Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. - -Let's take `HostnameSpec` as an example. -The final merged representation is: - -```sh -$ talosctl get hostnamespec -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: HostnameSpecs.net.talos.dev - id: hostname - version: 2 - owner: network.HostnameMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.HostnameSpecController -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that the final configuration for the hostname is `talos-default-master-1`. -And this is the hostname that was actually applied. -This can be verified by querying a `HostnameStatus` resource: - -```sh -$ talosctl get hostnamestatus -NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME -172.20.0.2 network HostnameStatus hostname 1 talos-default-master-1 -``` - -Initial configuration for the hostname in the `network-config` namespace is: - -```sh -$ talosctl get hostnamespec -o yaml --namespace network-config -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: default/hostname - version: 2 - owner: network.HostnameConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-172-20-0-2 - domainname: "" - layer: default ---- -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: dhcp4/eth0/hostname - version: 1 - owner: network.OperatorSpecController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that there are two specs for the hostname: - -* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); -* another one from the layer `operator` that defines the hostname as `talos-default-master-1` (DHCP). - -Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. -Here is the order of precedence from low to high: - -* `default` (defaults provided by Talos); -* `cmdline` (from the kernel command line); -* `platform` (driven by the cloud provider); -* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); -* `configuration` (derived from the machine configuration). - -So in our example the `operator` layer `HostnameSpec` overwrites the `default` layer producing the final hostname `talos-default-master-1`. - -The merge process applies to all six core networking specs. -For each spec, the `layer` controls the merge behavior -If multiple configuration specs -appear at the same layer, they can be merged together if possible, otherwise merge result -is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). - -`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. - -## Network Operators - -Network operators provide dynamic network configuration which can change over time as the node is running: - -* DHCPv4 -* DHCPv6 -* Virtual IP - -Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. - -Operators are configured with `OperatorSpec` resources which describe when operators -should run and additional configuration for the operator: - -```sh -$ talosctl get operatorspecs -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: OperatorSpecs.net.talos.dev - id: dhcp4/eth0 - version: 1 - owner: network.OperatorConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - operator: dhcp4 - linkName: eth0 - requireUp: true - dhcp4: - routeMetric: 1024 -``` - -`OperatorSpec` resources are generated by Talos based on machine configuration mostly. -DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. -This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. - -Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: - -```sh -$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 -``` - -## Other Network Resources - -There are some additional resources describing the network subsystem state. - -The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: - -```sh -$ talosctl get nodeaddresses -NODE NAMESPACE TYPE ID VERSION ADDRESSES -10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] -``` - -* `default` is the node default address; -* `current` is the set of addresses a node currently has; -* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). - -`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. - -Another important resource is `Nodename` which provides `Node` name in Kubernetes: - -```sh -$ talosctl get nodename -NODE NAMESPACE TYPE ID VERSION NODENAME -10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v -``` - -Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. - -`NetworkStatus` aggregates the current state of the network configuration: - -```sh -$ talosctl get networkstatus -o yaml -node: 10.100.2.23 -metadata: - namespace: network - type: NetworkStatuses.net.talos.dev - id: status - version: 5 - owner: network.StatusController - phase: running - created: 2021-06-24T18:56:00Z - updated: 2021-06-24T18:56:02Z -spec: - addressReady: true - connectivityReady: true - hostnameReady: true - etcFilesReady: true -``` - -## Network Controllers - -For each of the six basic resource types, there are several controllers: - -* `*StatusController` populates `*Status` resources observing the Linux kernel state. -* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. -* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. -* `*SpecController` applies merged `*Spec` resources to the kernel state. - -For the network operators: - -* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. -* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. - -## Configuration Sources - -There are several configuration sources for the network configuration, which are described in this section. - -### Defaults - -* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; -* hostname is set to the `talos-` where `IP` is the default node address; -* resolvers are set to `8.8.8.8`, `1.1.1.1`; -* time servers are set to `pool.ntp.org`; -* DHCP4 operator is run on any physical interface which is not configured explicitly. - -### Cmdline - -The kernel command line is parsed for the following options: - -* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; -* `talos.hostname=` option is used to set node hostname; -* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. - -### Platform - -Platform configuration delivers cloud environment-specific options (e.g. the hostname). - -### Operator - -Network operators provide configuration for all basic resource types. - -### Machine Configuration - -The machine configuration is parsed for link configuration, addresses, routes, hostname, -resolvers and time servers. -Any changes to `.machine.network` configuration can be applied in immediate mode. - -## Network Configuration Debugging - -Most of the network controller operations and failures are logged to the kernel console, -additional logs with `debug` level are available with `talosctl logs controller-runtime` command. -If the network configuration can't be established and the API is not available, `debug` level -logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v0.12/learn-more/philosophy.md b/website/content/v0.12/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.12/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.12/learn-more/talosctl.md b/website/content/v0.12/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.12/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.12/learn-more/upgrades.md b/website/content/v0.12/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.12/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.12/local-platforms/_index.md b/website/content/v0.12/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.12/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.12/local-platforms/docker.md b/website/content/v0.12/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.12/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.12/local-platforms/firecracker.md b/website/content/v0.12/local-platforms/firecracker.md deleted file mode 100644 index 9b23529f5..000000000 --- a/website/content/v0.12/local-platforms/firecracker.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Firecracker -description: "Creating Talos Kubernetes cluster using Firecracker VMs." ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.9.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.9.5/cni-plugins-linux-amd64-v0.9.5.tgz -L -o cni-plugins-linux-amd64-v0.9.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.9.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.12.0`: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/vmlinuz -L -o _out/vmlinuz -curl https://github.com/talos-systems/talos/releases/latest/download/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Worker 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.12/local-platforms/qemu.md b/website/content/v0.12/local-platforms/qemu.md deleted file mode 100644 index 8e7ecc32b..000000000 --- a/website/content/v0.12/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.12.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.12.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.12.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Worker 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.12/local-platforms/virtualbox.md b/website/content/v0.12/local-platforms/virtualbox.md deleted file mode 100644 index 0dc6715ab..000000000 --- a/website/content/v0.12/local-platforms/virtualbox.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.12/reference/_index.md b/website/content/v0.12/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.12/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.12/reference/api.md b/website/content/v0.12/reference/api.md deleted file mode 100644 index 1e7878d27..000000000 --- a/website/content/v0.12/reference/api.md +++ /dev/null @@ -1,3446 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FeaturesInfo](#machine.FeaturesInfo) - - [FileInfo](#machine.FileInfo) - - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) - - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) - - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | -| INPUT_DESTROY_READY | 4 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | -| is_learner | [bool](#bool) | | learner flag | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FeaturesInfo -FeaturesInfo describes individual Talos features that can be switched on or off. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | -| uid | [uint32](#uint32) | | Owner uid | -| gid | [uint32](#uint32) | | Owner gid | - - - - - - - - -### GenerateClientConfiguration - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | -| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | -| key | [bytes](#bytes) | | PEM-encoded generated client key. | -| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | - - - - - - - - -### GenerateClientConfigurationRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| roles | [string](#string) | repeated | Roles in the generated client certificate. | -| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | - - - - - - - - -### GenerateClientConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesResponse -rpc processes - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | -| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_WORKER | 3 | | -| TYPE_JOIN | 3 | Alias for TYPE_WORKER. | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | -| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| created | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| updated | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| tail_events | [uint32](#uint32) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.12/reference/cli.md b/website/content/v0.12/reference/cli.md deleted file mode 100644 index b696c7bff..000000000 --- a/website/content/v0.12/reference/cli.md +++ /dev/null @@ -1,2180 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --bad-rtc launch VM with bad RTC state (QEMU only) - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.12.0-alpha.1/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.22.1") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config contexts - -List defined contexts - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config info - -Show information about the current context - -``` -talosctl config info [flags] -``` - -### Options - -``` - -h, --help help for info -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config merge - -Merge additional contexts from another client configuration file - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config new - -Generate a new client configuration file - -``` -talosctl config new [] [flags] -``` - -### Options - -``` - --crt-ttl duration certificate TTL (default 87600h0m0s) - -h, --help help for new - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config - -Manage the client configuration file (talosconfig) - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config info](#talosctl-config-info) - Show information about the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file -* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use -a control plane node, common in a single node control plane setup, use port 6443 as -this is the port that the API server binds to on every control plane node. For an HA -setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --dry-run skip the actual upgrade and show the upgrade plan instead - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.22.1") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.12/reference/configuration.md b/website/content/v0.12/reference/configuration.md deleted file mode 100644 index 62adea89b..000000000 --- a/website/content/v0.12/reference/configuration.md +++ /dev/null @@ -1,5091 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: - - talosctl gen config --version v1alpha1 - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
-
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
-
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - -This node type was previously known as "join"; that value is still supported but deprecated. - - -Valid values: - - - - init - - - controlplane - - - worker -
- -
-
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
-
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.22.1 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
-
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
-
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
-
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
-
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
-
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
-
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
-
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
-
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - - -
- -
-
- -features FeaturesConfig - -
-
- -Features describe individual Talos features that can be switched on or off. - - - -Examples: - - -``` yaml -features: - rbac: true # Enable role-based access control (RBAC). -``` - - -
- -
- - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -id string - -
-
- -Globally unique identifier for this cluster. - -
- -
-
- -secret string - -
-
- -Shared secret of cluster. -This secret is shared among cluster members but should never be sent over the network. - -
- -
-
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
-
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
-
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
-
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
-
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.22.1 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
-
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.22.1 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
-
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.22.1 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
-
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.22.1 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
-
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" -``` - - -
- -
-
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - - -
- -
-
- -externalCloudProvider ExternalCloudProviderConfig - -
-
- -External cloud provider configuration. - - - -Examples: - - -``` yaml -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
-
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
-
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the extraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
-
- -inlineManifests ClusterInlineManifests - -
-
- -A list of inline Kubernetes manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -``` - - -
- -
-
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
-
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - -## ExtraMount -ExtraMount wraps OCI Mount specification. - -Appears in: - -- KubeletConfig.extraMounts - - -``` yaml -- destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.22.1 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. -# clusterDNS: -# - 10.96.0.10 -# - 169.254.2.53 - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.22.1 -``` - - -
- -
-
- -clusterDNS []string - -
-
- -The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - - - -Examples: - - -``` yaml -clusterDNS: - - 10.96.0.10 - - 169.254.2.53 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
-
- -extraMounts []ExtraMount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
-
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
-
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
-
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
-
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk attributes like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
-
- -diskSelector InstallDiskSelector - -
-
- -Look up disk using disk attributes like model, size, serial and others. -Always has priority over `disk`. - - - -Examples: - - -``` yaml -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
-
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
-
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -legacyBIOSSupport bool - -
-
- -Indicates if MBR partition should be marked as bootable (active). -Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. - -
- -
- - - -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - -- InstallConfig.diskSelector - - -``` yaml -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -size InstallDiskSizeMatcher - -
-
- -Disk size. - - - -Examples: - - -``` yaml -size: 4GB -``` - -``` yaml -size: '> 1TB' -``` - -``` yaml -size: <= 2TB -``` - - -
- -
-
- -name string - -
-
- -Disk name `/sys/block//device/name`. - -
- -
-
- -model string - -
-
- -Disk model `/sys/block//device/model`. - -
- -
-
- -serial string - -
-
- -Disk serial number `/sys/block//serial`. - -
- -
-
- -modalias string - -
-
- -Disk modalias `/sys/block//device/modalias`. - -
- -
-
- -uuid string - -
-
- -Disk UUID `/sys/block//uuid`. - -
- -
-
- -wwid string - -
-
- -Disk WWID `/sys/block//wwid`. - -
- -
-
- -type InstallDiskType - -
-
- -Disk Type. - - -Valid values: - - - - ssd - - - hdd - - - nvme - - - sd -
- -
- - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
-
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
-
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - -
- -
- -disabled bool - -
-
- -Disable coredns deployment on cluster bootstrap. - -
- -
-
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
-
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.22.1 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.22.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
-
- -disablePodSecurityPolicy bool - -
-
- -Disable PodSecurityPolicy in the API server and default manifests. - -
- -
- - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.22.1 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.22.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.22.1 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
-
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.22.1 -``` - - -
- -
-
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.22.1 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.22.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "urls". -The "name" key supports the following options: "flannel", "custom", and "none". -"flannel" uses Talos-managed Flannel CNI, and that's the default option. -"custom" uses custom manifests that should be provided in "urls". -"none" indicates that Talos will not manage any CNI installation. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
-
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
-
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
-
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - - -Valid values: - - - - flannel - - - custom - - - none -
- -
-
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. -Should be present for "custom", must be empty for "flannel" and "none". - -
- -
- - - -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - -- ClusterConfig.externalCloudProvider - - -``` yaml -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - -
- -
- -enabled bool - -
-
- -Enable external cloud provider. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -manifests []string - -
-
- -A list of urls that point to additional manifests for an external cloud provider. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
-
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
-
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - -- SystemDiskEncryptionConfig.state -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
-
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
-
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - - -Valid values: - - - - aes-xts-plain64 - - - xchacha12,aes-adiantum-plain64 - - - xchacha20,aes-adiantum-plain64 - - -Examples: - - -``` yaml -cipher: aes-xts-plain64 -``` - - -
- -
-
- -keySize uint - -
-
- -Defines the encryption key length. - -
- -
-
- -blockSize uint64 - -
-
- -Defines the encryption sector size. - - - -Examples: - - -``` yaml -blockSize: 4096 -``` - - -
- -
-
- -options []string - -
-
- -Additional --perf parameters for the LUKS2 encryption. - - -Valid values: - - - - no_read_workqueue - - - no_write_workqueue - - - same_cpu_crypt - - -Examples: - - -``` yaml -options: - - no_read_workqueue - - no_write_workqueue -``` - - -
- -
- - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
-
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
-
- -slot int - -
-
- -Key slot number for LUKS2 encryption. - -
- -
- - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - -- EncryptionKey.nodeID - - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
-
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
-
- -path string - -
-
- -The path of the file. - -
- -
-
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
-
- -aliases []string - -
-
- -The host alias. - -
- -
- - - -## Device -Device represents a network interface. - -Appears in: - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
-
- -addresses []string - -
-
- -Assigns static IP addresses to the interface. -An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). - - - -Examples: - - -``` yaml -addresses: - - 10.5.0.0/16 - - 192.168.3.7 -``` - - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
-
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
-
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
-
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
-
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
-
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
-
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
-
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
-
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
-
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
-
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
-
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
-
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
-
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
-
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
-
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
-
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - -- Device.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
-
- -equinixMetal VIPEquinixMetalConfig - -
-
- -Specifies the Equinix Metal API settings to assign VIP to the node. - -
- -
- - - -## VIPEquinixMetalConfig -VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. - -Appears in: - -- DeviceVIPConfig.equinixMetal - - - -
- -
- -apiToken string - -
-
- -Specifies the Equinix Metal API Token. - -
- -
- - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
-
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - -- Device.vlans - - - -
- -
- -addresses []string - -
-
- -The addresses in CIDR notation or as plain IPs to use. - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
-
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - -## Route -Route represents a network route. - -Appears in: - -- Device.routes -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
-
- -gateway string - -
-
- -The route's gateway. - -
- -
-
- -source string - -
-
- -The route's source address (optional). - -
- -
-
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
-
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
-
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - -## FeaturesConfig -FeaturesConfig describe individual Talos features that can be switched on or off. - -Appears in: - -- MachineConfig.features - - -``` yaml -rbac: true # Enable role-based access control (RBAC). -``` - -
- -
- -rbac bool - -
-
- -Enable role-based access control (RBAC). - -
- -
- - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - -- APIServerConfig.extraVolumes -- ControllerManagerConfig.extraVolumes -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
-
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
-
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - -
- -
- -name string - -
-
- -Name of the manifest. -Name should be unique. - - - -Examples: - - -``` yaml -name: csi -``` - - -
- -
-
- -contents string - -
-
- -Manifest contents as a string. - - - -Examples: - - -``` yaml -contents: /etc/kubernetes/auth -``` - - -
- -
- - diff --git a/website/content/v0.12/reference/kernel.md b/website/content/v0.12/reference/kernel.md deleted file mode 100644 index 65192d7a5..000000000 --- a/website/content/v0.12/reference/kernel.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automtic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. diff --git a/website/content/v0.12/reference/platform.md b/website/content/v0.12/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.12/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.12/single-board-computers/_index.md b/website/content/v0.12/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.12/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.12/single-board-computers/bananapi_m64.md b/website/content/v0.12/single-board-computers/bananapi_m64.md deleted file mode 100644 index bc48c4c61..000000000 --- a/website/content/v0.12/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.12/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.12/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index a0b7e8f2a..000000000 --- a/website/content/v0.12/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.12/single-board-computers/pine64.md b/website/content/v0.12/single-board-computers/pine64.md deleted file mode 100644 index bc30430b3..000000000 --- a/website/content/v0.12/single-board-computers/pine64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64" -description: "Installing Talos on a Pine64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-pine64-arm64.img.xz -xz -d metal-pine64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-pine64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.12/single-board-computers/rock64.md b/website/content/v0.12/single-board-computers/rock64.md deleted file mode 100644 index 27827e8ae..000000000 --- a/website/content/v0.12/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.12/single-board-computers/rockpi_4.md b/website/content/v0.12/single-board-computers/rockpi_4.md deleted file mode 100644 index 70888807e..000000000 --- a/website/content/v0.12/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Boot Talos from an SSD Drive - -> Note: this is only tested on Rock PI 4c - -Rock PI 4 has an M2 slot which supports NVMe disks. -It is possible to run Talos without any SD cards right from that SSD disk. - -The pre-installed SPI loader won't be able to chain Talos u-boot on the SSD drive because it's too outdated. -The official docs on booting from the SSD also propose using an outdated SPI to flash u-boot. - -Instead, it is necessary to update u-boot to a more recent version for this process to work. -The Armbian u-boot build for Rock PI 4c has been proved to work: [https://users.armbian.com/piter75/](https://users.armbian.com/piter75/). - -### Steps - -- Flash any OS to the SD card (can be Armbian for example). -- Download Armbian u-boot and update SPI flash: - -```bash -curl -LO https://users.armbian.com/piter75/rkspi_loader-v20.11.2-trunk-v2.img -sudo dd if=rkspi_loader-v20.11.2-trunk-v2.img of=/dev/mtdblock0 bs=4K -``` - -- Optionally, you can also write Talos image to the SSD drive right from your Rock PI board: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -sudo dd if=metal-rockpi_4-arm64.img.xz of=/dev/nvme0n1 -``` - -- remove SD card and reboot. - -After these steps, Talos will boot from the SSD and enter maintenance mode. -The rest of the flow is the same as running Talos from the SD card. diff --git a/website/content/v0.12/single-board-computers/rpi_4.md b/website/content/v0.12/single-board-computers/rpi_4.md deleted file mode 100644 index c2bff5617..000000000 --- a/website/content/v0.12/single-board-computers/rpi_4.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and use [Raspberry Pi Imager](https://www.raspberrypi.org/software/) -to install the bootloader on it (select Operating System > Misc utility images > Bootloader > SD Card Boot). -Alternatively, you can use the console on Linux or macOS. -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -```bash -curl -Lo rpi-boot-eeprom-recovery.zip https://github.com/raspberrypi/rpi-eeprom/releases/download/v2021.04.29-138a1/rpi-boot-eeprom-recovery-2021-04-29-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0p1 /mnt -sudo bsdtar rpi-boot-eeprom-recovery.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached to the port closest to the power/USB-C port, -the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -> Note: if you have an HDMI display attached and it shows only a rainbow splash, -> please use the other HDMI port, the one closest to the power/USB-C port. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.12/virtualized-platforms/_index.md b/website/content/v0.12/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.12/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.12/virtualized-platforms/hyper-v.md b/website/content/v0.12/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.12/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.12/virtualized-platforms/kvm.md b/website/content/v0.12/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.12/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.12/virtualized-platforms/proxmox.md b/website/content/v0.12/virtualized-platforms/proxmox.md deleted file mode 100644 index df61f34b2..000000000 --- a/website/content/v0.12/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.12.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". - -### With DHCP server - -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -### Without DHCP server - -To apply the machine configurations in maintenance mode, VM has to have IP on the network. -So you can set it on boot time manualy. - - - -Press `e` on the boot time. -And set the IP parameters for the VM. -[Format is](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt): - -```bash -ip=:::::: -``` - -For example $CONTROL_PLANE_IP will be 192.168.0.100 and gateway 192.168.0.1 - -```bash -linux /boot/vmlinuz init_on_alloc=1 slab_nomerge pti=on panic=0 consoleblank=0 printk.devkmsg=on earlyprintk=ttyS0 console=tty0 console=ttyS0 talos.platform=metal ip=192.168.0.100::192.168.0.1:255.255.255.0::eth0:off -``` - - - -Then press Ctrl-x or F10 - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplan.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.12/virtualized-platforms/vmware.md b/website/content/v0.12/virtualized-platforms/vmware.md deleted file mode 100644 index 350f7ad96..000000000 --- a/website/content/v0.12/virtualized-platforms/vmware.md +++ /dev/null @@ -1,203 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Control Plane Nodes - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint ,, -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.12/virtualized-platforms/xen.md b/website/content/v0.12/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.12/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.13/_index.md b/website/content/v0.13/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.13/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.13/bare-metal-platforms/_index.md b/website/content/v0.13/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.13/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.13/bare-metal-platforms/digital-rebar.md b/website/content/v0.13/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 7c85d83b7..000000000 --- a/website/content/v0.13/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview](../overview). - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/bare-metal-platforms/equinix-metal.md b/website/content/v0.13/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index dec278033..000000000 --- a/website/content/v0.13/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the Equinix Metal CLI installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `controlplane.yaml`, and `worker.yaml` -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config worker.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file worker.yaml -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/bare-metal-platforms/matchbox.md b/website/content/v0.13/bare-metal-platforms/matchbox.md deleted file mode 100644 index 89bc4e627..000000000 --- a/website/content/v0.13/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `controlplane.yaml`, and `worker.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/worker.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/bare-metal-platforms/sidero.md b/website/content/v0.13/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.13/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.13/cloud-platforms/_index.md b/website/content/v0.13/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.13/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.13/cloud-platforms/aws.md b/website/content/v0.13/cloud-platforms/aws.md deleted file mode 100644 index 728e473dd..000000000 --- a/website/content/v0.13/cloud-platforms/aws.md +++ /dev/null @@ -1,267 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Official AMI Images - -Official AMI image ID can be found in the `cloud-images.json` file attached to the Talos release: - -```bash -curl -sL https://github.com/siderolabs/talos/releases/download/v0.13.0/cloud-images.json | \ - jq -r '.[] | select(.region == "us-east-1") | select (.arch == "amd64") | .id' -``` - -Replace `us-east-1` and `amd64` in the line above with the desired region and architecture. - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: --with-examples=false --with-docs=false -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Take note that the generated configs are too long for AWS userdata field if the `--with-examples` and `--with-docs` flags are not passed. - -At this point, you can modify the generated configs to your liking. - -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 4 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://worker.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/azure.md b/website/content/v0.13/cloud-platforms/azure.md deleted file mode 100644 index bfdf828f0..000000000 --- a/website/content/v0.13/cloud-platforms/azure.md +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create the controlplane nodes -for i in $( seq 0 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./worker.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/digitalocean.md b/website/content/v0.13/cloud-platforms/digitalocean.md deleted file mode 100644 index 832178e3f..000000000 --- a/website/content/v0.13/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-1 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file worker.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/gcp.md b/website/content/v0.13/cloud-platforms/gcp.md deleted file mode 100644 index b027ba56f..000000000 --- a/website/content/v0.13/cloud-platforms/gcp.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create the control plane nodes. -for i in $( seq 1 3 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 3 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./worker.yaml -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/hetzner.md b/website/content/v0.13/cloud-platforms/hetzner.md deleted file mode 100644 index 782376633..000000000 --- a/website/content/v0.13/cloud-platforms/hetzner.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: "Hetzner" -description: "Creating a cluster via the CLI (hcloud) on Hetzner." ---- - -## Upload image - -Hetzner Cloud does not support uploading custom images. -You can email their support to get a Talos ISO uploaded by following [issues:3599](https://github.com/talos-systems/talos/issues/3599#issuecomment-841172018) or you can prepare image snapshot by yourself. - -There are two options to upload your own. - -1. Run an instance in rescue mode and replase the system OS with the Talos image -2. Use [Hashicorp packer](https://www.packer.io/docs/builders/hetzner-cloud) to prepare an image - -### Rescue mode - -Create a new Server in the Hetzner console. -Enable the Hetzner Rescue System for this server and reboot. -Upon a reboot, the server will boot a special minimal Linux distribution designed for repair and reinstall. -Once running, login to the server using ```ssh``` to prepare the system disk by doing the following: - -```bash -# Check that you in Rescue mode -df - -### Result is like: -# udev 987432 0 987432 0% /dev -# 213.133.99.101:/nfs 308577696 247015616 45817536 85% /root/.oldroot/nfs -# overlay 995672 8340 987332 1% / -# tmpfs 995672 0 995672 0% /dev/shm -# tmpfs 398272 572 397700 1% /run -# tmpfs 5120 0 5120 0% /run/lock -# tmpfs 199132 0 199132 0% /run/user/0 - -# Download the Talos image -cd /tmp -wget -O /tmp/talos.raw.xz https://github.com/siderolabs/talos/releases/download/v0.13.0/hcloud-amd64.raw.xz -# Replace system -xz -d -c /tmp/talos.raw.xz | dd of=/dev/sda && sync -# shutdown the instance -shutdown -h now -``` - -To make sure disk content is consistent, it is recommended to shut the server down before taking an image (snapshot). -Once shutdown, simply create an image (snapshot) from the console. -You can now use this snapshot to run Talos on the cloud. - -### Packer - -Install [packer](https://learn.hashicorp.com/tutorials/packer/get-started-install-cli) to the local machine. - -Create a config file for packer to use: - -```hcl -# hcloud.pkr.hcl - -packer { - required_plugins { - hcloud = { - version = ">= 1.0.0" - source = "github.com/hashicorp/hcloud" - } - } -} - -variable "talos_version" { - type = string - default = "v0.13.0" -} - -locals { - image = "https://github.com/siderolabs/talos/releases/download/${var.talos_version}/hcloud-amd64.raw.xz" -} - -source "hcloud" "talos" { - rescue = "linux64" - image = "debian-11" - location = "hel1" - server_type = "cx11" - ssh_username = "root" - - snapshot_name = "talos system disk" - snapshot_labels = { - type = "infra", - os = "talos", - version = "${var.talos_version}", - } -} - -build { - sources = ["source.hcloud.talos"] - - provisioner "shell" { - inline = [ - "apt-get install -y wget", - "wget -O /tmp/talos.raw.xz ${local.image}", - "xz -d -c /tmp/talos.raw.xz | dd of=/dev/sda && sync", - ] - } -} -``` - -Create a new image by issuing the commands shown below. -Note that to create a new API token for your Project, switch into the Hetzner Cloud Console choose a Project, go to Access → Security, and create a new token. - -```bash -# First you need set API Token -export HCLOUD_TOKEN=${TOKEN} - -# Upload image -packer init . -packer build . -# Save the image ID -export IMAGE_ID= -``` - -After doing this, you can find the snapshot in the console interface. - -## Creating a Cluster via the CLI - -This section assumes you have the [hcloud console utility](https://community.hetzner.com/tutorials/howto-hcloud-cli) on your local machine. - -```bash -# Set hcloud context and api key -hcloud context create talos-tutorial -``` - -### Create a Load Balancer - -Create a load balancer by issuing the commands shown below. -Save the IP/DNS name, as this info will be used in the next step. - -```bash -hcloud load-balancer create --name controlplane --network-zone eu-central --type lb11 --label 'type=controlplane' - -### Result is like: -# LoadBalancer 484487 created -# IPv4: 49.12.X.X -# IPv6: 2a01:4f8:X:X::1 - -hcloud load-balancer add-service controlplane \ - --listen-port 6443 --destination-port 6443 --protocol tcp -hcloud load-balancer add-target controlplane \ - --label-selector 'type=controlplane' -``` - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the IP/DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines by issuing: - -```bash -$ talosctl gen config talos-k8s-hcloud-tutorial https://:6443 -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatches which will be applied during the config generation. - -#### Validate the Configuration Files - -Validate any edited machine configs with: - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the Servers - -We can now create our servers. -Note that you can find ```IMAGE_ID``` in the snapshot section of the console: ```https://console.hetzner.cloud/projects/$PROJECT_ID/servers/snapshots```. - -#### Create the Control Plane Nodes - -Create the control plane nodes with: - -```bash -export IMAGE_ID= - -hcloud server create --name talos-control-plane-1 \ - --image ${IMAGE_ID} \ - --type cx21 --location hel1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml - -hcloud server create --name talos-control-plane-2 \ - --image ${IMAGE_ID} \ - --type cx21 --location fsn1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml - -hcloud server create --name talos-control-plane-3 \ - --image ${IMAGE_ID} \ - --type cx21 --location nbg1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml -``` - -#### Create the Worker Nodes - -Create the worker nodes with the following command, repeating (and incrementing the name counter) as many times as desired. - -```bash -hcloud server create --name talos-worker-1 \ - --image ${IMAGE_ID} \ - --type cx21 --location hel1 \ - --label 'type=worker' \ - --user-data-from-file worker.yaml -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP. -This can be found by issuing: - -```bash -hcloud server list | grep talos-control-plane -``` - -Set the `endpoints` and `nodes` for your talosconfig with: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd` on the first control plane node with: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/nocloud.md b/website/content/v0.13/cloud-platforms/nocloud.md deleted file mode 100644 index 3d0fa0788..000000000 --- a/website/content/v0.13/cloud-platforms/nocloud.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Nocloud" -description: "Creating a cluster via the CLI using qemu." ---- - -Talos supports [nocloud](https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html) data source implementation. - -There are two ways to configure Talos server with `nocloud` platform: - -* via SMBIOS "serial number" option -* using CDROM or USB-flash filesystem - -### SMBIOS Serial Number - -This method requires the network connection to be up (e.g. via DHCP). -Configuration is delivered from the HTTP server. - -```text -ds=nocloud-net;s=http://10.10.0.1/configs/;h=HOSTNAME -``` - -After the network initialization is complete, Talos fetches: - -* the machine config from `http://10.10.0.1/configs/user-data` -* the network config (if available) from `http://10.10.0.1/configs/network-config` - -#### SMBIOS: QEMU - -Add the following flag to `qemu` command line when starting a VM: - -```bash -qemu-system-x86_64 \ - ...\ - -smbios type=1,serial=ds=nocloud-net;s=http://10.10.0.1/configs/ -``` - -#### SMBIOS: Proxmox - -Set the source machine config through the serial number on Proxmox GUI. - - - -The Proxmox stores the VM config at `/etc/pve/qemu-server/$ID.conf` (```$ID``` - VM ID number of virtual machine), you will see something like: - -```conf -... -smbios1: uuid=ceae4d10,serial=ZHM9bm9jbG91ZC1uZXQ7cz1odHRwOi8vMTAuMTAuMC4xL2NvbmZpZ3Mv,base64=1 -... -``` - -Where serial holds the base64-encoded string version of `ds=nocloud-net;s=http://10.10.0.1/configs/`. - -### CDROM/USB - -Talos can also get machine config from local attached storage without any prior network connection being established. - -You can provide configs to the server via files on a VFAT or ISO9660 filesystem. -The filesystem volume label must be ```cidata``` or ```CIDATA```. - -#### Example: QEMU - -Create and prepare Talos machine config: - -```bash -export CONTROL_PLANE_IP=192.168.1.10 - -talosctl gen config talos-nocloud https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -Prepare cloud-init configs: - -```bash -mkdir -p iso -mv _out/controlplane.yaml iso/user-data -echo "local-hostname: controlplane-1" > iso/meta-data -cat > iso/network-config << EOF -version: 1 -config: - - type: physical - name: eth0 - mac_address: "52:54:00:12:34:00" - subnets: - - type: static - address: 192.168.1.10 - netmask: 255.255.255.0 - gateway: 192.168.1.254 -EOF -``` - -Create cloud-init iso image - -```bash -cd iso && genisoimage -output cidata.iso -V cidata -r -J user-data meta-data network-config -``` - -Start the VM - -```bash -qemu-system-x86_64 \ - ... - -cdrom iso/cidata.iso \ - ... -``` - -#### Example: Proxmox - -Proxmox can create cloud-init disk [for you](https://pve.proxmox.com/wiki/Cloud-Init_Support). -Edit the cloud-init config information in Proxmox as follows, substitute your own information as necessary: - - - -and then update ```cicustom``` param at `/etc/pve/qemu-server/$ID.conf`. - -```config -cicustom: user=local:snippets/master-1.yml -ipconfig0: ip=192.168.1.10/24,gw=192.168.10.254 -nameserver: 1.1.1.1 -searchdomain: local -``` - -> Note: `snippets/master-1.yml` is Talos machine config. -It is usually located at `/var/lib/vz/snippets/master-1.yml`. -This file must be placed to this path manually, as Proxmox does not support snippet uploading via API/GUI. - -Click on `Regenerate Image` button after the above changes are made. diff --git a/website/content/v0.13/cloud-platforms/openstack.md b/website/content/v0.13/cloud-platforms/openstack.md deleted file mode 100644 index b60f66b6d..000000000 --- a/website/content/v0.13/cloud-platforms/openstack.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 1 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/worker.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/cloud-platforms/scaleway.md b/website/content/v0.13/cloud-platforms/scaleway.md deleted file mode 100644 index c80795482..000000000 --- a/website/content/v0.13/cloud-platforms/scaleway.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Scaleway" -description: "Creating a cluster via the CLI (scw) on scaleway.com." ---- - -Talos is known to work on scaleway.com; however, it is currently undocumented. diff --git a/website/content/v0.13/cloud-platforms/upcloud.md b/website/content/v0.13/cloud-platforms/upcloud.md deleted file mode 100644 index 588e8c72d..000000000 --- a/website/content/v0.13/cloud-platforms/upcloud.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "UpCloud" -description: "Creating a cluster via the CLI (upctl) on UpCloud.com." ---- - -Talos is known to work on UpCloud.com; however, it is currently undocumented. diff --git a/website/content/v0.13/cloud-platforms/vultr.md b/website/content/v0.13/cloud-platforms/vultr.md deleted file mode 100644 index 51352d934..000000000 --- a/website/content/v0.13/cloud-platforms/vultr.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Vultr" -description: "Creating a cluster via the CLI (vultr-cli) on Vultr.com." ---- - -Talos is known to work on Vultr.com; however, it is currently undocumented. diff --git a/website/content/v0.13/guides/_index.md b/website/content/v0.13/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.13/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.13/guides/advanced-networking.md b/website/content/v0.13/guides/advanced-networking.md deleted file mode 100644 index 8361db677..000000000 --- a/website/content/v0.13/guides/advanced-networking.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - addresses: - - 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo - addresses: - - 192.168.0.21/24 - - 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - addresses: - - "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.13/guides/air-gapped.md b/website/content/v0.13/guides/air-gapped.md deleted file mode 100644 index e92cc7c83..000000000 --- a/website/content/v0.13/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.13.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.13/guides/configuring-certificate-authorities.md b/website/content/v0.13/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.13/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.13/guides/configuring-containerd.md b/website/content/v0.13/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.13/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.13/guides/configuring-corporate-proxies.md b/website/content/v0.13/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.13/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.13/guides/configuring-network-connectivity.md b/website/content/v0.13/guides/configuring-network-connectivity.md deleted file mode 100644 index 94ea517bf..000000000 --- a/website/content/v0.13/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.13/guides/configuring-pull-through-cache.md b/website/content/v0.13/guides/configuring-pull-through-cache.md deleted file mode 100644 index 3b2e05fbc..000000000 --- a/website/content/v0.13/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `quay.io`, `gcr.io`, and `ghcr.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.13/guides/configuring-the-cluster-endpoint.md b/website/content/v0.13/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index d3d0bfd3b..000000000 --- a/website/content/v0.13/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. controlplane.yaml and worker.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.13/guides/configuring-wireguard-network.md b/website/content/v0.13/guides/configuring-wireguard-network.md deleted file mode 100644 index 6102d3966..000000000 --- a/website/content/v0.13/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > worker.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - addresses: - - 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.13/guides/customizing-the-kernel.md b/website/content/v0.13/guides/customizing-the-kernel.md deleted file mode 100644 index 22b76a959..000000000 --- a/website/content/v0.13/guides/customizing-the-kernel.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -Build and push your own kernel: - - ```sh - git clone https://github.com/talos-systems/pkgs.git - cd pkgs - make kernel-menuconfig USERNAME=_your_github_user_name_ - - docker login ghcr.io --username _your_github_user_name_ - make kernel USERNAME=_your_github_user_name_ PUSH=true - ``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM ghcr.io/talos-systems/installer:latest -COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -To build the image, run: - -```bash -DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . -``` - -> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.13/guides/customizing-the-root-filesystem.md b/website/content/v0.13/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.13/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.13/guides/deploy-metrics-server.md b/website/content/v0.13/guides/deploy-metrics-server.md deleted file mode 100644 index 0471cdbfc..000000000 --- a/website/content/v0.13/guides/deploy-metrics-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v0.13/guides/disaster-recovery.md b/website/content/v0.13/guides/disaster-recovery.md deleted file mode 100644 index 286b70080..000000000 --- a/website/content/v0.13/guides/disaster-recovery.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --on-reboot` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's `EPHEMERAL` partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v0.13/guides/discovery.md b/website/content/v0.13/guides/discovery.md deleted file mode 100644 index d65b79abf..000000000 --- a/website/content/v0.13/guides/discovery.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: "Discovery" ---- - -## Video Walkthrough - -To see a live demo of Cluster Discovery, see the video below: - - - -## Registries - -Peers are aggregated from a number of optional registries. -By default, Talos will use the `kubernetes` and `service` registries. -Either one can be disabled. -To disable a registry, set `disabled` to `true` (this option is the same for all registries): -For example, to disable the `service` registry: - -```yaml -cluster: - discovery: - enabled: true - registries: - service: - disabled: true -``` - -Disabling all registries effectively disables member discovery altogether. - -> As of v0.13, Talos supports the `kubernetes` and `service` registries. - -`Kubernetes` registry uses Kubernetes `Node` resource data and additional Talos annotations: - -```sh -$ kubectl describe node -Annotations: cluster.talos.dev/node-id: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd - networking.talos.dev/assigned-prefixes: 10.244.0.0/32,10.244.0.1/24 - networking.talos.dev/self-ips: 172.20.0.2,fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94 -... -``` - -`Service` registry uses external [Discovery Service](../../learn-more/discovery/) to exchange encrypted information about cluster members. - -## Resource Definitions - -Talos v0.13 introduces seven new resources that can be used to introspect the new discovery and KubeSpan features. - -### Discovery - -#### Identities - -The node's unique identity (base62 encoded random 32 bytes) can be obtained with: - -> Note: Using base62 allows the ID to be URL encoded without having to use the ambiguous URL-encoding version of base64. - -```sh -$ talosctl get identities -o yaml -... -spec: - nodeId: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd -``` - -Node identity is used as the unique `Affiliate` identifier. - -Node identity resource is preserved in the `STATE` partition in `node-identity.yaml` file. -Node identity is preserved across reboots and upgrades, but it is regenerated if the node is reset (wiped). - -#### Affiliates - -An affiliate is a proposed member attributed to the fact that the node has the same cluster ID and secret. - -```sh -$ talosctl get affiliates -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 2 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd 4 talos-default-master-1 controlplane ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 2 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -One of the `Affiliates` with the `ID` matching node identity is populated from the node data, other `Affiliates` are pulled from the registries. -Enabled discovery registries run in parallel and discovered data is merged to build the list presented above. - -Details about data coming from each registry can be queried from the `cluster-raw` namespace: - -```sh -$ talosctl get affiliates --namespace=cluster-raw -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -k8s/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 3 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -k8s/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -k8s/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -k8s/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 3 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -service/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 23 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -service/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 26 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -service/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 20 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -service/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 14 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -Each `Affiliate` ID is prefixed with `k8s/` for data coming from the Kubernetes registry and with `service/` for data coming from the discovery service. - -#### Members - -A member is an affiliate that has been approved to join the cluster. -The members of the cluster can be obtained with: - -```sh -$ talosctl get members -ID VERSION HOSTNAME MACHINE TYPE OS ADDRESSES -talos-default-master-1 2 talos-default-master-1 controlplane Talos (v0.13.0) ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -talos-default-master-2 1 talos-default-master-2 controlplane Talos (v0.13.0) ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -talos-default-master-3 1 talos-default-master-3 controlplane Talos (v0.13.0) ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -talos-default-worker-1 1 talos-default-worker-1 worker Talos (v0.13.0) ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -talos-default-worker-2 1 talos-default-worker-2 worker Talos (v0.13.0) ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -``` diff --git a/website/content/v0.13/guides/disk-encryption.md b/website/content/v0.13/guides/disk-encryption.md deleted file mode 100644 index 04b3fbfd8..000000000 --- a/website/content/v0.13/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.13/guides/editing-machine-configuration.md b/website/content/v0.13/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.13/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.13/guides/kubespan.md b/website/content/v0.13/guides/kubespan.md deleted file mode 100644 index 739f989ad..000000000 --- a/website/content/v0.13/guides/kubespan.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: "KubeSpan" ---- - -KubeSpan is a feature of Talos that automates the setup and maintenance of a full mesh [WireGuard](https://www.wireguard.com) network for your cluster, giving you the ablility to operate hybrid Kubernetes clusters that can span the edge, datacenter, and cloud. -Management of keys and discovery of peers can be completely automated for a zero-touch experience that makes it simple and easy to create hybrid clusters. - -## Video Walkthrough - -To learn more about KubeSpan, see the video below: - - - -To see a live demo of KubeSpan, see one the videos below: - - - - - -## Enabling - -### Creating a New Cluster - -To generate configuration files for a new cluster, we can use the `--with-kubespan` flag in `talosctl gen config`. -This will enable peer discovery and KubeSpan. - -```yaml -... - # Provides machine specific network configuration options. - network: - # Configures KubeSpan feature. - kubespan: - enabled: true # Enable the KubeSpan feature. -... - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: {} -... -# Provides cluster specific configuration options. -cluster: - id: yui150Ogam0pdQoNZS2lZR-ihi8EWxNM17bZPktJKKE= # Globally unique identifier for this cluster. - secret: dAmFcyNmDXusqnTSkPJrsgLJ38W8oEEXGZKM0x6Orpc= # Shared secret of cluster. -``` - -> The default discovery service is an external service hosted for free by Sidero Labs. -> The default value is `https://discovery.talos.dev/`. -> Contact Sidero Labs if you need to run this service privately. - -### Upgrading an Existing Cluster - -In order to enable KubeSpan for an existing cluster, upgrade to the latest v0.13. -Once your cluster is upgraded, the configuration of each node must contain the globally unique identifier, the shared secret for the cluster, and have KubeSpan and discovery enabled. - -> Note: Discovery can be used without KubeSpan, but KubeSpan requires at least one discovery registry. - -#### Talos v0.11 or Less - -If you are migrating from Talos v0.11 or less, we need to generate a cluster ID and secret. - -To generate an `id`: - -```sh -$ openssl rand -base64 32 -EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= -``` - -To generate a `secret`: - -```sh -$ openssl rand -base64 32 -AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -Now, update the configuration of each node with the cluster with the generated `id` and `secret`. -You should end up with the addition of something like this (your `id` and `secret` should be different): - -```yaml -cluster: - id: EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= - secret: AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -> Note: This can be applied in immediate mode (no reboot required) by passing `--immediate` to either the `edit machineconfig` or `apply-config` subcommands. - -#### Talos v0.12 - -Enable `kubespan` and `discovery`. - -```yaml -machine: - network: - kubespan: - enabled: true -cluster: - discovery: - enabled: true -``` - -## Resource Definitions - -### KubeSpanIdentities - -A node's WireGuard identities can be obtained with: - -```sh -$ talosctl get kubespanidentities -o yaml -... -spec: - address: fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94/128 - subnet: fd83:b1f7:fcb5:2802::/64 - privateKey: gNoasoKOJzl+/B+uXhvsBVxv81OcVLrlcmQ5jQwZO08= - publicKey: NzW8oeIH5rJyY5lefD9WRoHWWRr/Q6DwsDjMX+xKjT4= -``` - -Talos automatically configures unique IPv6 address for each node in the cluster-specific IPv6 ULA prefix. - -Wireguard private key is generated for the node, private key never leaves the node while public key is published through the cluster discovery. - -`KubeSpanIdentity` is persisted across reboots and upgrades in `STATE` partition in the file `kubespan-identity.yaml`. - -### KubeSpanPeerSpecs - -A node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerspecs -ID VERSION LABEL ENDPOINTS -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 2 talos-default-master-2 ["172.20.0.3:51820"] -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 2 talos-default-master-3 ["172.20.0.4:51820"] -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 2 talos-default-worker-2 ["172.20.0.6:51820"] -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 2 talos-default-worker-1 ["172.20.0.5:51820"] -``` - -The peer ID is the Wireguard public key. -`KubeSpanPeerSpecs` are built from the cluster discovery data. - -### KubeSpanPeerStatuses - -The status of a node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerstatuses -ID VERSION LABEL ENDPOINT STATE RX TX -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 63 talos-default-master-2 172.20.0.3:51820 up 15043220 17869488 -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 62 talos-default-master-3 172.20.0.4:51820 up 14573208 18157680 -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 60 talos-default-worker-2 172.20.0.6:51820 up 130072 46888 -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 60 talos-default-worker-1 172.20.0.5:51820 up 130044 46556 -``` - -KubeSpan peer status includes following information: - -* the actual endpoint used for peer communication -* link state: - * `unknown`: the endpoint was just changed, link state is not known yet - * `up`: there is a recent handshake from the peer - * `down`: there is no handshake from the peer -* number of bytes sent/received over the Wireguard link with the peer - -If the connection state goes `down`, Talos will be cycling through the available endpoints until it finds the one which works. - -Peer status information is updated every 30 seconds. - -### KubeSpanEndpoints - -A node's WireGuard endpoints (peer addresses) can be obtained with: - -```sh -$ talosctl get kubespanendpoints -ID VERSION ENDPOINT AFFILIATE ID -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 1 172.20.0.3:51820 2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 1 172.20.0.4:51820 b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 1 172.20.0.6:51820 NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 1 172.20.0.5:51820 6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA -``` - -The endpoint ID is the base64 encoded WireGuard public key. - -The observed endpoints are submitted back to the discovery service (if enabled) so that other peers can try additional endpoints to establish the connection. diff --git a/website/content/v0.13/guides/managing-pki.md b/website/content/v0.13/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.13/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.13/guides/rbac.md b/website/content/v0.13/guides/rbac.md deleted file mode 100644 index 2376ec7d2..000000000 --- a/website/content/v0.13/guides/rbac.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Role-based access control (RBAC) ---- - -Talos v0.11 introduced initial support for role-based access control (RBAC). -This guide will explain what that is and how to enable it without losing access to the cluster. - -## RBAC in Talos - -Talos uses certificates to authorize users. -The certificate subject's organization field is used to encode user roles. -There is a set of predefined roles that allow access to different [API methods](../../reference/api/): - -* `os:admin` grants access to all methods; -* `os:reader` grants access to "safe" methods (for example, that includes the ability to list files, but does not include the ability to read files content); -* `os:etcd:backup` grants access to [`/machine.MachineService/EtcdSnapshot`](../../reference/api/#machine.EtcdSnapshotRequest) method. - -Roles in the current `talosconfig` can be checked with the following command: - -```sh -$ talosctl config info - -[...] -Roles: os:admin -[...] -``` - -RBAC is enabled by default in new clusters created with `talosctl` v0.11+ and disabled otherwise. - -## Enabling RBAC - -First, both the Talos cluster and `talosctl` tool should be [upgraded](../upgrading-talos/). -Then the `talosctl config new` command should be used to generate a new client configuration with the `os:admin` role. -Additional configurations and certificates for different roles can be generated by passing `--roles` flag: - -```sh -talosctl config new --roles=os:reader reader -``` - -That command will create a new client configuration file `reader` with a new certificate with `os:reader` role. - -After that, RBAC should be enabled in the machine configuration: - -```yaml -machine: - features: - rbac: true -``` diff --git a/website/content/v0.13/guides/resetting-a-machine.md b/website/content/v0.13/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.13/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.13/guides/storage.md b/website/content/v0.13/guides/storage.md deleted file mode 100644 index 7e53db95e..000000000 --- a/website/content/v0.13/guides/storage.md +++ /dev/null @@ -1,220 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -In Kubernetes, using storage in the right way is well-facilitated by the API. -However, unless you are running in a major public cloud, that API may not be hooked up to anything. -This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. -There are a _lot_ of options out there, and it can be fairly bewildering. - -For Talos, we try to limit the options somewhat to make the decision-making easier. - -## Public Cloud - -If you are running on a major public cloud, use their block storage. -It is easy and automatic. - -## Storage Clusters - -Redundancy in storage is usually very important. -Scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. - -Running a storage cluster can be a very good choice when managing your own storage, and there are two project we recommend, depending on your situation. - -If you need vast amounts of storage composed of more than a dozen or so disks, just use Rook to manage Ceph. -Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. -Ceph also bundles in an S3-compatible object store. -The down side of Ceph is that there are a lot of moving parts. - -> Please note that _most_ people should _never_ use mount-many semantics. -> NFS is pervasive because it is old and easy, _not_ because it is a good idea. -> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. - -If your storage needs are small enough to not need Ceph, use Mayastor. - -### Rook/Ceph - -[Ceph](https://ceph.io) is the grandfather of open source storage clusters. -It is big, has a lot of pieces, and will do just about anything. -It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. -It comes bundled with RadosGW, an S3-compatible object store. -It comes with CephFS, a NFS-like clustered filesystem. -And of course, it comes with RBD, a block storage system. - -With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. - -So if Ceph is so great, why not use it for everything? - -Ceph can be rather slow for small clusters. -It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. -Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. - -Troubleshooting Ceph can be difficult if you do not understand its architecture. -There are lots of acronyms and the documentation assumes a fair level of knowledge. -There are very good tools for inspection and debugging, but this is still frequently seen as a concern. - -### Mayastor - -[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. -(Despite the name, Mayastor does _not_ require you to have NVME drives.) -It is fast and lean but still cluster-oriented and cloud native. -Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. - -Unlike Ceph, Mayastor is _just_ a block store. -It focuses on block storage and does it well. -It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. - -Mayastor is new, maybe _too_ new. -If you're looking for something well-tested and battle-hardened, this is not it. -If you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. - -### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -This can be done with `talosctl edit machineconfig` or via config patches during `talosctl gen config`. - -- Under `/machine/sysctls`, add `vm.nr_hugepages: "512"` -- Under `/machine/kubelet/extraMounts`, add `/var/local` like so: - -```yaml -... -extraMounts: - - destination: /var/local - type: bind - source: /var/local - options: - - rbind - - rshared - - rw -... -``` - -- Either using `kubectl taint node` in a pre-existing cluster or by updating `/machine/kubelet/extraArgs` in machine config, add `openebs.io/engine=mayastor` as a node label. -If being done via machine config, `extraArgs` may look like: - -```yaml -... -extraArgs: - node-labels: openebs.io/engine=mayastor -... -``` - -### Deploy Mayastor - -Using the [Mayastor docs](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) as a reference, apply all YAML files necessary. -At the time of writing this looked like: - -```bash -kubectl create namespace mayastor - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-rbac.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/nats-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/csi/moac/crds/mayastorpool.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/csi-daemonset.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/mayastor-daemonset.yaml -``` - -### Create Pools - -Each "storage" node should have a "MayastorPool" that defines the local disks to use for storage. -These are later considered during scheduling and replication of data. -Create the pool by issuing the following, updating as necessary: - -```bash -cat < - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.13/guides/upgrading-kubernetes.md b/website/content/v0.13/guides/upgrading-kubernetes.md deleted file mode 100644 index abd787fc1..000000000 --- a/website/content/v0.13/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,309 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To check what is going to be upgraded you can run `talosctl upgrade-k8s` with `--dry-run` flag: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.21.3 --to 1.22.0 --dry-run -checking for resource APIs to be deprecated in version 1.22.0 -WARNING: found resources which are going to be deprecated/migrated in the version 1.22.0 -RESOURCE COUNT -validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 -mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 -customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 -apiservices.v1beta1.apiregistration.k8s.io 54 -leases.v1beta1.coordination.k8s.io 4 - -discovered master nodes ["10.5.0.2"] -updating "kube-apiserver" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-apiserver: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating "kube-controller-manager" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-controller-manager: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating "kube-scheduler" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-scheduler: v1.21.3 -> 1.22.0 - > skipped in dry-run -updating daemonset "kube-proxy" to version "1.22.0" -skipped in dry-run -``` - -To upgrade Kubernetes from v1.21.3 to v1.22.0 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.21.3 --to 1.22.0 -checking for resource APIs to be deprecated in version 1.22.0 -discovered master nodes ["10.5.0.2"] -updating "kube-apiserver" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-apiserver: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating "kube-controller-manager" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-controller-manager: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating "kube-scheduler" to version "1.22.0" - > "10.5.0.2": starting update - > update kube-scheduler: v1.21.3 -> 1.22.0 - > "10.5.0.2": machine configuration patched - > "10.5.0.2": waiting for API server state pod update - < "10.5.0.2": successfully updated -updating daemonset "kube-proxy" to version "1.22.0" -``` - -Script runs in two phases: - -1. In the first phase every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. - Messages `config version mismatch` indicate that script is waiting for the updated container to be registered in the API server. -2. In the second phase script updates `kube-proxy` daemonset with the new image version. - -If script fails for any reason, it can be safely restarted to continue upgrade process. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -## Kubelet - -Upgrading Kubelet version requires Talos node reboot after machine configuration change. - -For every node, patch machine configuration with new kubelet version, wait for the node to reboot: - -```bash -$ talosctl -n patch mc -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -Once node boots with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.20.4 -``` diff --git a/website/content/v0.13/guides/upgrading-talos.md b/website/content/v0.13/guides/upgrading-talos.md deleted file mode 100644 index cccd50ccc..000000000 --- a/website/content/v0.13/guides/upgrading-talos.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -### After Upgrade to 0.13 - -No actions required. - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.13.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.13.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -There are no required machine configuration changes when upgrading to Talos 0.13, but there are several new features -which should be enabled explicitly: - -* [cluster membership discovery](../../guides/discovery/) -* [KubeSpan](../../guides/kubespan/) - -These features require `.cluster.id` and `.cluster.secret` configuration fields to be set (introduced in Talos 0.12), -please see the [v0.12 upgrade docs](../../../docs-v0.12/guides/upgrading-talos/) for details. diff --git a/website/content/v0.13/guides/vip.md b/website/content/v0.13/guides/vip.md deleted file mode 100644 index 12205537d..000000000 --- a/website/content/v0.13/guides/vip.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.13/introduction/_index.md b/website/content/v0.13/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.13/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.13/introduction/getting-started.md b/website/content/v0.13/introduction/getting-started.md deleted file mode 100644 index a7e611747..000000000 --- a/website/content/v0.13/introduction/getting-started.md +++ /dev/null @@ -1,471 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -#### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -#### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.13.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.13.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.13.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.13.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.13.0/boot-amd64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.13.0/boot-amd64.tar.gz) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.13.0/boot-ard64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.13.0/boot-ard64.tar.gz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](../../reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `worker.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Worker - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Worker. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Worker Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Worker Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `worker.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp worker.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. -The author of this document does not set a default node. - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.13/introduction/quickstart.md b/website/content/v0.13/introduction/quickstart.md deleted file mode 100644 index a5978ea51..000000000 --- a/website/content/v0.13/introduction/quickstart.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -#### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -#### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.13.0) containerd://1.5.5 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.13.0) containerd://1.5.5 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.13/introduction/support-matrix.md b/website/content/v0.13/introduction/support-matrix.md deleted file mode 100644 index 7535bfb0a..000000000 --- a/website/content/v0.13/introduction/support-matrix.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Support Matrix -weight: 6 ---- - -| Talos Version | 0.13 | 0.12 | -|----------------------------------------------------------------------------------------------------------------|------------------------------------|------------------------------------| -| Release Date | 2021-10-12 | 2021-08-31 (0.12.0) | -| End of Community Support | 0.14.0 release (2021-12-15, TBD) | 2021-10-12 | -| Enterprise Support | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | -| Kubernetes | 1.22, 1.21, 1.20 | 1.22, 1.21, 1.20 | -| Architecture | amd64, arm64 | -| **Platforms** | | | -| - cloud | AWS, GCP, Azure, Digital Ocean, Hetzner, OpenStack, Scaleway, Vultr, Upcloud | AWS, GCP, Azure, Digital Ocean, OpenStack | -| - bare metal | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | -| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | -| - SBCs | Raspberry Pi4, Banana Pi M64, Pine64, and other | -| - local | Docker, QEMU | -| **Cluster API** | | | -| [CAPI Bootstrap Provider Talos](https://github.com/talos-systems/cluster-api-bootstrap-provider-talos) | >= 0.4.1 | >= 0.3.0 | -| [CAPI Control Plane Provider Talos](https://github.com/talos-systems/cluster-api-control-plane-provider-talos) | >= 0.3.0 | >= 0.1.1 | -| [Sidero](https://www.sidero.dev/) | >= 0.3.0 | >= 0.3.0 | -| **UI** | | | -| [Theila](https://github.com/talos-systems/theila) | ✓ | ✓ | - -## Platform Tiers - -Tier 1: Automated tests, high-priority fixes. -Tier 2: Tested from time to time, medium-priority bugfixes. -Tier 3: Not tested by core Talos team, community tested. - -### Tier 1 - -* Metal -* AWS -* GCP - -### Tier 2 - -* Azure -* Digital Ocean -* OpenStack -* VMWare - -### Tier 3 - -* Hetzner -* nocloud -* Scaleway -* Vultr -* Upcloud diff --git a/website/content/v0.13/introduction/system-requirements.md b/website/content/v0.13/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.13/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.13/introduction/what-is-new.md b/website/content/v0.13/introduction/what-is-new.md deleted file mode 100644 index fcd8ce89d..000000000 --- a/website/content/v0.13/introduction/what-is-new.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: What's New in Talos 0.13 -weight: 5 ---- - -### Cluster Discovery and KubeSpan - -This release of Talos includes two new closely related -features: [cluster membership discovery](../../guides/discovery/) and [KubeSpan](../../guides/kubespan/). - -KubeSpan is a feature of Talos that automates the setup and maintainance of a full mesh [WireGuard](https://www.wireguard.com) network for your cluster, giving you the ablility to operate hybrid Kubernetes clusters that can span the edge, datacenter, and cloud. -Management of keys and discovery of peers can be completely automated for a zero-touch experience that makes it simple and easy to create hybrid clusters. - -These new features are not enabled by default, to enable them please make following changes to the machine configuration: - -```yaml -machine: - network: - kubespan: - enabled: true -cluster: - discovery: - enabled: true -``` - -### Reboots via `kexec` - -Talos now reboots by default via kexec syscall which means BIOS POST process is skipped. -On bare-metal hardware BIOS POST process might take 10-15 minutes, so Talos reboots 10-15 minutes faster on bare-metal. - -Kexec support is enabled by default, but it can be disabled with the following change to the machine configuration: - -```yaml -machine: - sysctls: - kernel.kexec_load_disabled: "1" -``` - -### Hetzner, Scaleway, Upcloud and Vultr - -Talos now natively supports four new cloud platforms: - -* [Hetzner](https://www.hetzner.com/), including VIP support -* [Scaleway](https://www.scaleway.com/en/) -* [Upcloud](https://upcloud.com/) -* [Vultr](https://www.vultr.com/) - -Also generic `cloud-init` `nocloud` platform is supported in both networking and storage-based modes. - -### etcd Advertised Address - -The address advertised by etcd can now be controlled with [new machine configuration option](../../reference/configuration/#etcdconfig) `machine.etcd.subnet`. - -### kubelet Node IP - -The addresses picked by kubelet can now be controlled with [new machine configuration option](../../reference/configuration/#kubeletconfig) `machine.kubelet.nodeIP.validSubnets`. - -### Windows Suport - -CLI tool talosctl is now built for Windows and published as part of the [release](https://github.com/talos-systems/talos/releases/tag/v0.13.0). - -### Component Updates - -* Linux: 5.10.69 -* Kubernetes: 1.22.2 -* containerd: 1.5.6 -* runc: 1.0.2 - -Talos is built with Go 1.17.1. diff --git a/website/content/v0.13/introduction/what-is-talos.md b/website/content/v0.13/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.13/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.13/learn-more/_index.md b/website/content/v0.13/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.13/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.13/learn-more/architecture.md b/website/content/v0.13/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.13/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.13/learn-more/components.md b/website/content/v0.13/learn-more/components.md deleted file mode 100644 index eed0fdee7..000000000 --- a/website/content/v0.13/learn-more/components.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.13/learn-more/concepts.md b/website/content/v0.13/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.13/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.13/learn-more/control-plane.md b/website/content/v0.13/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.13/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.13/learn-more/controllers-resources.md b/website/content/v0.13/learn-more/controllers-resources.md deleted file mode 100644 index d46cfae4e..000000000 --- a/website/content/v0.13/learn-more/controllers-resources.md +++ /dev/null @@ -1,229 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, -listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v0.13/learn-more/discovery.md b/website/content/v0.13/learn-more/discovery.md deleted file mode 100644 index 2b4d55003..000000000 --- a/website/content/v0.13/learn-more/discovery.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: "Discovery" -weight: 11 ---- - -We maintain a public discovery service whereby members of your cluster can use a common and unique key to coordinate the most basic connection information (i.e. the set of possible "endpoints", or IP:port pairs). -We call this data "affiliate data." - -> Note: If KubeSpan is enabled the data has the addition of the WireGuard public key. - -Before sending data to the discovery service, Talos will encrypt the affiliate data with AES-GCM encryption and separately encrypt endpoints with AES in ECB mode so that endpoints coming from different sources can be deduplicated server-side. -Each node submits it's data encrypted plus it submits the endpoints it sees from other peers to the discovery service -The discovery service aggregates the data, deduplicates the endpoints, and sends updates to each connected peer. -Each peer receives information back about other affiliates from the discovery service, decrypts it and uses it to drive KubeSpan and cluster discovery. -Moreover, the discovery service has no peristence. -Data is stored in memory only with a TTL set by the clients (i.e. Talos). -The cluster ID is used as a key to select the affiliates (so that different clusters see different affiliates). - -To summarize, the discovery service knows the client version, cluster ID, the number of affiliates, some encrypted data for each affiliate, and a list of encrypted endpoints. diff --git a/website/content/v0.13/learn-more/faqs.md b/website/content/v0.13/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.13/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.13/learn-more/kubespan.md b/website/content/v0.13/learn-more/kubespan.md deleted file mode 100644 index 685914121..000000000 --- a/website/content/v0.13/learn-more/kubespan.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: "KubeSpan" -weight: 12 ---- - -## WireGuard Peer Discovery - -The key pieces of information needed for WireGuard generally are: - -- the public key of the host you wish to connect to -- an IP address and port of the host you wish to connect to - -The latter is really only required of _one_ side of the pair. -Once traffic is received, that information is known and updated by WireGuard automatically and internally. - -For Kubernetes, though, this is not quite sufficient. -Kubernetes also needs to know which traffic goes to which WireGuard peer. -Because this information may be dynamic, we need a way to be able to constantly keep this information up to date. - -If we have a functional connection to Kubernetes otherwise, it's fairly easy: we can just keep that information in Kubernetes. -Otherwise, we have to have some way to discover it. - -In our solution, we have a multi-tiered approach to gathering this information. -Each tier can operate independently, but the amalgamation of the tiers produces a more robust set of connection criteria. - -For this discussion, we will point out two of these tiers: - -- an external service -- a Kubernetes-based system - -See [discovery service](../discovery) to learn more about the external service. - -The Kubernetes-based system utilises annotations on Kubernetes Nodes which describe each node's public key and local addresses. - -On top of this, we also route Pod subnets. -This is often (maybe even usually) taken care of by the CNI, but there are many situations where the CNI fails to be able to do this itself, across networks. -So we also scrape the Kubernetes Node resource to discover its `podCIDRs`. - -## NAT, Multiple Routes, Multiple IPs - -One of the difficulties in communicating across networks is that there is often not a single address and port which can identify a connection for each node on the system. -For instance, a node sitting on the same network might see its peer as `192.168.2.10`, but a node across the internet may see it as `2001:db8:1ef1::10`. - -We need to be able to handle any number of addresses and ports, and we also need to have a mechanism to _try_ them. -WireGuard only allows us to select one at a time. - -For our implementation, then, we have built a controller which continuously discovers and rotates these IP:port pairs until a connection is established. -It then starts trying again if that connection ever fails. - -## Packet Routing - -After we have established a WireGuard connection, our work is not done. -We still have to make sure that the right packets get sent to the WireGuard interface. - -WireGuard supplies a convenient facility for tagging packets which come from _it_, which is great. -But in our case, we need to be able to allow traffic which both does _not_ come from WireGuard and _also_ is not destined for another Kubernetes node to flow through the normal mechanisms. - -Unlike many corporate or privacy-oriented VPNs, we need to allow general internet traffic to flow normally. - -Also, as our cluster grows, this set of IP addresses can become quite large and quite dynamic. -This would be very cumbersome and slow in `iptables`. -Luckily, the kernel supplies a convenient mechanism by which to define this arbitrarily large set of IP addresses: IP sets. - -Talos collects all of the IPs and subnets which are considered "in-cluster" and maintains these in the kernel as an IP set. - -Now that we have the IP set defined, we need to tell the kernel how to use it. - -The traditional way of doing this would be to use `iptables`. -However, there is a big problem with IPTables. -It is a common namespace in which any number of other pieces of software may dump things. -We have no surety that what we add will not be wiped out by something else (from Kubernetes itself, to the CNI, to some workload application), be rendered unusable by higher-priority rules, or just generally cause trouble and conflicts. - -Instead, we use a three-pronged system which is both more foundational and less centralised. - -NFTables offers a separately namespaced, decentralised way of marking packets for later processing based on IP sets. -Instead of a common set of well-known tables, NFTables uses hooks into the kernel's netfilter system, which are less vulnerable to being usurped, bypassed, or a source of interference than IPTables, but which are rendered down by the kernel to the same underlying XTables system. - -Our NFTables system is where we store the IP sets. -Any packet which enters the system, either by forward from inside Kubernetes or by generation from the host itself, is compared against a hash table of this IP set. -If it is matched, it is marked for later processing by our next stage. -This is a high-performance system which exists fully in the kernel and which ultimately becomes an eBPF program, so it scales well to hundreds of nodes. - -The next stage is the kernel router's route rules. -These are defined as a common ordered list of operations for the whole operating system, but they are intended to be tightly constrained and are rarely used by applications in any case. -The rules we add are very simple: if a packet is marked by our NFTables system, send it to an alternate routing table. - -This leads us to our third and final stage of packet routing. -We have a custom routing table with two rules: - -- send all IPv4 traffic to the WireGuard interface -- send all IPv6 traffic to the WireGuard interface - -So in summary, we: - -- mark packets destined for Kubernetes applications or Kubernetes nodes -- send marked packets to a special routing table -- send anything which is sent to that routing table through the WireGuard interface - -This gives us an isolated, resilient, tolerant, and non-invasive way to route Kubernetes traffic safely, automatically, and transparently through WireGuard across almost any set of network topologies. diff --git a/website/content/v0.13/learn-more/networking-resources.md b/website/content/v0.13/learn-more/networking-resources.md deleted file mode 100644 index f9e58a549..000000000 --- a/website/content/v0.13/learn-more/networking-resources.md +++ /dev/null @@ -1,394 +0,0 @@ ---- -title: "Networking Resources" -weight: 10 ---- - -Starting with version 0.11, a new implementation of the network configuration subsystem is powered by [COSI](../controllers-resources/). -The new implementation is still using the same machine configuration file format and external sources to configure a node's network, so there should be no difference -in the way Talos works in 0.11. - -The most notable change in Talos 0.11 is that all changes to machine configuration `.machine.network` can be applied now in immediate mode (without a reboot) via -`talosctl edit mc --immediate` or `talosctl apply-config --immediate`. - -## Resources - -There are six basic network configuration items in Talos: - -* `Address` (IP address assigned to the interface/link); -* `Route` (route to a destination); -* `Link` (network interface/link configuration); -* `Resolver` (list of DNS servers); -* `Hostname` (node hostname and domainname); -* `TimeServer` (list of NTP servers). - -Each network configuration item has two counterparts: - -* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); -* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. - -| Resource | Status | Spec | -|--------------------|------------------------|----------------------| -| `Address` | `AddressStatus` | `AddressSpec` | -| `Route` | `RouteStatus` | `RouteSpec` | -| `Link` | `LinkStatus` | `LinkSpec` | -| `Resolver` | `ResolverStatus` | `ResolverSpec` | -| `Hostname` | `HostnameStatus` | `HostnameSpec` | -| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | - -Status resources have aliases with the `Status` suffix removed, so for example -`AddressStatus` is also available as `Address`. - -Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. - -## Observing State - -The current network configuration state can be observed by querying `*Status` resources via -`talosctl`: - -```sh -$ talosctl get addresses -NODE NAMESPACE TYPE ID VERSION ADDRESS LINK -172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 -172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 -172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 -172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 -172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo -172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo -``` - -In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and -addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). - -Talos networking controllers watch the kernel state and update resources -accordingly. - -Additional details about the address can be accessed via the YAML output: - -```sh -$ talosctl get address eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressStatuses.net.talos.dev - id: eth0/172.20.0.2/24 - version: 1 - owner: network.AddressStatusController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - address: 172.20.0.2/24 - local: 172.20.0.2 - broadcast: 172.20.0.255 - linkIndex: 4 - linkName: eth0 - family: inet4 - scope: global - flags: permanent -``` - -Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. - -Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. -For example: - -```sh -$ talosctl get resolvers -NODE NAMESPACE TYPE ID VERSION RESOLVERS -172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] -``` - -## Inspecting Configuration - -The desired networking configuration is combined from multiple sources and presented -as `*Spec` resources: - -```sh -$ talosctl get addressspecs -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 -172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 -172.20.0.2 network AddressSpec lo/::1/128 2 -``` - -These `AddressSpecs` are applied to the Linux kernel to reach the desired state. -If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. - -`*Spec` resources can't be manipulated directly, they are generated automatically by Talos -from multiple configuration sources (see a section below for details). - -If a `*Spec` resource is queried in YAML format, some additional information is available: - -```sh -$ talosctl get addressspecs eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressSpecs.net.talos.dev - id: eth0/172.20.0.2/24 - version: 2 - owner: network.AddressMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.AddressSpecController -spec: - address: 172.20.0.2/24 - linkName: eth0 - family: inet4 - scope: global - flags: permanent - layer: operator -``` - -An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. - -## Configuration Merging - -Spec resources described in the previous section show the final merged configuration state, -while initial specs are put to a different unmerged namespace `network-config`. -Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. - -Let's take `HostnameSpec` as an example. -The final merged representation is: - -```sh -$ talosctl get hostnamespec -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: HostnameSpecs.net.talos.dev - id: hostname - version: 2 - owner: network.HostnameMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.HostnameSpecController -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that the final configuration for the hostname is `talos-default-master-1`. -And this is the hostname that was actually applied. -This can be verified by querying a `HostnameStatus` resource: - -```sh -$ talosctl get hostnamestatus -NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME -172.20.0.2 network HostnameStatus hostname 1 talos-default-master-1 -``` - -Initial configuration for the hostname in the `network-config` namespace is: - -```sh -$ talosctl get hostnamespec -o yaml --namespace network-config -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: default/hostname - version: 2 - owner: network.HostnameConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-172-20-0-2 - domainname: "" - layer: default ---- -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: dhcp4/eth0/hostname - version: 1 - owner: network.OperatorSpecController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that there are two specs for the hostname: - -* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); -* another one from the layer `operator` that defines the hostname as `talos-default-master-1` (DHCP). - -Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. -Here is the order of precedence from low to high: - -* `default` (defaults provided by Talos); -* `cmdline` (from the kernel command line); -* `platform` (driven by the cloud provider); -* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); -* `configuration` (derived from the machine configuration). - -So in our example the `operator` layer `HostnameSpec` overwrites the `default` layer producing the final hostname `talos-default-master-1`. - -The merge process applies to all six core networking specs. -For each spec, the `layer` controls the merge behavior -If multiple configuration specs -appear at the same layer, they can be merged together if possible, otherwise merge result -is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). - -`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. - -## Network Operators - -Network operators provide dynamic network configuration which can change over time as the node is running: - -* DHCPv4 -* DHCPv6 -* Virtual IP - -Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. - -Operators are configured with `OperatorSpec` resources which describe when operators -should run and additional configuration for the operator: - -```sh -$ talosctl get operatorspecs -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: OperatorSpecs.net.talos.dev - id: dhcp4/eth0 - version: 1 - owner: network.OperatorConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - operator: dhcp4 - linkName: eth0 - requireUp: true - dhcp4: - routeMetric: 1024 -``` - -`OperatorSpec` resources are generated by Talos based on machine configuration mostly. -DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. -This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. - -Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: - -```sh -$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 -``` - -## Other Network Resources - -There are some additional resources describing the network subsystem state. - -The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: - -```sh -$ talosctl get nodeaddresses -NODE NAMESPACE TYPE ID VERSION ADDRESSES -10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] -``` - -* `default` is the node default address; -* `current` is the set of addresses a node currently has; -* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). - -`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. - -Another important resource is `Nodename` which provides `Node` name in Kubernetes: - -```sh -$ talosctl get nodename -NODE NAMESPACE TYPE ID VERSION NODENAME -10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v -``` - -Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. - -`NetworkStatus` aggregates the current state of the network configuration: - -```sh -$ talosctl get networkstatus -o yaml -node: 10.100.2.23 -metadata: - namespace: network - type: NetworkStatuses.net.talos.dev - id: status - version: 5 - owner: network.StatusController - phase: running - created: 2021-06-24T18:56:00Z - updated: 2021-06-24T18:56:02Z -spec: - addressReady: true - connectivityReady: true - hostnameReady: true - etcFilesReady: true -``` - -## Network Controllers - -For each of the six basic resource types, there are several controllers: - -* `*StatusController` populates `*Status` resources observing the Linux kernel state. -* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. -* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. -* `*SpecController` applies merged `*Spec` resources to the kernel state. - -For the network operators: - -* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. -* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. - -## Configuration Sources - -There are several configuration sources for the network configuration, which are described in this section. - -### Defaults - -* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; -* hostname is set to the `talos-` where `IP` is the default node address; -* resolvers are set to `8.8.8.8`, `1.1.1.1`; -* time servers are set to `pool.ntp.org`; -* DHCP4 operator is run on any physical interface which is not configured explicitly. - -### Cmdline - -The kernel command line is parsed for the following options: - -* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; -* `talos.hostname=` option is used to set node hostname; -* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. - -### Platform - -Platform configuration delivers cloud environment-specific options (e.g. the hostname). - -### Operator - -Network operators provide configuration for all basic resource types. - -### Machine Configuration - -The machine configuration is parsed for link configuration, addresses, routes, hostname, -resolvers and time servers. -Any changes to `.machine.network` configuration can be applied in immediate mode. - -## Network Configuration Debugging - -Most of the network controller operations and failures are logged to the kernel console, -additional logs with `debug` level are available with `talosctl logs controller-runtime` command. -If the network configuration can't be established and the API is not available, `debug` level -logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v0.13/learn-more/philosophy.md b/website/content/v0.13/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.13/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.13/learn-more/talosctl.md b/website/content/v0.13/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.13/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.13/learn-more/upgrades.md b/website/content/v0.13/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.13/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.13/local-platforms/_index.md b/website/content/v0.13/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.13/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.13/local-platforms/docker.md b/website/content/v0.13/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.13/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.13/local-platforms/qemu.md b/website/content/v0.13/local-platforms/qemu.md deleted file mode 100644 index 29988ab66..000000000 --- a/website/content/v0.13/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.13.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.13.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.13.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.13.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Worker 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.13/local-platforms/virtualbox.md b/website/content/v0.13/local-platforms/virtualbox.md deleted file mode 100644 index e24ec676c..000000000 --- a/website/content/v0.13/local-platforms/virtualbox.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.13.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.13.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.13/reference/_index.md b/website/content/v0.13/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.13/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.13/reference/api.md b/website/content/v0.13/reference/api.md deleted file mode 100644 index 1e7878d27..000000000 --- a/website/content/v0.13/reference/api.md +++ /dev/null @@ -1,3446 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FeaturesInfo](#machine.FeaturesInfo) - - [FileInfo](#machine.FileInfo) - - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) - - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) - - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | -| INPUT_DESTROY_READY | 4 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | -| is_learner | [bool](#bool) | | learner flag | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FeaturesInfo -FeaturesInfo describes individual Talos features that can be switched on or off. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | -| uid | [uint32](#uint32) | | Owner uid | -| gid | [uint32](#uint32) | | Owner gid | - - - - - - - - -### GenerateClientConfiguration - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | -| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | -| key | [bytes](#bytes) | | PEM-encoded generated client key. | -| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | - - - - - - - - -### GenerateClientConfigurationRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| roles | [string](#string) | repeated | Roles in the generated client certificate. | -| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | - - - - - - - - -### GenerateClientConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesResponse -rpc processes - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | -| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_WORKER | 3 | | -| TYPE_JOIN | 3 | Alias for TYPE_WORKER. | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | -| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| created | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| updated | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| tail_events | [uint32](#uint32) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.13/reference/cli.md b/website/content/v0.13/reference/cli.md deleted file mode 100644 index ba547f288..000000000 --- a/website/content/v0.13/reference/cli.md +++ /dev/null @@ -1,2127 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --bad-rtc launch VM with bad RTC state (QEMU only) - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.13.0-alpha.3/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.22.2") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-kubespan enable KubeSpan system - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or QEMU-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config contexts - -List defined contexts - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config info - -Show information about the current context - -``` -talosctl config info [flags] -``` - -### Options - -``` - -h, --help help for info -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config merge - -Merge additional contexts from another client configuration file - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config new - -Generate a new client configuration file - -``` -talosctl config new [] [flags] -``` - -### Options - -``` - --crt-ttl duration certificate TTL (default 87600h0m0s) - -h, --help help for new - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config - -Manage the client configuration file (talosconfig) - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config info](#talosctl-config-info) - Show information about the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file -* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use -a control plane node, common in a single node control plane setup, use port 6443 as -this is the port that the API server binds to on every control plane node. For an HA -setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) - --with-kubespan enable KubeSpan feature -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - -i, --insecure get resources using the insecure (encrypted with no auth) maintenance service - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --dry-run skip the actual upgrade and show the upgrade plan instead - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.22.2") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.13/reference/configuration.md b/website/content/v0.13/reference/configuration.md deleted file mode 100644 index a9a1b1bde..000000000 --- a/website/content/v0.13/reference/configuration.md +++ /dev/null @@ -1,5533 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: - - talosctl gen config --version v1alpha1 - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
-
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
-
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - -This node type was previously known as "join"; that value is still supported but deprecated. - - -Valid values: - - - - init - - - controlplane - - - worker -
- -
-
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
-
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.22.2 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - bind - # - rshared - # - rw - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - fdc7::/16 -``` - - -
- -
-
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. -``` - - -
- -
-
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
-
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
-
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
-
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com - bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -``` - - -
- -
-
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
-
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
-
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - - -
- -
-
- -features FeaturesConfig - -
-
- -Features describe individual Talos features that can be switched on or off. - - - -Examples: - - -``` yaml -features: - rbac: true # Enable role-based access control (RBAC). -``` - - -
- -
- - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -id string - -
-
- -Globally unique identifier for this cluster (base64 encoded random 32 bytes). - -
- -
-
- -secret string - -
-
- -Shared secret of cluster (base64 encoded random 32 bytes). -This secret is shared among cluster members but should never be sent over the network. - -
- -
-
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
-
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
-
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
-
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
-
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.22.2 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
-
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.22.2 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
-
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.22.2 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
-
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.22.2 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
-
- -discovery ClusterDiscoveryConfig - -
-
- -Configures cluster member discovery. - - - -Examples: - - -``` yaml -discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -``` - - -
- -
-
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" - - # # The subnet from which the advertise URL should be. - # subnet: 10.0.0.0/8 -``` - - -
- -
-
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - - -
- -
-
- -externalCloudProvider ExternalCloudProviderConfig - -
-
- -External cloud provider configuration. - - - -Examples: - - -``` yaml -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
-
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
-
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the extraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
-
- -inlineManifests ClusterInlineManifests - -
-
- -A list of inline Kubernetes manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -``` - - -
- -
-
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
-
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - -## ExtraMount -ExtraMount wraps OCI Mount specification. - -Appears in: - -- KubeletConfig.extraMounts - - -``` yaml -- destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -``` - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.22.2 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. -# clusterDNS: -# - 10.96.0.10 -# - 169.254.2.53 - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - bind -# - rshared -# - rw - -# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. -# nodeIP: -# # The `validSubnets` field configures the networks to pick kubelet node IP from. -# validSubnets: -# - 10.0.0.0/8 -# - fdc7::/16 -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.22.2 -``` - - -
- -
-
- -clusterDNS []string - -
-
- -The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - - - -Examples: - - -``` yaml -clusterDNS: - - 10.96.0.10 - - 169.254.2.53 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
-
- -extraMounts []ExtraMount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. -Note that either `bind` or `rbind` are required in the `options`. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -``` - - -
- -
-
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -nodeIP KubeletNodeIPConfig - -
-
- -The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. -This is used when a node has multiple addresses to choose from. - - - -Examples: - - -``` yaml -nodeIP: - # The `validSubnets` field configures the networks to pick kubelet node IP from. - validSubnets: - - 10.0.0.0/8 - - fdc7::/16 -``` - - -
- -
- - - -## KubeletNodeIPConfig -KubeletNodeIPConfig represents the kubelet node IP configuration. - -Appears in: - -- KubeletConfig.nodeIP - - -``` yaml -# The `validSubnets` field configures the networks to pick kubelet node IP from. -validSubnets: - - 10.0.0.0/8 - - fdc7::/16 -``` - -
- -
- -validSubnets []string - -
-
- -The `validSubnets` field configures the networks to pick kubelet node IP from. -For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. -If not specified, kubelet configures node IP automatically. - -
- -
- - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld - -# # Configures KubeSpan feature. -# kubespan: -# enabled: true # Enable the KubeSpan feature. -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
-
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
-
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
-
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
-
- -kubespan NetworkKubeSpan - -
-
- -Configures KubeSpan feature. - - - -Examples: - - -``` yaml -kubespan: - enabled: true # Enable the KubeSpan feature. -``` - - -
- -
- - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk attributes like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
-
- -diskSelector InstallDiskSelector - -
-
- -Look up disk using disk attributes like model, size, serial and others. -Always has priority over `disk`. - - - -Examples: - - -``` yaml -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
-
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
-
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -legacyBIOSSupport bool - -
-
- -Indicates if MBR partition should be marked as bootable (active). -Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. - -
- -
- - - -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - -- InstallConfig.diskSelector - - -``` yaml -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -size InstallDiskSizeMatcher - -
-
- -Disk size. - - - -Examples: - - -``` yaml -size: 4GB -``` - -``` yaml -size: '> 1TB' -``` - -``` yaml -size: <= 2TB -``` - - -
- -
-
- -name string - -
-
- -Disk name `/sys/block//device/name`. - -
- -
-
- -model string - -
-
- -Disk model `/sys/block//device/model`. - -
- -
-
- -serial string - -
-
- -Disk serial number `/sys/block//serial`. - -
- -
-
- -modalias string - -
-
- -Disk modalias `/sys/block//device/modalias`. - -
- -
-
- -uuid string - -
-
- -Disk UUID `/sys/block//uuid`. - -
- -
-
- -wwid string - -
-
- -Disk WWID `/sys/block//wwid`. - -
- -
-
- -type InstallDiskType - -
-
- -Disk Type. - - -Valid values: - - - - ssd - - - hdd - - - nvme - - - sd -
- -
- - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
-
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - -
- -
-
- -bootTimeout Duration - -
-
- -Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -NTP sync will be still running in the background. -Defaults to "infinity" (waiting forever for time sync) - -
- -
- - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
-
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.4 # The `image` field is an override to the default coredns image. -``` - -
- -
- -disabled bool - -
-
- -Disable coredns deployment on cluster bootstrap. - -
- -
-
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
-
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.22.2 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.22.2 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
-
- -disablePodSecurityPolicy bool - -
-
- -Disable PodSecurityPolicy in the API server and default manifests. - -
- -
- - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.22.2 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.22.2 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.22.2 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
-
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.22.2 -``` - - -
- -
-
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.22.2 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.22.2 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" - -# # The subnet from which the advertise URL should be. -# subnet: 10.0.0.0/8 -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.16 -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
-
- -subnet string - -
-
- -The subnet from which the advertise URL should be. - - - -Examples: - - -``` yaml -subnet: 10.0.0.0/8 -``` - - -
- -
- - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "urls". -The "name" key supports the following options: "flannel", "custom", and "none". -"flannel" uses Talos-managed Flannel CNI, and that's the default option. -"custom" uses custom manifests that should be provided in "urls". -"none" indicates that Talos will not manage any CNI installation. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
-
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
-
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
-
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - - -Valid values: - - - - flannel - - - custom - - - none -
- -
-
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. -Should be present for "custom", must be empty for "flannel" and "none". - -
- -
- - - -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - -- ClusterConfig.externalCloudProvider - - -``` yaml -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - -
- -
- -enabled bool - -
-
- -Enable external cloud provider. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -manifests []string - -
-
- -A list of urls that point to additional manifests for an external cloud provider. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
-
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
-
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - -- SystemDiskEncryptionConfig.state -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
-
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
-
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - - -Valid values: - - - - aes-xts-plain64 - - - xchacha12,aes-adiantum-plain64 - - - xchacha20,aes-adiantum-plain64 - - -Examples: - - -``` yaml -cipher: aes-xts-plain64 -``` - - -
- -
-
- -keySize uint - -
-
- -Defines the encryption key length. - -
- -
-
- -blockSize uint64 - -
-
- -Defines the encryption sector size. - - - -Examples: - - -``` yaml -blockSize: 4096 -``` - - -
- -
-
- -options []string - -
-
- -Additional --perf parameters for the LUKS2 encryption. - - -Valid values: - - - - no_read_workqueue - - - no_write_workqueue - - - same_cpu_crypt - - -Examples: - - -``` yaml -options: - - no_read_workqueue - - no_write_workqueue -``` - - -
- -
- - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
-
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
-
- -slot int - -
-
- -Key slot number for LUKS2 encryption. - -
- -
- - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - -- EncryptionKey.nodeID - - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
-
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
-
- -path string - -
-
- -The path of the file. - -
- -
-
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
-
- -aliases []string - -
-
- -The host alias. - -
- -
- - - -## Device -Device represents a network interface. - -Appears in: - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
-
- -addresses []string - -
-
- -Assigns static IP addresses to the interface. -An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). - - - -Examples: - - -``` yaml -addresses: - - 10.5.0.0/16 - - 192.168.3.7 -``` - - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
-
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
-
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
-
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
-
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
-
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
-
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
-
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
-
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
-
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
-
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
-
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
-
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
-
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
-
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
-
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
-
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - -- Device.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
-
- -equinixMetal VIPEquinixMetalConfig - -
-
- -Specifies the Equinix Metal API settings to assign VIP to the node. - -
- -
-
- -hcloud VIPHCloudConfig - -
-
- -Specifies the Hetzner Cloud API settings to assign VIP to the node. - -
- -
- - - -## VIPEquinixMetalConfig -VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. - -Appears in: - -- DeviceVIPConfig.equinixMetal - - - -
- -
- -apiToken string - -
-
- -Specifies the Equinix Metal API Token. - -
- -
- - - -## VIPHCloudConfig -VIPHCloudConfig contains settings for Hetzner Cloud VIP management. - -Appears in: - -- DeviceVIPConfig.hcloud - - - -
- -
- -apiToken string - -
-
- -Specifies the Hetzner Cloud API Token. - -
- -
- - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
-
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - -- Device.vlans - - - -
- -
- -addresses []string - -
-
- -The addresses in CIDR notation or as plain IPs to use. - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
-
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - -## Route -Route represents a network route. - -Appears in: - -- Device.routes -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
-
- -gateway string - -
-
- -The route's gateway. - -
- -
-
- -source string - -
-
- -The route's source address (optional). - -
- -
-
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
-
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
-
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - -## FeaturesConfig -FeaturesConfig describe individual Talos features that can be switched on or off. - -Appears in: - -- MachineConfig.features - - -``` yaml -rbac: true # Enable role-based access control (RBAC). -``` - -
- -
- -rbac bool - -
-
- -Enable role-based access control (RBAC). - -
- -
-
- -logging bool - -
-
- -FIXME(aleksi). - - -> FIXME(aleksi) - -
- -
- - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - -- APIServerConfig.extraVolumes -- ControllerManagerConfig.extraVolumes -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
-
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
-
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - -
- -
- -name string - -
-
- -Name of the manifest. -Name should be unique. - - - -Examples: - - -``` yaml -name: csi -``` - - -
- -
-
- -contents string - -
-
- -Manifest contents as a string. - - - -Examples: - - -``` yaml -contents: /etc/kubernetes/auth -``` - - -
- -
- - - -## NetworkKubeSpan -NetworkKubeSpan struct describes KubeSpan configuration. - -Appears in: - -- NetworkConfig.kubespan - - -``` yaml -enabled: true # Enable the KubeSpan feature. -``` - -
- -
- -enabled bool - -
-
- -Enable the KubeSpan feature. -Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled. - -
- -
-
- -allowDownPeerBypass bool - -
-
- -Skip sending traffic via KubeSpan if the peer connection state is not up. -This provides configurable choice between connectivity and security: either traffic is always -forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly -to the peer if Wireguard connection can't be established. - -
- -
- - - -## ClusterDiscoveryConfig -ClusterDiscoveryConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterConfig.discovery - - -``` yaml -enabled: true # Enable the cluster membership discovery feature. -# Configure registries used for cluster member discovery. -registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -``` - -
- -
- -enabled bool - -
-
- -Enable the cluster membership discovery feature. -Cluster discovery is based on individual registries which are configured under the registries field. - -
- -
-
- -registries DiscoveryRegistriesConfig - -
-
- -Configure registries used for cluster member discovery. - -
- -
- - - -## DiscoveryRegistriesConfig -DiscoveryRegistriesConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterDiscoveryConfig.registries - - - -
- -
- -kubernetes RegistryKubernetesConfig - -
-
- -Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information -as annotations on the Node resources. - -
- -
-
- -service RegistryServiceConfig - -
-
- -Service registry is using an external service to push and pull information about cluster members. - -
- -
- - - -## RegistryKubernetesConfig -RegistryKubernetesConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.kubernetes - - - -
- -
- -disabled bool - -
-
- -Disable Kubernetes discovery registry. - -
- -
- - - -## RegistryServiceConfig -RegistryServiceConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.service - - - -
- -
- -disabled bool - -
-
- -Disable external service discovery registry. - -
- -
-
- -endpoint string - -
-
- -External service endpoint. - - - -Examples: - - -``` yaml -endpoint: https://discovery.talos.dev/ -``` - - -
- -
- - diff --git a/website/content/v0.13/reference/kernel.md b/website/content/v0.13/reference/kernel.md deleted file mode 100644 index 65192d7a5..000000000 --- a/website/content/v0.13/reference/kernel.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automtic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. diff --git a/website/content/v0.13/reference/platform.md b/website/content/v0.13/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.13/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.13/single-board-computers/_index.md b/website/content/v0.13/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.13/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.13/single-board-computers/bananapi_m64.md b/website/content/v0.13/single-board-computers/bananapi_m64.md deleted file mode 100644 index bc48c4c61..000000000 --- a/website/content/v0.13/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.13/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.13/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index a0b7e8f2a..000000000 --- a/website/content/v0.13/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.13/single-board-computers/pine64.md b/website/content/v0.13/single-board-computers/pine64.md deleted file mode 100644 index bc30430b3..000000000 --- a/website/content/v0.13/single-board-computers/pine64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64" -description: "Installing Talos on a Pine64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-pine64-arm64.img.xz -xz -d metal-pine64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-pine64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.13/single-board-computers/rock64.md b/website/content/v0.13/single-board-computers/rock64.md deleted file mode 100644 index 27827e8ae..000000000 --- a/website/content/v0.13/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.13/single-board-computers/rockpi_4.md b/website/content/v0.13/single-board-computers/rockpi_4.md deleted file mode 100644 index f0f78b6a7..000000000 --- a/website/content/v0.13/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Boot Talos from an eMMC or SSD Drive - -> Note: this is only tested on Rock PI 4c - -It is possible to run Talos without any SD cards right from either an eMMC or SSD disk. - -The pre-installed SPI loader won't be able to chain Talos u-boot on the device because it's too outdated. - -Instead, it is necessary to update u-boot to a more recent version for this process to work. -The Armbian u-boot build for Rock PI 4c has been proved to work: [https://users.armbian.com/piter75/](https://users.armbian.com/piter75/). - -### Steps - -- Flash the Rock PI 4c variant of [Debian](https://wiki.radxa.com/Rockpi4/downloads) to the SD card. -- Check that /dev/mtdblock0 exists otherwise the command will silently fail; e.g. `lsblk`. -- Download Armbian u-boot and update SPI flash: - -```bash -curl -LO https://users.armbian.com/piter75/rkspi_loader-v20.11.2-trunk-v2.img -sudo dd if=rkspi_loader-v20.11.2-trunk-v2.img of=/dev/mtdblock0 bs=4K -``` - -- Optionally, you can also write Talos image to the SSD drive right from your Rock PI board: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -sudo dd if=metal-rockpi_4-arm64.img.xz of=/dev/nvme0n1 -``` - -- remove SD card and reboot. - -After these steps, Talos will boot from the SSD and enter maintenance mode. -The rest of the flow is the same as running Talos from the SD card. diff --git a/website/content/v0.13/single-board-computers/rpi_4.md b/website/content/v0.13/single-board-computers/rpi_4.md deleted file mode 100644 index c2bff5617..000000000 --- a/website/content/v0.13/single-board-computers/rpi_4.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and use [Raspberry Pi Imager](https://www.raspberrypi.org/software/) -to install the bootloader on it (select Operating System > Misc utility images > Bootloader > SD Card Boot). -Alternatively, you can use the console on Linux or macOS. -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -```bash -curl -Lo rpi-boot-eeprom-recovery.zip https://github.com/raspberrypi/rpi-eeprom/releases/download/v2021.04.29-138a1/rpi-boot-eeprom-recovery-2021-04-29-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0p1 /mnt -sudo bsdtar rpi-boot-eeprom-recovery.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached to the port closest to the power/USB-C port, -the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -> Note: if you have an HDMI display attached and it shows only a rainbow splash, -> please use the other HDMI port, the one closest to the power/USB-C port. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.13/virtualized-platforms/_index.md b/website/content/v0.13/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.13/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.13/virtualized-platforms/hyper-v.md b/website/content/v0.13/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.13/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.13/virtualized-platforms/kvm.md b/website/content/v0.13/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.13/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.13/virtualized-platforms/proxmox.md b/website/content/v0.13/virtualized-platforms/proxmox.md deleted file mode 100644 index 5e5d4e30e..000000000 --- a/website/content/v0.13/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.13.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.13.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". - -### With DHCP server - -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -### Without DHCP server - -To apply the machine configurations in maintenance mode, VM has to have IP on the network. -So you can set it on boot time manually. - - - -Press `e` on the boot time. -And set the IP parameters for the VM. -[Format is](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt): - -```bash -ip=:::::: -``` - -For example $CONTROL_PLANE_IP will be 192.168.0.100 and gateway 192.168.0.1 - -```bash -linux /boot/vmlinuz init_on_alloc=1 slab_nomerge pti=on panic=0 consoleblank=0 printk.devkmsg=on earlyprintk=ttyS0 console=tty0 console=ttyS0 talos.platform=metal ip=192.168.0.100::192.168.0.1:255.255.255.0::eth0:off -``` - - - -Then press Ctrl-x or F10 - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.13/virtualized-platforms/vmware.md b/website/content/v0.13/virtualized-platforms/vmware.md deleted file mode 100644 index 1b596da68..000000000 --- a/website/content/v0.13/virtualized-platforms/vmware.md +++ /dev/null @@ -1,214 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat controlplane.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.13/virtualized-platforms/xen.md b/website/content/v0.13/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.13/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.14/_index.md b/website/content/v0.14/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.14/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.14/bare-metal-platforms/_index.md b/website/content/v0.14/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.14/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.14/bare-metal-platforms/digital-rebar.md b/website/content/v0.14/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 41883fdf2..000000000 --- a/website/content/v0.14/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we assume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview](../overview). - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/bare-metal-platforms/equinix-metal.md b/website/content/v0.14/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index 993cd9704..000000000 --- a/website/content/v0.14/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the [Equinix Metal CLI](https://github.com/equinix/metal-cli/) installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `controlplane.yaml`, and `worker.yaml` -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config worker.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Control Plane Nodes - -```bash -metal device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -metal device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file worker.yaml -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/bare-metal-platforms/matchbox.md b/website/content/v0.14/bare-metal-platforms/matchbox.md deleted file mode 100644 index 89bc4e627..000000000 --- a/website/content/v0.14/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config worker.yaml --mode metal -worker.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `controlplane.yaml`, and `worker.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/worker.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/bare-metal-platforms/sidero.md b/website/content/v0.14/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.14/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.14/cloud-platforms/_index.md b/website/content/v0.14/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.14/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.14/cloud-platforms/aws.md b/website/content/v0.14/cloud-platforms/aws.md deleted file mode 100644 index 3e482d784..000000000 --- a/website/content/v0.14/cloud-platforms/aws.md +++ /dev/null @@ -1,267 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Official AMI Images - -Official AMI image ID can be found in the `cloud-images.json` file attached to the Talos release: - -```bash -curl -sL https://github.com/siderolabs/talos/releases/download/v0.14.0/cloud-images.json | \ - jq -r '.[] | select(.region == "us-east-1") | select (.arch == "amd64") | .id' -``` - -Replace `us-east-1` and `amd64` in the line above with the desired region and architecture. - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: --with-examples=false --with-docs=false -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -Take note that the generated configs are too long for AWS userdata field if the `--with-examples` and `--with-docs` flags are not passed. - -At this point, you can modify the generated configs to your liking. - -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 4 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://worker.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/cloud-platforms/azure.md b/website/content/v0.14/cloud-platforms/azure.md deleted file mode 100644 index fdbb52fad..000000000 --- a/website/content/v0.14/cloud-platforms/azure.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done - -# NOTES: -# Talos can detect PublicIPs automatically if PublicIP SKU is Basic. -# Use `--sku Basic` to set SKU to Basic. -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. -Azure allows you to pass Talos machine configuration to the virtual machine at bootstrap time via -`user-data` or `custom-data` methods. - -Talos supports only `custom-data` method, machine configuration is available to the VM only on the first boot. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create the controlplane nodes -for i in $( seq 0 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./worker.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/cloud-platforms/digitalocean.md b/website/content/v0.14/cloud-platforms/digitalocean.md deleted file mode 100644 index 832178e3f..000000000 --- a/website/content/v0.14/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-1 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file worker.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/cloud-platforms/gcp.md b/website/content/v0.14/cloud-platforms/gcp.md deleted file mode 100644 index 8b72afe8d..000000000 --- a/website/content/v0.14/cloud-platforms/gcp.md +++ /dev/null @@ -1,422 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -[jq](https://stedolan.github.io/jq/) and [talosctl](../../introduction/quickstart/#talosctl) also needs to be installed - -## Manual Setup - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -`130.211.0.0/22` and `35.191.0.0/16` are the GCP [Load Balancer IP ranges](https://cloud.google.com/load-balancing/docs/health-checks#fw-rule) - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create the control plane nodes. -for i in $( seq 1 3 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 3 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./worker.yaml -``` - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') -``` - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig talosconfig config node $CONTROL_PLANE_0_IP -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -### Cleanup - -```bash -# cleanup VM's -gcloud compute instances delete \ - talos-worker-0 \ - talos-controlplane-0 \ - talos-controlplane-1 \ - talos-controlplane-2 - -# cleanup firewall rules -gcloud compute firewall-rules delete \ - talos-controlplane-talosctl \ - talos-controlplane-firewall - -# cleanup forwarding rules -gcloud compute forwarding-rules delete \ - talos-fwd-rule - -# cleanup addresses -gcloud compute addresses delete \ - talos-lb-ip - -# cleanup proxies -gcloud compute target-tcp-proxies delete \ - talos-tcp-proxy - -# cleanup backend services -gcloud compute backend-services delete \ - talos-be - -# cleanup health checks -gcloud compute health-checks delete \ - talos-health-check - -# cleanup unmanaged instance groups -gcloud compute instance-groups unmanaged delete \ - talos-ig - -# cleanup Talos image -gcloud compute images delete \ - talos -``` - -## Using GCP Deployment manager - -Using GCP deployment manager automatically creates a Google Storage bucket and uploads the Talos image to it. -Once the deployment is complete the generated `talosconfig` and `kubeconfig` files are uploaded to the bucket. - -By default this setup creates a three node control plane and a single worker in `us-west1-b` - -First we need to create a folder to store our deployment manifests and perform all subsequent operations from that folder. - -```bash -mkdir -p talos-gcp-deployment -cd talos-gcp-deployment -``` - -### Getting the deployment manifests - -We need to download two deployment manifests for the deployment from the Talos github repository. - -```bash -curl -fsSLO "https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v0.14/Cloud%20Platforms/gcp/config.yaml" -curl -fsSLO "https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v0.14/Cloud%20Platforms/gcp/talos-ha.jinja" -# if using ccm -curl -fsSLO "https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v0.14/Cloud%20Platforms/gcp/gcp-ccm.yaml" -``` - -### Updating the config - -Now we need to update the local `config.yaml` file with any required changes such as changing the default zone, Talos version, machine sizes, nodes count etc. - -An example `config.yaml` file is shown below: - -```yaml -imports: - - path: talos-ha.jinja - -resources: - - name: talos-ha - type: talos-ha.jinja - properties: - zone: us-west1-b - talosVersion: {{< release >}} - externalCloudProvider: false - controlPlaneNodeCount: 5 - controlPlaneNodeType: n1-standard-1 - workerNodeCount: 3 - workerNodeType: n1-standard-1 -outputs: - - name: bucketName - value: $(ref.talos-ha.bucketName) -``` - -#### Enabling external cloud provider - -Note: The `externalCloudProvider` property is set to `false` by default. -The [manifest](https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v0.14/Cloud%20Platforms/gcp/gcp-ccm.yaml#L256) used for deploying the ccm (cloud controller manager) is currently using the GCP ccm provided by openshift since there are no public images for the [ccm](https://github.com/kubernetes/cloud-provider-gcp) yet. - -> Since the routes controller is disabled while deploying the CCM, the CNI pods needs to be restarted after the CCM deployment is complete to remove the `node.kubernetes.io/network-unavailable` taint. -See [Nodes network-unavailable taint not removed after installing ccm](https://github.com/kubernetes/cloud-provider-gcp/issues/291) for more information - -Use a custom built image for the ccm deployment if required. - -### Creating the deployment - -Now we are ready to create the deployment. -Confirm with `y` for any prompts. -Run the following command to create the deployment: - -```bash -# use a unique name for the deployment, resources are prefixed with the deployment name -export DEPLOYMENT_NAME="" -gcloud deployment-manager deployments create "${DEPLOYMENT_NAME}" --config config.yaml -``` - -### Retrieving the outputs - -First we need to get the deployment outputs. - -```bash -# first get the outputs -OUTPUTS=$(gcloud deployment-manager deployments describe "${DEPLOYMENT_NAME}" --format json | jq '.outputs[]') - -BUCKET_NAME=$(jq -r '. | select(.name == "bucketName").finalValue' <<< "${OUTPUTS}") -# used when cloud controller is enabled -SERVICE_ACCOUNT=$(jq -r '. | select(.name == "serviceAccount").finalValue' <<< "${OUTPUTS}") -PROJECT=$(jq -r '. | select(.name == "project").finalValue' <<< "${OUTPUTS}") -``` - -Note: If cloud controller manager is enabled, the below command needs to be run to allow the controller custom role to access cloud resources - -```bash -gcloud projects add-iam-policy-binding \ - "${PROJECT}" \ - --member "serviceAccount:${SERVICE_ACCOUNT}" \ - --role roles/iam.serviceAccountUser - -gcloud projects add-iam-policy-binding \ - "${PROJECT}" \ - --member serviceAccount:"${SERVICE_ACCOUNT}" \ - --role roles/compute.admin - -gcloud projects add-iam-policy-binding \ - "${PROJECT}" \ - --member serviceAccount:"${SERVICE_ACCOUNT}" \ - --role roles/compute.loadBalancerAdmin -``` - -### Downloading talos and kube config - -In addition to the `talosconfig` and `kubeconfig` files, the storage bucket contains the `controlplane.yaml` and `worker.yaml` files used to join additional nodes to the cluster. - -```bash -gsutil cp "gs://${BUCKET_NAME}/generated/talosconfig" . -gsutil cp "gs://${BUCKET_NAME}/generated/kubeconfig" . -``` - -### Deploying the cloud controller manager - -```bash -kubectl \ - --kubeconfig kubeconfig \ - --namespace kube-system \ - apply \ - --filename gcp-ccm.yaml -# wait for the ccm to be up -kubectl \ - --kubeconfig kubeconfig \ - --namespace kube-system \ - rollout status \ - daemonset cloud-controller-manager -``` - -If the cloud controller manager is enabled, we need to restart the CNI pods to remove the `node.kubernetes.io/network-unavailable` taint. - -```bash -# restart the CNI pods, in this case flannel -kubectl \ - --kubeconfig kubeconfig \ - --namespace kube-system \ - rollout restart \ - daemonset kube-flannel -# wait for the pods to be restarted -kubectl \ - --kubeconfig kubeconfig \ - --namespace kube-system \ - rollout status \ - daemonset kube-flannel -``` - -### Check cluster status - -```bash -kubectl \ - --kubeconfig kubeconfig \ - get nodes -``` - -### Cleanup deployment - -Warning: This will delete the deployment and all resources associated with it. - -Run below if cloud controller manager is enabled - -```bash -gcloud projects remove-iam-policy-binding \ - "${PROJECT}" \ - --member "serviceAccount:${SERVICE_ACCOUNT}" \ - --role roles/iam.serviceAccountUser - -gcloud projects remove-iam-policy-binding \ - "${PROJECT}" \ - --member serviceAccount:"${SERVICE_ACCOUNT}" \ - --role roles/compute.admin - -gcloud projects remove-iam-policy-binding \ - "${PROJECT}" \ - --member serviceAccount:"${SERVICE_ACCOUNT}" \ - --role roles/compute.loadBalancerAdmin -``` - -Now we can finally remove the deployment - -```bash -# delete the objects in the bucket first -gsutil -m rm -r "gs://${BUCKET_NAME}" -gcloud deployment-manager deployments delete "${DEPLOYMENT_NAME}" --quiet -``` diff --git a/website/content/v0.14/cloud-platforms/gcp/config.yaml b/website/content/v0.14/cloud-platforms/gcp/config.yaml deleted file mode 100644 index cfda2bc83..000000000 --- a/website/content/v0.14/cloud-platforms/gcp/config.yaml +++ /dev/null @@ -1,21 +0,0 @@ -imports: - - path: talos-ha.jinja - -resources: - - name: talos-ha - type: talos-ha.jinja - properties: - zone: us-west1-b - talosVersion: v0.13.3 - externalCloudProvider: false - controlPlaneNodeCount: 3 - controlPlaneNodeType: n1-standard-1 - workerNodeCount: 1 - workerNodeType: n1-standard-1 -outputs: - - name: bucketName - value: $(ref.talos-ha.bucketName) - - name: serviceAccount - value: $(ref.talos-ha.serviceAccount) - - name: project - value: $(ref.talos-ha.project) diff --git a/website/content/v0.14/cloud-platforms/gcp/gcp-ccm.yaml b/website/content/v0.14/cloud-platforms/gcp/gcp-ccm.yaml deleted file mode 100644 index 1694e876e..000000000 --- a/website/content/v0.14/cloud-platforms/gcp/gcp-ccm.yaml +++ /dev/null @@ -1,276 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cloud-controller-manager - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: system:cloud-provider -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - update -- apiGroups: - - "" - resources: - - services/status - verbs: - - patch - - update ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: system:cloud-provider -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:cloud-provider -subjects: -- kind: ServiceAccount - name: cloud-provider - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: system:cloud-controller-manager -rules: -- apiGroups: - - "" - - events.k8s.io - resources: - - events - verbs: - - create - - patch - - update -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create -- apiGroups: - - coordination.k8s.io - resourceNames: - - cloud-controller-manager - resources: - - leases - verbs: - - get - - update -- apiGroups: - - "" - resources: - - endpoints - - serviceaccounts - verbs: - - create - - get - - update -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - update -- apiGroups: - - "" - resources: - - namespaces - verbs: - - get -- apiGroups: - - "" - resources: - - nodes/status - verbs: - - patch - - update -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - get - - update -- apiGroups: - - "authentication.k8s.io" - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - "*" - resources: - - "*" - verbs: - - list - - watch -- apiGroups: - - "" - resources: - - serviceaccounts/token - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: system:controller:cloud-node-controller -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - update -- apiGroups: - - "" - resources: - - nodes - verbs: - - get - - list - - update - - delete - - patch -- apiGroups: - - "" - resources: - - nodes/status - verbs: - - get - - list - - update - - delete - - patch -- apiGroups: - - "" - resources: - - pods - verbs: - - list - - delete -- apiGroups: - - "" - resources: - - pods/status - verbs: - - list - - delete ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cloud-controller-manager:apiserver-authentication-reader - namespace: kube-system -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: extension-apiserver-authentication-reader -subjects: -- apiGroup: "" - kind: ServiceAccount - name: cloud-controller-manager - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: system:cloud-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:cloud-controller-manager -subjects: -- kind: ServiceAccount - name: cloud-controller-manager - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: system:controller:cloud-node-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:controller:cloud-node-controller -subjects: -- kind: ServiceAccount - name: cloud-node-controller - namespace: kube-system ---- -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cloud-controller-manager - namespace: kube-system - labels: - tier: control-plane - k8s-app: cloud-controller-manager -spec: - selector: - matchLabels: - k8s-app: cloud-controller-manager - updateStrategy: - type: RollingUpdate - template: - metadata: - labels: - tier: control-plane - k8s-app: cloud-controller-manager - spec: - nodeSelector: - node-role.kubernetes.io/master: "" - tolerations: - - key: node.cloudprovider.kubernetes.io/uninitialized - value: "true" - effect: NoSchedule - - key: node-role.kubernetes.io/master - effect: NoSchedule - securityContext: - seccompProfile: - type: RuntimeDefault - runAsUser: 65521 - runAsNonRoot: true - priorityClassName: system-node-critical - hostNetwork: true - serviceAccountName: cloud-controller-manager - containers: - - name: cloud-controller-manager - image: quay.io/openshift/origin-gcp-cloud-controller-manager:4.10.0 - resources: - requests: - cpu: 50m - command: - - /bin/gcp-cloud-controller-manager - args: - - --bind-address=127.0.0.1 - - --cloud-provider=gce - - --use-service-account-credentials - - --configure-cloud-routes=false - - --allocate-node-cidrs=false - - --controllers=*,-nodeipam - livenessProbe: - httpGet: - host: 127.0.0.1 - port: 10258 - path: /healthz - scheme: HTTPS - initialDelaySeconds: 15 - timeoutSeconds: 15 diff --git a/website/content/v0.14/cloud-platforms/gcp/talos-ha.jinja b/website/content/v0.14/cloud-platforms/gcp/talos-ha.jinja deleted file mode 100644 index afd1fba08..000000000 --- a/website/content/v0.14/cloud-platforms/gcp/talos-ha.jinja +++ /dev/null @@ -1,282 +0,0 @@ -resources: -- type: storage.v1.bucket - name: {{ env["deployment"] }}-talos-assets -- name: create-talos-artifact - action: gcp-types/cloudbuild-v1:cloudbuild.projects.builds.create - metadata: - runtimePolicy: - - CREATE - properties: - steps: - - name: gcr.io/cloud-builders/curl - args: - - -fSLO - - https://github.com/siderolabs/talos/releases/download/{{ properties["talosVersion"] }}/gcp-amd64.tar.gz - - name: gcr.io/cloud-builders/gsutil - args: - - -m - - cp - - gcp-amd64.tar.gz - - gs://$(ref.{{ env["deployment"] }}-talos-assets.name)/gcp-amd64.tar.gz - timeout: 120s -- type: compute.v1.image - name: {{ env["deployment"] }}-talos-image - metadata: - dependsOn: - - create-talos-artifact - properties: - rawDisk: - source: https://storage.cloud.google.com/$(ref.{{ env["deployment"] }}-talos-assets.name)/gcp-amd64.tar.gz - sourceType: RAW - description: Talos image - family: talos -- type: compute.v1.instanceGroup - name: {{ env["deployment"] }}-talos-ig - properties: - zone: {{ properties["zone"] }} - description: Talos instance group - namedPorts: - - name: tcp6443 - port: 6443 -- type: compute.v1.healthCheck - name: {{ env["deployment"] }}-talos-healthcheck - properties: - description: Talos health check - type: TCP - tcpHealthCheck: - port: 6443 -- type: compute.v1.backendService - name: {{ env["deployment"] }}-talos-backend - properties: - description: Talos backend service - protocol: TCP - healthChecks: - - $(ref.{{ env["deployment"] }}-talos-healthcheck.selfLink) - timeoutSec: 300 - backends: - - description: Talos backend - group: $(ref.{{ env["deployment"] }}-talos-ig.selfLink) - portName: tcp6443 -- type: compute.v1.targetTcpProxy - name: {{ env["deployment"] }}-talos-tcp-proxy - properties: - description: Talos TCP proxy - service: $(ref.{{ env["deployment"] }}-talos-backend.selfLink) - proxyHeader: NONE -- type: compute.v1.globalAddress - name: {{ env["deployment"] }}-talos-lb-ip - properties: - description: Talos LoadBalancer IP -- type: compute.v1.globalForwardingRule - name: talos-fwd-rule - properties: - description: Talos Forwarding rule - target: $(ref.{{ env["deployment"] }}-talos-tcp-proxy.selfLink) - IPAddress: $(ref.{{ env["deployment"] }}-talos-lb-ip.address) - IPProtocol: TCP - portRange: 443 -- type: compute.v1.firewall - name: {{ env["deployment"] }}-talos-controlplane-firewall - properties: - description: Talos controlplane firewall - sourceRanges: - - 130.211.0.0/22 - - 35.191.0.0/16 - targetTags: - - talos-controlplane - allowed: - - IPProtocol: TCP - ports: - - 6443 -- type: compute.v1.firewall - name: {{ env["deployment"] }}-talos-controlplane-talosctl - properties: - description: Talos controlplane talosctl firewall - sourceRanges: - - 0.0.0.0/0 - targetTags: - - talos-controlplane - - talos-workers - allowed: - - IPProtocol: TCP - ports: - - 50000 -{% if properties["externalCloudProvider"] %} -- type: gcp-types/iam-v1:projects.serviceAccounts - name: {{ env["deployment"] }}-ccm-sa - properties: - displayName: Cloud Controller Manager - accountId: {{ env["deployment"] }}-ccm-sa -{% endif %} -{% for index in range(properties["controlPlaneNodeCount"]) %} -- type: compute.v1.instance - name: {{ env["deployment"] }}-talos-controlplane-{{ index }} - properties: - zone: {{ properties["zone"] }} - machineType: zones/{{ properties["zone"] }}/machineTypes/{{ properties["controlPlaneNodeType"] }} -{% if properties["externalCloudProvider"] %} - serviceAccounts: - - email: $(ref.{{ env["deployment"] }}-ccm-sa.email) - scopes: - - https://www.googleapis.com/auth/compute -{% endif %} - tags: - items: - - talos-controlplane - - {{ env["deployment"] }}-talos-controlplane-{{ index }} # required for cloud controller-manager - disks: - - deviceName: boot - type: PERSISTENT - boot: true - autoDelete: true - initializeParams: - diskSizeGb: 20 - sourceImage: $(ref.{{ env["deployment"] }}-talos-image.selfLink) - networkInterfaces: - - network: global/networks/default - accessConfigs: - - name: External NAT - type: ONE_TO_ONE_NAT -{% endfor %} -{% for index in range(properties["workerNodeCount"]) %} -- type: compute.v1.instance - name: {{ env["deployment"] }}-talos-worker-{{ index }} - properties: - zone: {{ properties["zone"] }} - machineType: zones/{{ properties["zone"] }}/machineTypes/{{ properties["workerNodeType"] }} -{% if properties["externalCloudProvider"] %} - serviceAccounts: - - email: $(ref.{{ env["deployment"] }}-ccm-sa.email) - scopes: - - https://www.googleapis.com/auth/compute -{% endif %} - tags: - items: - - talos-workers - - {{ env["deployment"] }}-talos-worker-{{ index }} # required for cloud controller-manager - disks: - - deviceName: boot - type: PERSISTENT - boot: true - autoDelete: true - initializeParams: - diskSizeGb: 20 - sourceImage: $(ref.{{ env["deployment"] }}-talos-image.selfLink) - networkInterfaces: - - network: global/networks/default - accessConfigs: - - name: External NAT - type: ONE_TO_ONE_NAT -{% endfor %} -- name: {{ env["deployment"] }}-talos-ig-members - action: gcp-types/compute-v1:compute.instanceGroups.addInstances - properties: - zone: {{ properties["zone"] }} - instanceGroup: $(ref.{{ env["deployment"] }}-talos-ig.name) - instances: -{% for index in range(properties["controlPlaneNodeCount"]) %} - - instance: $(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.selfLink) -{% endfor %} -- name: generate-config-and-bootstrap - action: gcp-types/cloudbuild-v1:cloudbuild.projects.builds.create - metadata: - runtimePolicy: - - CREATE - properties: - steps: - - name: gcr.io/cloud-builders/curl - args: - - -fSLO - - https://github.com/siderolabs/talos/releases/download/{{ properties["talosVersion"] }}/talosctl-linux-amd64 - - name: alpine - args: - - /bin/sh - - -ec - - | - chmod +x talosctl-linux-amd64 && \ - mv talosctl-linux-amd64 /usr/local/bin/talosctl && \ - mkdir -p generated && \ - talosctl gen config \ - {{ env["deployment"] }} \ - https://$(ref.{{ env["deployment"] }}-talos-lb-ip.address):443 \ - {% if properties["externalCloudProvider"] %} --config-patch '[{"op": "add", "path": "/cluster/externalCloudProvider", "value": {"enabled": true}}]' \{% endif %} - --output-dir generated/ && \ -{% for index in range(properties["controlPlaneNodeCount"]) %} - echo "applying config for {{ env["deployment"] }}-talos-controlplane-{{ index }}" && \ - talosctl apply-config \ - --insecure \ - --nodes $(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --file generated/controlplane.yaml && \ -{% endfor %} -{% for index in range(properties["workerNodeCount"]) %} - echo "applying config for {{ env["deployment"] }}-talos-worker-{{ index }}" && \ - talosctl apply-config \ - --insecure \ - --nodes $(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --file generated/worker.yaml && \ -{% endfor %} - # wait before bootstrapping - wait_count=120 - until nc -vzw 3 $(ref.{{ env["deployment"] }}-talos-controlplane-0.networkInterfaces[0].accessConfigs[0].natIP) 50000; do - echo "Waiting for talos-controlplane-0 to be ready for bootstrap" - wait_count=$((wait_count=wait_count-1)) - if [ "${wait_count}" -eq 0 ]; then - echo "Timeout waiting for talos-controlplane-0 to be ready for bootstrap" - # if failed just reset -{% for index in range(properties["controlPlaneNodeCount"]) %} - echo "resetting config for {{ env["deployment"] }}-talos-controlplane-{{ index }}" && \ - talosctl reset \ - --talosconfig generated/talosconfig\ - --nodes $(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --graceful=false \ - --system-labels-to-wipe SYSTEM \ - --system-labels-to-wipe EPHEMERAL && \ -{% endfor %} -{% for index in range(properties["workerNodeCount"]) %} - talosctl reset \ - --talosconfig generated/talosconfig\ - --nodes $(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP) \ - --graceful=false \ - --system-labels-to-wipe SYSTEM \ - --system-labels-to-wipe EPHEMERAL && \ -{% endfor %} - exit 1 - fi - done && \ - talosctl \ - --talosconfig generated/talosconfig \ - --nodes $(ref.{{ env["deployment"] }}-talos-controlplane-0.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-controlplane-0.networkInterfaces[0].accessConfigs[0].natIP) \ - bootstrap && \ - talosctl \ - --talosconfig generated/talosconfig \ - --nodes $(ref.{{ env["deployment"] }}-talos-controlplane-0.networkInterfaces[0].accessConfigs[0].natIP) \ - --endpoints $(ref.{{ env["deployment"] }}-talos-controlplane-0.networkInterfaces[0].accessConfigs[0].natIP) \ - kubeconfig generated/ && \ - talosctl \ - --talosconfig generated/talosconfig \ - config endpoint \ - {% for index in range(properties["controlPlaneNodeCount"]) %}$(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP){% if not loop.last %} {% endif %}{% endfor %} {% for index in range(properties["workerNodeCount"]) %}$(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP){% if not loop.last %} {% endif %}{% endfor %} && \ - talosctl \ - --talosconfig generated/talosconfig \ - config node \ - {% for index in range(properties["controlPlaneNodeCount"]) %}$(ref.{{ env["deployment"] }}-talos-controlplane-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP){% if not loop.last %} {% endif %}{% endfor %} {% for index in range(properties["workerNodeCount"]) %}$(ref.{{ env["deployment"] }}-talos-worker-{{ index }}.networkInterfaces[0].accessConfigs[0].natIP){% if not loop.last %} {% endif %}{% endfor %} - - name: gcr.io/cloud-builders/gsutil - args: - - -m - - cp - - -r - - generated - - gs://$(ref.{{ env["deployment"] }}-talos-assets.name)/ - timeout: 360s -outputs: -- name: bucketName - value: $(ref.{{ env["deployment"] }}-talos-assets.name) -- name: serviceAccount - value: $(ref.{{ env["deployment"] }}-ccm-sa.email) -- name: project - value: {{ env["project"] }} diff --git a/website/content/v0.14/cloud-platforms/hetzner.md b/website/content/v0.14/cloud-platforms/hetzner.md deleted file mode 100644 index 69a026bdb..000000000 --- a/website/content/v0.14/cloud-platforms/hetzner.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: "Hetzner" -description: "Creating a cluster via the CLI (hcloud) on Hetzner." ---- - -## Upload image - -Hetzner Cloud does not support uploading custom images. -You can email their support to get a Talos ISO uploaded by following [issues:3599](https://github.com/talos-systems/talos/issues/3599#issuecomment-841172018) or you can prepare image snapshot by yourself. - -There are two options to upload your own. - -1. Run an instance in rescue mode and replace the system OS with the Talos image -2. Use [Hashicorp packer](https://www.packer.io/docs/builders/hetzner-cloud) to prepare an image - -### Rescue mode - -Create a new Server in the Hetzner console. -Enable the Hetzner Rescue System for this server and reboot. -Upon a reboot, the server will boot a special minimal Linux distribution designed for repair and reinstall. -Once running, login to the server using ```ssh``` to prepare the system disk by doing the following: - -```bash -# Check that you in Rescue mode -df - -### Result is like: -# udev 987432 0 987432 0% /dev -# 213.133.99.101:/nfs 308577696 247015616 45817536 85% /root/.oldroot/nfs -# overlay 995672 8340 987332 1% / -# tmpfs 995672 0 995672 0% /dev/shm -# tmpfs 398272 572 397700 1% /run -# tmpfs 5120 0 5120 0% /run/lock -# tmpfs 199132 0 199132 0% /run/user/0 - -# Download the Talos image -cd /tmp -wget -O /tmp/talos.raw.xz https://github.com/siderolabs/talos/releases/download/v0.13.0/hcloud-amd64.raw.xz -# Replace system -xz -d -c /tmp/talos.raw.xz | dd of=/dev/sda && sync -# shutdown the instance -shutdown -h now -``` - -To make sure disk content is consistent, it is recommended to shut the server down before taking an image (snapshot). -Once shutdown, simply create an image (snapshot) from the console. -You can now use this snapshot to run Talos on the cloud. - -### Packer - -Install [packer](https://learn.hashicorp.com/tutorials/packer/get-started-install-cli) to the local machine. - -Create a config file for packer to use: - -```hcl -# hcloud.pkr.hcl - -packer { - required_plugins { - hcloud = { - version = ">= 1.0.0" - source = "github.com/hashicorp/hcloud" - } - } -} - -variable "talos_version" { - type = string - default = "v0.13.0" -} - -locals { - image = "https://github.com/siderolabs/talos/releases/download/${var.talos_version}/hcloud-amd64.raw.xz" -} - -source "hcloud" "talos" { - rescue = "linux64" - image = "debian-11" - location = "hel1" - server_type = "cx11" - ssh_username = "root" - - snapshot_name = "talos system disk" - snapshot_labels = { - type = "infra", - os = "talos", - version = "${var.talos_version}", - } -} - -build { - sources = ["source.hcloud.talos"] - - provisioner "shell" { - inline = [ - "apt-get install -y wget", - "wget -O /tmp/talos.raw.xz ${local.image}", - "xz -d -c /tmp/talos.raw.xz | dd of=/dev/sda && sync", - ] - } -} -``` - -Create a new image by issuing the commands shown below. -Note that to create a new API token for your Project, switch into the Hetzner Cloud Console choose a Project, go to Access → Security, and create a new token. - -```bash -# First you need set API Token -export HCLOUD_TOKEN=${TOKEN} - -# Upload image -packer init . -packer build . -# Save the image ID -export IMAGE_ID= -``` - -After doing this, you can find the snapshot in the console interface. - -## Creating a Cluster via the CLI - -This section assumes you have the [hcloud console utility](https://community.hetzner.com/tutorials/howto-hcloud-cli) on your local machine. - -```bash -# Set hcloud context and api key -hcloud context create talos-tutorial -``` - -### Create a Load Balancer - -Create a load balancer by issuing the commands shown below. -Save the IP/DNS name, as this info will be used in the next step. - -```bash -hcloud load-balancer create --name controlplane --network-zone eu-central --type lb11 --label 'type=controlplane' - -### Result is like: -# LoadBalancer 484487 created -# IPv4: 49.12.X.X -# IPv6: 2a01:4f8:X:X::1 - -hcloud load-balancer add-service controlplane \ - --listen-port 6443 --destination-port 6443 --protocol tcp -hcloud load-balancer add-target controlplane \ - --label-selector 'type=controlplane' -``` - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the IP/DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines by issuing: - -```bash -$ talosctl gen config talos-k8s-hcloud-tutorial https://:6443 -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatches which will be applied during the config generation. - -#### Validate the Configuration Files - -Validate any edited machine configs with: - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -### Create the Servers - -We can now create our servers. -Note that you can find ```IMAGE_ID``` in the snapshot section of the console: ```https://console.hetzner.cloud/projects/$PROJECT_ID/servers/snapshots```. - -#### Create the Control Plane Nodes - -Create the control plane nodes with: - -```bash -export IMAGE_ID= - -hcloud server create --name talos-control-plane-1 \ - --image ${IMAGE_ID} \ - --type cx21 --location hel1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml - -hcloud server create --name talos-control-plane-2 \ - --image ${IMAGE_ID} \ - --type cx21 --location fsn1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml - -hcloud server create --name talos-control-plane-3 \ - --image ${IMAGE_ID} \ - --type cx21 --location nbg1 \ - --label 'type=controlplane' \ - --user-data-from-file controlplane.yaml -``` - -#### Create the Worker Nodes - -Create the worker nodes with the following command, repeating (and incrementing the name counter) as many times as desired. - -```bash -hcloud server create --name talos-worker-1 \ - --image ${IMAGE_ID} \ - --type cx21 --location hel1 \ - --label 'type=worker' \ - --user-data-from-file worker.yaml -``` - -### Bootstrap Etcd - -To configure `talosctl` we will need the first control plane node's IP. -This can be found by issuing: - -```bash -hcloud server list | grep talos-control-plane -``` - -Set the `endpoints` and `nodes` for your talosconfig with: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd` on the first control plane node with: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/cloud-platforms/nocloud.md b/website/content/v0.14/cloud-platforms/nocloud.md deleted file mode 100644 index 3d0fa0788..000000000 --- a/website/content/v0.14/cloud-platforms/nocloud.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: "Nocloud" -description: "Creating a cluster via the CLI using qemu." ---- - -Talos supports [nocloud](https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html) data source implementation. - -There are two ways to configure Talos server with `nocloud` platform: - -* via SMBIOS "serial number" option -* using CDROM or USB-flash filesystem - -### SMBIOS Serial Number - -This method requires the network connection to be up (e.g. via DHCP). -Configuration is delivered from the HTTP server. - -```text -ds=nocloud-net;s=http://10.10.0.1/configs/;h=HOSTNAME -``` - -After the network initialization is complete, Talos fetches: - -* the machine config from `http://10.10.0.1/configs/user-data` -* the network config (if available) from `http://10.10.0.1/configs/network-config` - -#### SMBIOS: QEMU - -Add the following flag to `qemu` command line when starting a VM: - -```bash -qemu-system-x86_64 \ - ...\ - -smbios type=1,serial=ds=nocloud-net;s=http://10.10.0.1/configs/ -``` - -#### SMBIOS: Proxmox - -Set the source machine config through the serial number on Proxmox GUI. - - - -The Proxmox stores the VM config at `/etc/pve/qemu-server/$ID.conf` (```$ID``` - VM ID number of virtual machine), you will see something like: - -```conf -... -smbios1: uuid=ceae4d10,serial=ZHM9bm9jbG91ZC1uZXQ7cz1odHRwOi8vMTAuMTAuMC4xL2NvbmZpZ3Mv,base64=1 -... -``` - -Where serial holds the base64-encoded string version of `ds=nocloud-net;s=http://10.10.0.1/configs/`. - -### CDROM/USB - -Talos can also get machine config from local attached storage without any prior network connection being established. - -You can provide configs to the server via files on a VFAT or ISO9660 filesystem. -The filesystem volume label must be ```cidata``` or ```CIDATA```. - -#### Example: QEMU - -Create and prepare Talos machine config: - -```bash -export CONTROL_PLANE_IP=192.168.1.10 - -talosctl gen config talos-nocloud https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -Prepare cloud-init configs: - -```bash -mkdir -p iso -mv _out/controlplane.yaml iso/user-data -echo "local-hostname: controlplane-1" > iso/meta-data -cat > iso/network-config << EOF -version: 1 -config: - - type: physical - name: eth0 - mac_address: "52:54:00:12:34:00" - subnets: - - type: static - address: 192.168.1.10 - netmask: 255.255.255.0 - gateway: 192.168.1.254 -EOF -``` - -Create cloud-init iso image - -```bash -cd iso && genisoimage -output cidata.iso -V cidata -r -J user-data meta-data network-config -``` - -Start the VM - -```bash -qemu-system-x86_64 \ - ... - -cdrom iso/cidata.iso \ - ... -``` - -#### Example: Proxmox - -Proxmox can create cloud-init disk [for you](https://pve.proxmox.com/wiki/Cloud-Init_Support). -Edit the cloud-init config information in Proxmox as follows, substitute your own information as necessary: - - - -and then update ```cicustom``` param at `/etc/pve/qemu-server/$ID.conf`. - -```config -cicustom: user=local:snippets/master-1.yml -ipconfig0: ip=192.168.1.10/24,gw=192.168.10.254 -nameserver: 1.1.1.1 -searchdomain: local -``` - -> Note: `snippets/master-1.yml` is Talos machine config. -It is usually located at `/var/lib/vz/snippets/master-1.yml`. -This file must be placed to this path manually, as Proxmox does not support snippet uploading via API/GUI. - -Click on `Regenerate Image` button after the above changes are made. diff --git a/website/content/v0.14/cloud-platforms/openstack.md b/website/content/v0.14/cloud-platforms/openstack.md deleted file mode 100644 index b60f66b6d..000000000 --- a/website/content/v0.14/cloud-platforms/openstack.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 1 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/worker.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Bootstrap Etcd - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.14/cloud-platforms/scaleway.md b/website/content/v0.14/cloud-platforms/scaleway.md deleted file mode 100644 index c80795482..000000000 --- a/website/content/v0.14/cloud-platforms/scaleway.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Scaleway" -description: "Creating a cluster via the CLI (scw) on scaleway.com." ---- - -Talos is known to work on scaleway.com; however, it is currently undocumented. diff --git a/website/content/v0.14/cloud-platforms/upcloud.md b/website/content/v0.14/cloud-platforms/upcloud.md deleted file mode 100644 index 588e8c72d..000000000 --- a/website/content/v0.14/cloud-platforms/upcloud.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "UpCloud" -description: "Creating a cluster via the CLI (upctl) on UpCloud.com." ---- - -Talos is known to work on UpCloud.com; however, it is currently undocumented. diff --git a/website/content/v0.14/cloud-platforms/vultr.md b/website/content/v0.14/cloud-platforms/vultr.md deleted file mode 100644 index 51352d934..000000000 --- a/website/content/v0.14/cloud-platforms/vultr.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Vultr" -description: "Creating a cluster via the CLI (vultr-cli) on Vultr.com." ---- - -Talos is known to work on Vultr.com; however, it is currently undocumented. diff --git a/website/content/v0.14/guides/_index.md b/website/content/v0.14/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.14/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.14/guides/adding-a-proprietary-kernel-module.md b/website/content/v0.14/guides/adding-a-proprietary-kernel-module.md deleted file mode 100644 index da46ba82e..000000000 --- a/website/content/v0.14/guides/adding-a-proprietary-kernel-module.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: "Adding a proprietary kernel module to Talos Linux" -description: "" ---- - -1. Patching and building the kernel image - 1. Clone the `pkgs` repository from Github and check out the revision corresponding to your version of Talos Linux - - ```bash - git clone https://github.com/talos-systems/pkgs pkgs && cd pkgs - git checkout v0.8.0 - ``` - - 2. Clone the Linux kernel and check out the revision that pkgs uses (this can be found in `kernel/kernel-prepare/pkg.yaml` and it will be something like the following: `https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-x.xx.x.tar.xz`) - - ```bash - git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git && cd linux - git checkout v5.15 - ``` - - 3. Your module will need to be converted to be in-tree. - The steps for this are different depending on the complexity of the module to port, but generally it would involve moving the module source code into the `drivers` tree and creating a new Makefile and Kconfig. - 4. Stage your changes in Git with `git add -A`. - 5. Run `git diff --cached --no-prefix > foobar.patch` to generate a patch from your changes. - 6. Copy this patch to `kernel/kernel/patches` in the `pkgs` repo. - 7. Add a `patch` line in the `prepare` segment of `kernel/kernel/pkg.yaml`: - - ```bash - patch -p0 < /pkg/patches/foobar.patch - ``` - - 8. Build the kernel image. - Make sure you are logged in to `ghcr.io` before running this command, and you can change or omit `PLATFORM` depending on what you want to target. - - ```bash - make kernel PLATFORM=linux/amd64 USERNAME=your-username PUSH=true - ``` - - 9. Make a note of the image name the `make` command outputs. -2. Building the installer image - 1. Copy the following into a new `Dockerfile`: - - ```dockerfile - FROM scratch AS customization - COPY --from=ghcr.io/your-username/kernel: /lib/modules /lib/modules - - FROM ghcr.io/talos-systems/installer: - COPY --from=ghcr.io/your-username/kernel: /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz - ``` - - 2. Run to build and push the installer: - - ```bash - INSTALLER_VERSION= - IMAGE_NAME="ghcr.io/your-username/talos-installer:$INSTALLER_VERSION" - DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t "$IMAGE_NAME" . && docker push "$IMAGE_NAME" - ``` - -3. Deploying to your cluster - - ```bash - talosctl upgrade --image ghcr.io/your-username/talos-installer: --preserve=true - ``` diff --git a/website/content/v0.14/guides/advanced-networking.md b/website/content/v0.14/guides/advanced-networking.md deleted file mode 100644 index 8361db677..000000000 --- a/website/content/v0.14/guides/advanced-networking.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - addresses: - - 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo - addresses: - - 192.168.0.21/24 - - 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - addresses: - - "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.14/guides/air-gapped.md b/website/content/v0.14/guides/air-gapped.md deleted file mode 100644 index d66763ea0..000000000 --- a/website/content/v0.14/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.14.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.14/guides/configuring-ceph-with-rook.md b/website/content/v0.14/guides/configuring-ceph-with-rook.md deleted file mode 100644 index 2fb159bfa..000000000 --- a/website/content/v0.14/guides/configuring-ceph-with-rook.md +++ /dev/null @@ -1,278 +0,0 @@ ---- -title: "Configuring Ceph with Rook" -description: "" ---- - -## Preparation - -Talos Linux reserves an entire disk for the OS installation, so machines with multiple available disks are needed for a reliable Ceph cluster with Rook and Talos Linux. -Rook requires that the block devices or partitions used by Ceph have no partitions or formatted filesystems before use. -Rook also requires a minimum Kubernetes version of `v1.16` and Helm `v3.0` for installation of charts. -It is highly recommended that the [Rook Ceph overview](https://rook.io/docs/rook/v1.8/ceph-storage.html) is read and understood before deploying a Ceph cluster with Rook. - -## Installation - -Creating a Ceph cluster with Rook requires two steps; first the Rook Operator needs to be installed which can be done with a Helm Chart. -The example below installs the Rook Operator into the `rook-ceph` namespace, which is the default for a Ceph cluster with Rook. - -```shell -$ helm repo add rook-release https://charts.rook.io/release -"rook-release" has been added to your repositories - -$ helm install --create-namespace --namespace rook-ceph rook-ceph rook-release/rook-ceph -W0327 17:52:44.277830 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -W0327 17:52:44.612243 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -NAME: rook-ceph -LAST DEPLOYED: Sun Mar 27 17:52:42 2022 -NAMESPACE: rook-ceph -STATUS: deployed -REVISION: 1 -TEST SUITE: None -NOTES: -The Rook Operator has been installed. Check its status by running: - kubectl --namespace rook-ceph get pods -l "app=rook-ceph-operator" - -Visit https://rook.io/docs/rook/latest for instructions on how to create and configure Rook clusters - -Important Notes: -- You must customize the 'CephCluster' resource in the sample manifests for your cluster. -- Each CephCluster must be deployed to its own namespace, the samples use `rook-ceph` for the namespace. -- The sample manifests assume you also installed the rook-ceph operator in the `rook-ceph` namespace. -- The helm chart includes all the RBAC required to create a CephCluster CRD in the same namespace. -- Any disk devices you add to the cluster in the 'CephCluster' must be empty (no filesystem and no partitions). -``` - -Once that is complete, the Ceph cluster can be installed with the official Helm Chart. -The Chart can be installed with default values, which will attempt to use all nodes in the Kubernetes cluster, and all unused disks on each node for Ceph storage, and make available block storage, object storage, as well as a shared filesystem. -Generally more specific node/device/cluster configuration is used, and the [Rook documentation](https://rook.io/docs/rook/v1.8/ceph-cluster-crd.html) explains all the available options in detail. -For this example the defaults will be adequate. - -```shell -$ helm install --create-namespace --namespace rook-ceph rook-ceph-cluster --set operatorNamespace=rook-ceph rook-release/rook-ceph-cluster -NAME: rook-ceph-cluster -LAST DEPLOYED: Sun Mar 27 18:12:46 2022 -NAMESPACE: rook-ceph -STATUS: deployed -REVISION: 1 -TEST SUITE: None -NOTES: -The Ceph Cluster has been installed. Check its status by running: - kubectl --namespace rook-ceph get cephcluster - -Visit https://rook.github.io/docs/rook/latest/ceph-cluster-crd.html for more information about the Ceph CRD. - -Important Notes: -- You can only deploy a single cluster per namespace -- If you wish to delete this cluster and start fresh, you will also have to wipe the OSD disks using `sfdisk` -``` - -Now the Ceph cluster configuration has been created, the Rook operator needs time to install the Ceph cluster and bring all the components online. -The progression of the Ceph cluster state can be followed with the following command. - -```shell -$ watch kubectl --namespace rook-ceph get cephcluster rook-ceph -Every 2.0s: kubectl --namespace rook-ceph get cephcluster rook-ceph - -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 57s Progressing Configuring Ceph Mons -``` - -Depending on the size of the Ceph cluster and the availability of resources the Ceph cluster should become available, and with it the storage classes that can be used with Kubernetes Physical Volumes. - -```shell -$ kubectl --namespace rook-ceph get cephcluster rook-ceph -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 40m Ready Cluster created successfully HEALTH_OK - -$ kubectl get storageclass -NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE -ceph-block (default) rook-ceph.rbd.csi.ceph.com Delete Immediate true 77m -ceph-bucket rook-ceph.ceph.rook.io/bucket Delete Immediate false 77m -ceph-filesystem rook-ceph.cephfs.csi.ceph.com Delete Immediate true 77m -``` - -## Talos Linux Considerations - -It is important to note that a Rook Ceph cluster saves cluster information directly onto the node (be default `dataDirHostPath` is set to `/var/lib/rook`) which under Talos Linux is **ephemeral**. -This makes cluster management a little bit more involved, as any time a Talos Linux node is reconfigured or upgraded, the ephemeral partition is wiped. - -When performing maintenance on a Talos Linux node with a Rook Ceph cluster, it is imperative that care be taken to maintain the health of the Ceph cluster, for instance when upgrading the Talos Linux version. -Before upgrading, you should always check the health status of the Ceph cluster to ensure that it is healthy. - -```shell -$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io rook-ceph -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 98m Ready Cluster created successfully HEALTH_OK -``` - -If it is, you can begin the upgrade process for the Talos Linux node, during which time the Ceph cluster will become unhealthy as the node is reconfigured. -Before performing any other action on the Talos Linux nodes, the Ceph cluster must return to a healthy status. - -```shell -$ talosctl upgrade --nodes 172.20.15.5 --image ghcr.io/talos-systems/installer:v0.14.3 -NODE ACK STARTED -172.20.15.5 Upgrade request received 2022-03-27 20:29:55.292432887 +0200 CEST m=+10.050399758 - -$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 99m Progressing Configuring Ceph Mgr(s) HEALTH_WARN - -$ kubectl --namespace rook-ceph wait --timeout=1800s --for=jsonpath='{.status.ceph.health}=HEALTH_OK' rook-ceph -cephcluster.ceph.rook.io/rook-ceph condition met -``` - -The above steps need to be performed for each Talos Linux node undergoing maintenance, one at a time. - -## Cleaning Up - -### Rook Ceph Cluster Removal - -Removing a Rook Ceph cluster requires a few steps, starting with signalling to Rook that the Ceph cluster is really being destroyed. -Then all Persistent Volumes (and Claims) backed by the Ceph cluster must be deleted, followed by the Storage Classes and the Ceph storage types. - -```shell -$ kubectl --namespace rook-ceph patch cephcluster rook-ceph --type merge -p '{"spec":{"cleanupPolicy":{"confirmation":"yes-really-destroy-data"}}}' -cephcluster.ceph.rook.io/rook-ceph patched - -$ kubectl delete storageclasses ceph-block ceph-bucket ceph-filesystem -storageclass.storage.k8s.io "ceph-block" deleted -storageclass.storage.k8s.io "ceph-bucket" deleted -storageclass.storage.k8s.io "ceph-filesystem" deleted - -$ kubectl --namespace rook-ceph delete cephblockpools ceph-blockpool -cephblockpool.ceph.rook.io "ceph-blockpool" deleted - -$ kubectl --namespace rook-ceph delete cephobjectstore ceph-objectstore -cephobjectstore.ceph.rook.io "ceph-objectstore" deleted - -$ kubectl --namespace rook-ceph delete cephfilesystem ceph-filesystem -cephfilesystem.ceph.rook.io "ceph-filesystem" deleted -``` - -Once that is complete, the Ceph cluster itself can be removed, along with the Rook Ceph cluster Helm chart installation. - -```shell -$ kubectl --namespace rook-ceph delete cephcluster rook-ceph -cephcluster.ceph.rook.io "rook-ceph" deleted - -$ helm --namespace rook-ceph uninstall rook-ceph-cluster -release "rook-ceph-cluster" uninstalled -``` - -If needed, the Rook Operator can also be removed along with all the Custom Resource Definitions that it created. - -```shell -$ helm --namespace rook-ceph uninstall rook-ceph -W0328 12:41:14.998307 147203 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -These resources were kept due to the resource policy: -[CustomResourceDefinition] cephblockpools.ceph.rook.io -[CustomResourceDefinition] cephbucketnotifications.ceph.rook.io -[CustomResourceDefinition] cephbuckettopics.ceph.rook.io -[CustomResourceDefinition] cephclients.ceph.rook.io -[CustomResourceDefinition] cephclusters.ceph.rook.io -[CustomResourceDefinition] cephfilesystemmirrors.ceph.rook.io -[CustomResourceDefinition] cephfilesystems.ceph.rook.io -[CustomResourceDefinition] cephfilesystemsubvolumegroups.ceph.rook.io -[CustomResourceDefinition] cephnfses.ceph.rook.io -[CustomResourceDefinition] cephobjectrealms.ceph.rook.io -[CustomResourceDefinition] cephobjectstores.ceph.rook.io -[CustomResourceDefinition] cephobjectstoreusers.ceph.rook.io -[CustomResourceDefinition] cephobjectzonegroups.ceph.rook.io -[CustomResourceDefinition] cephobjectzones.ceph.rook.io -[CustomResourceDefinition] cephrbdmirrors.ceph.rook.io -[CustomResourceDefinition] objectbucketclaims.objectbucket.io -[CustomResourceDefinition] objectbuckets.objectbucket.io - -release "rook-ceph" uninstalled - -$ kubectl delete crds cephblockpools.ceph.rook.io cephbucketnotifications.ceph.rook.io cephbuckettopics.ceph.rook.io \ - cephclients.ceph.rook.io cephclusters.ceph.rook.io cephfilesystemmirrors.ceph.rook.io \ - cephfilesystems.ceph.rook.io cephfilesystemsubvolumegroups.ceph.rook.io \ - cephnfses.ceph.rook.io cephobjectrealms.ceph.rook.io cephobjectstores.ceph.rook.io \ - cephobjectstoreusers.ceph.rook.io cephobjectzonegroups.ceph.rook.io cephobjectzones.ceph.rook.io \ - cephrbdmirrors.ceph.rook.io objectbucketclaims.objectbucket.io objectbuckets.objectbucket.io -customresourcedefinition.apiextensions.k8s.io "cephblockpools.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephbucketnotifications.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephbuckettopics.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephclients.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephclusters.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystemmirrors.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystems.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystemsubvolumegroups.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephnfses.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectrealms.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectstores.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectstoreusers.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectzonegroups.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectzones.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephrbdmirrors.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "objectbucketclaims.objectbucket.io" deleted -customresourcedefinition.apiextensions.k8s.io "objectbuckets.objectbucket.io" deleted -``` - -### Talos Linux Rook Metadata Removal - -If the Rook Operator is cleanly removed following the above process, the node metadata and disks should be clean and ready to be re-used. -In the case of an unclean cluster removal, there may be still a few instances of metadata stored on the system disk, as well as the partition information on the storage disks. -First the node metadata needs to be removed, make sure to update the `nodeName` with the actual name of a storage node that needs cleaning, and `path` with the Rook configuration `dataDirHostPath` set when installing the chart. -The following will need to be repeated for each node used in the Rook Ceph cluster. - -```shell -$ cat < - volumes: - - name: rook-data-dir - hostPath: - path: - containers: - - name: disk-clean - image: busybox - securityContext: - privileged: true - volumeMounts: - - name: rook-data-dir - mountPath: /node/rook-data - command: ["/bin/sh", "-c", "rm -rf /node/rook-data/*"] -EOF -pod/disk-clean created - -$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-clean -pod/disk-clean condition met - -$ kubectl delete pod disk-clean -pod "disk-clean" deleted -``` - -Lastly, the disks themselves need the partition and filesystem data wiped before they can be reused. -Again, the following as to be repeated for each node **and** disk used in the Rook Ceph cluster, updating `nodeName` and `of=` in the `command` as needed. - -```shell -$ cat < - containers: - - name: disk-wipe - image: busybox - securityContext: - privileged: true - command: ["/bin/sh", "-c", "dd if=/dev/zero bs=1M count=100 oflag=direct of="] -EOF -pod/disk-wipe created - -$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-wipe -pod/disk-wipe condition met - -$ kubectl delete pod disk-clean -pod "disk-wipe" deleted -``` diff --git a/website/content/v0.14/guides/configuring-certificate-authorities.md b/website/content/v0.14/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.14/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.14/guides/configuring-containerd.md b/website/content/v0.14/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.14/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.14/guides/configuring-corporate-proxies.md b/website/content/v0.14/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.14/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.14/guides/configuring-network-connectivity.md b/website/content/v0.14/guides/configuring-network-connectivity.md deleted file mode 100644 index 94ea517bf..000000000 --- a/website/content/v0.14/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.14/guides/configuring-pull-through-cache.md b/website/content/v0.14/guides/configuring-pull-through-cache.md deleted file mode 100644 index 3b2e05fbc..000000000 --- a/website/content/v0.14/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `quay.io`, `gcr.io`, and `ghcr.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.14/guides/configuring-the-cluster-endpoint.md b/website/content/v0.14/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index 9c2ef9760..000000000 --- a/website/content/v0.14/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip address to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. controlplane.yaml and worker.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.14/guides/configuring-wireguard-network.md b/website/content/v0.14/guides/configuring-wireguard-network.md deleted file mode 100644 index 6102d3966..000000000 --- a/website/content/v0.14/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > worker.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - addresses: - - 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.14/guides/customizing-the-kernel.md b/website/content/v0.14/guides/customizing-the-kernel.md deleted file mode 100644 index 22b76a959..000000000 --- a/website/content/v0.14/guides/customizing-the-kernel.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -Build and push your own kernel: - - ```sh - git clone https://github.com/talos-systems/pkgs.git - cd pkgs - make kernel-menuconfig USERNAME=_your_github_user_name_ - - docker login ghcr.io --username _your_github_user_name_ - make kernel USERNAME=_your_github_user_name_ PUSH=true - ``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM ghcr.io/talos-systems/installer:latest -COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -To build the image, run: - -```bash -DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . -``` - -> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.14/guides/customizing-the-root-filesystem.md b/website/content/v0.14/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.14/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.14/guides/deploy-metrics-server.md b/website/content/v0.14/guides/deploy-metrics-server.md deleted file mode 100644 index 0471cdbfc..000000000 --- a/website/content/v0.14/guides/deploy-metrics-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v0.14/guides/deploying-cilium.md b/website/content/v0.14/guides/deploying-cilium.md deleted file mode 100644 index 436d4388d..000000000 --- a/website/content/v0.14/guides/deploying-cilium.md +++ /dev/null @@ -1,210 +0,0 @@ ---- -title: "Deploying Cilium CNI" -description: "In this guide you will learn how to set up Cilium CNI on Talos." ---- - -From v1.9 onwards Cilium does no longer provide a one-liner install manifest that can be used to install Cilium on a node via `kubectl apply -f` or passing it in as an extra url in the `urls` part in the Talos machine configuration. - -> Installing Cilium the new way via the `cilium` cli is broken, so we'll be using `helm` to install Cilium. -For more information: [Install with CLI fails, works with Helm](https://github.com/cilium/cilium-cli/issues/505) - -Refer to [Installing with Helm](https://docs.cilium.io/en/v1.11/gettingstarted/k8s-install-helm/) for more information. - -First we'll need to add the helm repo for Cilium. - -```bash -helm repo add cilium https://helm.cilium.io/ -helm repo update -``` - -This documentation will outline installing Cilium CNI v1.11.2 on Talos in four different ways. -Adhering to Talos principles we'll deploy Cilium with IPAM mode set to Kubernetes. -Each method can either install Cilium using kube proxy (default) or without: [Kubernetes Without kube-proxy](https://docs.cilium.io/en/v1.11/gettingstarted/kubeproxy-free/) - -## Machine config preparation - -When generating the machine config for a node set the CNI to none. -For example using a config patch: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -Or if you want to deploy Cilium in strict mode without kube-proxy, you also need to disable kube proxy: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op": "add", "path": "/cluster/proxy", "value": {"disabled": true}}, {"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -## Method 1: Helm install - -After applying the machine config and bootstrapping Talos will appear to hang on phase 18/19 with the message: retrying error: node not ready. -This happens because nodes in Kubernetes are only marked as ready once the CNI is up. -As there is no CNI defined, the boot process is pending and will reboot the node to retry after 10 minutes, this is expected behavior. - -During this window you can install Cilium manually by running the following: - -```bash -helm install cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes -``` - -Or if you want to deploy Cilium in strict mode without kube-proxy, also set some extra paramaters: - -```bash -export KUBERNETES_API_SERVER_ADDRESS=<> -export KUBERNETES_API_SERVER_PORT=6443 - -helm install cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes \ - --set kubeProxyReplacement=strict \ - --set k8sServiceHost="${KUBERNETES_API_SERVER_ADDRESS}" \ - --set k8sServicePort="${KUBERNETES_API_SERVER_PORT}" -``` - -After Cilium is installed the boot process should continue and complete successfully. - -## Method 2: Helm manifests install - -Instead of directly installing Cilium you can instead first generate the manifest and then apply it: - -```bash -helm template cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system - --set ipam.mode=kubernetes > cilium.yaml - -kubectl apply -f cilium.yaml -``` - -Without kube-proxy: - -```bash -export KUBERNETES_API_SERVER_ADDRESS=<> -export KUBERNETES_API_SERVER_PORT=6443 - -helm template cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes \ - --set kubeProxyReplacement=strict \ - --set k8sServiceHost="${KUBERNETES_API_SERVER_ADDRESS}" \ - --set k8sServicePort="${KUBERNETES_API_SERVER_PORT}" > cilium.yaml - -kubectl apply -f cilium.yaml -``` - -## Method 3: Helm manifests hosted install - -After generating `cilium.yaml` using `helm template`, instead of applying this manifest directly during the Talos boot window (before the reboot timeout). -You can also host this file somewhere and patch the machine config to apply this manifest automatically during bootstrap. -To do this patch your machine configuration to include this config instead of the above: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "custom", "urls": ["https://server.yourdomain.tld/some/path/cilium.yaml"]}}]' -``` - -Resulting in a config that look like this: - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://server.yourdomain.tld/some/path/cilium.yaml -``` - -However, beware of the fact that the helm generated Cilium manifest contains sensitive key material. -As such you should definitely not host this somewhere publicly accessible. - -## Method 4: Helm manifests inline install - -A more secure option would be to include the `helm template` output manifest inside the machine configuration. -The machine config should be generated with CNI set to `none` - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -if deploying Cilium with `kube-proxy` disabled, you can also include the following: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op": "add", "path": "/cluster/proxy", "value": {"disabled": true}}, {"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -To do so patch this into your machine configuration: - -``` yaml -inlineManifests: - - name: cilium - contents: | - -- - # Source: cilium/templates/cilium-agent/serviceaccount.yaml - apiVersion: v1 - kind: ServiceAccount - metadata: - name: "cilium" - namespace: kube-system - --- - # Source: cilium/templates/cilium-operator/serviceaccount.yaml - apiVersion: v1 - kind: ServiceAccount - -> Your cilium.yaml file will be pretty long.... -``` - -This will install the Cilium manifests at just the right time during bootstrap. - -Beware though: - -- Changing the namespace when templating with Helm does not generate a manifest containing the yaml to create that namespace. -As the inline manifest is processed from top to bottom make sure to manually put the namespace yaml at the start of the inline manifest. -- Only add the Cilium inline manifest to the control plane nodes machine configuration. -- Make sure all control plane nodes have an identical configuration. -- If you delete any of the generated resources they will be restored whenever a control plane node reboots. -- As a safety measure Talos only creates missing resources from inline manifests, it never deletes or updates anything. -- If you need to update a manifest make sure to first edit all control plane machine configurations and then run `talosctl upgrade-k8s` as it will take care of updating inline manifests. - -## Known issues - -- Currently there is an interaction between a Kubespan enabled Talos cluster and Cilium that results in the cluster going down during bootstrap after applying the Cilium manifests. -For more details: [Kubespan and Cilium compatiblity: etcd is failing](https://github.com/talos-systems/talos/issues/4836) - -- When running Cilium with a kube-proxy eBPF replacement (strict mode) there is a conflicting kernel module that results in locked tx queues. -This can be fixed by blacklisting `aoe_init` with extraKernelArgs. -For more details: [Cilium on talos "aoe: packet could not be sent on \*. consider increasing tx_queue_len"](https://github.com/talos-systems/talos/issues/4863) - -- There are some gotchas when using Talos and Cilium on the Google cloud platform when using internal load balancers. -For more details: [GCP ILB support / support scope local routes to be configured](https://github.com/talos-systems/talos/issues/4109) - -- Some kernel values changed by kube-proxy are not set to good defaults when running the cilium kernel-proxy alternative. -For more details: [Kernel default values (sysctl)](https://github.com/talos-systems/talos/issues/4654) - -## Other things to know - -- Talos has full kernel module support for eBPF, See: - - [Cilium System Requirements](https://docs.cilium.io/en/v1.11/operations/system_requirements/) - - [Talos Kernel Config AMD64](https://github.com/talos-systems/pkgs/blob/master/kernel/build/config-amd64) - - [Talos Kernel Config ARM64](https://github.com/talos-systems/pkgs/blob/master/kernel/build/config-arm64) - -- Talos also includes the modules: - - - `CONFIG_NETFILTER_XT_TARGET_TPROXY=m` - - `CONFIG_NETFILTER_XT_TARGET_CT=m` - - `CONFIG_NETFILTER_XT_MATCH_MARK=m` - - `CONFIG_NETFILTER_XT_MATCH_SOCKET=m` - - This allows you to set `--set enableXTSocketFallback=false` on the helm install/template command preventing Cilium from disabling the `ip_early_demux` kernel feature. -This will win back some performance. diff --git a/website/content/v0.14/guides/disaster-recovery.md b/website/content/v0.14/guides/disaster-recovery.md deleted file mode 100644 index 286b70080..000000000 --- a/website/content/v0.14/guides/disaster-recovery.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --on-reboot` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's `EPHEMERAL` partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v0.14/guides/discovery.md b/website/content/v0.14/guides/discovery.md deleted file mode 100644 index 8f2d9ec91..000000000 --- a/website/content/v0.14/guides/discovery.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: "Discovery" ---- - -## Video Walkthrough - -To see a live demo of Cluster Discovery, see the video below: - - - -## Registries - -Peers are aggregated from a number of optional registries. -By default, Talos will use the `kubernetes` and `service` registries. -Either one can be disabled. -To disable a registry, set `disabled` to `true` (this option is the same for all registries): -For example, to disable the `service` registry: - -```yaml -cluster: - discovery: - enabled: true - registries: - service: - disabled: true -``` - -Disabling all registries effectively disables member discovery altogether. - -> As of v0.14, Talos supports the `kubernetes` and `service` registries. - -`Kubernetes` registry uses Kubernetes `Node` resource data and additional Talos annotations: - -```sh -$ kubectl describe node -Annotations: cluster.talos.dev/node-id: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd - networking.talos.dev/assigned-prefixes: 10.244.0.0/32,10.244.0.1/24 - networking.talos.dev/self-ips: 172.20.0.2,fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94 -... -``` - -`Service` registry uses external [Discovery Service](../../learn-more/discovery/) to exchange encrypted information about cluster members. - -## Resource Definitions - -Talos v0.14 introduces seven new resources that can be used to introspect the new discovery and KubeSpan features. - -### Discovery - -#### Identities - -The node's unique identity (base62 encoded random 32 bytes) can be obtained with: - -> Note: Using base62 allows the ID to be URL encoded without having to use the ambiguous URL-encoding version of base64. - -```sh -$ talosctl get identities -o yaml -... -spec: - nodeId: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd -``` - -Node identity is used as the unique `Affiliate` identifier. - -Node identity resource is preserved in the `STATE` partition in `node-identity.yaml` file. -Node identity is preserved across reboots and upgrades, but it is regenerated if the node is reset (wiped). - -#### Affiliates - -An affiliate is a proposed member attributed to the fact that the node has the same cluster ID and secret. - -```sh -$ talosctl get affiliates -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 2 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd 4 talos-default-master-1 controlplane ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 2 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -One of the `Affiliates` with the `ID` matching node identity is populated from the node data, other `Affiliates` are pulled from the registries. -Enabled discovery registries run in parallel and discovered data is merged to build the list presented above. - -Details about data coming from each registry can be queried from the `cluster-raw` namespace: - -```sh -$ talosctl get affiliates --namespace=cluster-raw -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -k8s/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 3 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -k8s/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -k8s/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -k8s/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 3 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -service/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 23 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -service/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 26 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -service/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 20 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -service/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 14 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -Each `Affiliate` ID is prefixed with `k8s/` for data coming from the Kubernetes registry and with `service/` for data coming from the discovery service. - -#### Members - -A member is an affiliate that has been approved to join the cluster. -The members of the cluster can be obtained with: - -```sh -$ talosctl get members -ID VERSION HOSTNAME MACHINE TYPE OS ADDRESSES -talos-default-master-1 2 talos-default-master-1 controlplane Talos (v0.14.0) ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -talos-default-master-2 1 talos-default-master-2 controlplane Talos (v0.14.0) ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -talos-default-master-3 1 talos-default-master-3 controlplane Talos (v0.14.0) ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -talos-default-worker-1 1 talos-default-worker-1 worker Talos (v0.14.0) ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -talos-default-worker-2 1 talos-default-worker-2 worker Talos (v0.14.0) ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -``` diff --git a/website/content/v0.14/guides/disk-encryption.md b/website/content/v0.14/guides/disk-encryption.md deleted file mode 100644 index 04b3fbfd8..000000000 --- a/website/content/v0.14/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.14/guides/editing-machine-configuration.md b/website/content/v0.14/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.14/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.14/guides/kubespan.md b/website/content/v0.14/guides/kubespan.md deleted file mode 100644 index d87283f2f..000000000 --- a/website/content/v0.14/guides/kubespan.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: "KubeSpan" ---- - -KubeSpan is a feature of Talos that automates the setup and maintenance of a full mesh [WireGuard](https://www.wireguard.com) network for your cluster, giving you the ability to operate hybrid Kubernetes clusters that can span the edge, datacenter, and cloud. -Management of keys and discovery of peers can be completely automated for a zero-touch experience that makes it simple and easy to create hybrid clusters. - -## Video Walkthrough - -To learn more about KubeSpan, see the video below: - - - -To see a live demo of KubeSpan, see one the videos below: - - - - - -## Enabling - -### Creating a New Cluster - -To generate configuration files for a new cluster, we can use the `--with-kubespan` flag in `talosctl gen config`. -This will enable peer discovery and KubeSpan. - -```yaml -... - # Provides machine specific network configuration options. - network: - # Configures KubeSpan feature. - kubespan: - enabled: true # Enable the KubeSpan feature. -... - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: {} -... -# Provides cluster specific configuration options. -cluster: - id: yui150Ogam0pdQoNZS2lZR-ihi8EWxNM17bZPktJKKE= # Globally unique identifier for this cluster. - secret: dAmFcyNmDXusqnTSkPJrsgLJ38W8oEEXGZKM0x6Orpc= # Shared secret of cluster. -``` - -> The default discovery service is an external service hosted for free by Sidero Labs. -> The default value is `https://discovery.talos.dev/`. -> Contact Sidero Labs if you need to run this service privately. - -### Upgrading an Existing Cluster - -In order to enable KubeSpan for an existing cluster, upgrade to the latest v0.14. -Once your cluster is upgraded, the configuration of each node must contain the globally unique identifier, the shared secret for the cluster, and have KubeSpan and discovery enabled. - -> Note: Discovery can be used without KubeSpan, but KubeSpan requires at least one discovery registry. - -#### Talos v0.11 or Less - -If you are migrating from Talos v0.11 or less, we need to generate a cluster ID and secret. - -To generate an `id`: - -```sh -$ openssl rand -base64 32 -EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= -``` - -To generate a `secret`: - -```sh -$ openssl rand -base64 32 -AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -Now, update the configuration of each node with the cluster with the generated `id` and `secret`. -You should end up with the addition of something like this (your `id` and `secret` should be different): - -```yaml -cluster: - id: EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= - secret: AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -> Note: This can be applied in immediate mode (no reboot required) by passing `--immediate` to either the `edit machineconfig` or `apply-config` subcommands. - -#### Talos v0.12 - -Enable `kubespan` and `discovery`. - -```yaml -machine: - network: - kubespan: - enabled: true -cluster: - discovery: - enabled: true -``` - -## Resource Definitions - -### KubeSpanIdentities - -A node's WireGuard identities can be obtained with: - -```sh -$ talosctl get kubespanidentities -o yaml -... -spec: - address: fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94/128 - subnet: fd83:b1f7:fcb5:2802::/64 - privateKey: gNoasoKOJzl+/B+uXhvsBVxv81OcVLrlcmQ5jQwZO08= - publicKey: NzW8oeIH5rJyY5lefD9WRoHWWRr/Q6DwsDjMX+xKjT4= -``` - -Talos automatically configures unique IPv6 address for each node in the cluster-specific IPv6 ULA prefix. - -Wireguard private key is generated for the node, private key never leaves the node while public key is published through the cluster discovery. - -`KubeSpanIdentity` is persisted across reboots and upgrades in `STATE` partition in the file `kubespan-identity.yaml`. - -### KubeSpanPeerSpecs - -A node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerspecs -ID VERSION LABEL ENDPOINTS -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 2 talos-default-master-2 ["172.20.0.3:51820"] -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 2 talos-default-master-3 ["172.20.0.4:51820"] -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 2 talos-default-worker-2 ["172.20.0.6:51820"] -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 2 talos-default-worker-1 ["172.20.0.5:51820"] -``` - -The peer ID is the Wireguard public key. -`KubeSpanPeerSpecs` are built from the cluster discovery data. - -### KubeSpanPeerStatuses - -The status of a node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerstatuses -ID VERSION LABEL ENDPOINT STATE RX TX -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 63 talos-default-master-2 172.20.0.3:51820 up 15043220 17869488 -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 62 talos-default-master-3 172.20.0.4:51820 up 14573208 18157680 -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 60 talos-default-worker-2 172.20.0.6:51820 up 130072 46888 -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 60 talos-default-worker-1 172.20.0.5:51820 up 130044 46556 -``` - -KubeSpan peer status includes following information: - -* the actual endpoint used for peer communication -* link state: - * `unknown`: the endpoint was just changed, link state is not known yet - * `up`: there is a recent handshake from the peer - * `down`: there is no handshake from the peer -* number of bytes sent/received over the Wireguard link with the peer - -If the connection state goes `down`, Talos will be cycling through the available endpoints until it finds the one which works. - -Peer status information is updated every 30 seconds. - -### KubeSpanEndpoints - -A node's WireGuard endpoints (peer addresses) can be obtained with: - -```sh -$ talosctl get kubespanendpoints -ID VERSION ENDPOINT AFFILIATE ID -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 1 172.20.0.3:51820 2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 1 172.20.0.4:51820 b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 1 172.20.0.6:51820 NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 1 172.20.0.5:51820 6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA -``` - -The endpoint ID is the base64 encoded WireGuard public key. - -The observed endpoints are submitted back to the discovery service (if enabled) so that other peers can try additional endpoints to establish the connection. diff --git a/website/content/v0.14/guides/logging.md b/website/content/v0.14/guides/logging.md deleted file mode 100644 index 926b3a6c2..000000000 --- a/website/content/v0.14/guides/logging.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: Logging ---- - -## Viewing logs - -Kernel messages can be retrieved with `talosctl dmesg` command: - -```sh -$ talosctl -n 172.20.1.2 dmesg - -172.20.1.2: kern: info: [2021-11-10T10:09:37.662764956Z]: Command line: init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 random.trust_cpu=on printk.devkmsg=on ima_template=ima-ng ima_appraise=fix ima_hash=sha512 console=ttyS0 reboot=k panic=1 talos.shutdown=halt talos.platform=metal talos.config=http://172.20.1.1:40101/config.yaml -[...] -``` - -Service logs can be retrieved with `talosctl logs` command: - -```sh -$ talosctl -n 172.20.1.2 services - -NODE SERVICE STATE HEALTH LAST CHANGE LAST EVENT -172.20.1.2 apid Running OK 19m27s ago Health check successful -172.20.1.2 containerd Running OK 19m29s ago Health check successful -172.20.1.2 cri Running OK 19m27s ago Health check successful -172.20.1.2 etcd Running OK 19m22s ago Health check successful -172.20.1.2 kubelet Running OK 19m20s ago Health check successful -172.20.1.2 machined Running ? 19m30s ago Service started as goroutine -172.20.1.2 trustd Running OK 19m27s ago Health check successful -172.20.1.2 udevd Running OK 19m28s ago Health check successful - -$ talosctl -n 172.20.1.2 logs machined - -172.20.1.2: [talos] task setupLogger (1/1): done, 106.109µs -172.20.1.2: [talos] phase logger (1/7): done, 564.476µs -[...] -``` - -Container logs for Kubernetes pods can be retrieved with `talosctl logs -k` command: - -```sh -$ talosctl -n 172.20.1.2 containers -k -NODE NAMESPACE ID IMAGE PID STATUS -172.20.1.2 k8s.io kube-system/kube-flannel-dk6d5 k8s.gcr.io/pause:3.5 1329 SANDBOX_READY -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-cni ghcr.io/talos-systems/install-cni:v0.7.0-alpha.0-1-g2bb2efc 0 CONTAINER_EXITED -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-config quay.io/coreos/flannel:v0.13.0 0 CONTAINER_EXITED -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:kube-flannel quay.io/coreos/flannel:v0.13.0 1610 CONTAINER_RUNNING -172.20.1.2 k8s.io kube-system/kube-proxy-gfkqj k8s.gcr.io/pause:3.5 1311 SANDBOX_READY -172.20.1.2 k8s.io └─ kube-system/kube-proxy-gfkqj:kube-proxy k8s.gcr.io/kube-proxy:v1.23.0 1379 CONTAINER_RUNNING - -$ talosctl -n 172.20.1.2 logs -k kube-system/kube-proxy-gfkqj:kube-proxy -172.20.1.2: 2021-11-30T19:13:20.567825192Z stderr F I1130 19:13:20.567737 1 server_others.go:138] "Detected node IP" address="172.20.0.3" -172.20.1.2: 2021-11-30T19:13:20.599684397Z stderr F I1130 19:13:20.599613 1 server_others.go:206] "Using iptables Proxier" -[...] -``` - -## Sending logs - -### Service logs - -You can enable logs sendings in machine configuration: - -```yaml -machine: - logging: - destinations: - - endpoint: "udp://127.0.0.1:12345/" - format: "json_lines" - - endpoint: "tcp://host:5044/" - format: "json_lines" -``` - -Several destinations can be specified. -Supported protocols are UDP and TCP. -The only currently supported format is `json_lines`: - -```json -{ - "msg": "[talos] apply config request: immediate true, on reboot false", - "talos-level": "info", - "talos-service": "machined", - "talos-time": "2021-11-10T10:48:49.294858021Z" -} -``` - -Messages are newline-separated when sent over TCP. -Over UDP messages are sent with one message per packet. -`msg`, `talos-level`, `talos-service`, and `talos-time` fields are always present; there may be additional fields. - -### Kernel logs - -Kernel log delivery can be enabled with the `talos.logging.kernel` kernel command line argument, which can be specified -in the `.machine.installer.extraKernelArgs`: - -```yaml -machine: - install: - extraKernelArgs: - - talos.logging.kernel=tcp://host:5044/ -``` - -Kernel log destination is specified in the same way as service log endpoint. -The only supported format is `json_lines`. - -Sample message: - -```json -{ - "clock":6252819, // time relative to the kernel boot time - "facility":"user", - "msg":"[talos] task startAllServices (1/1): waiting for 6 services\n", - "priority":"warning", - "seq":711, - "talos-level":"warn", // Talos-translated `priority` into common logging level - "talos-time":"2021-11-26T16:53:21.3258698Z" // Talos-translated `clock` using current time -} -``` - -> `extraKernelArgs` in the machine configuration are only applied on Talos upgrades, not just by applying the config. -> (Upgrading to the same version is fine). - -### Filebeat example - -To forward logs to other Log collection services, one way to do this is sending -them to a [Filebeat](https://www.elastic.co/beats/filebeat) running in the -cluster itself (in the host network), which takes care of forwarding it to -other endpoints (and the necessary transformations). - -If [Elastic Cloud on Kubernetes](https://www.elastic.co/elastic-cloud-kubernetes) -is being used, the following Beat (custom resource) configuration might be -helpful: - -```yaml -apiVersion: beat.k8s.elastic.co/v1beta1 -kind: Beat -metadata: - name: talos -spec: - type: filebeat - version: 7.15.1 - elasticsearchRef: - name: talos - config: - filebeat.inputs: - - type: "udp" - host: "127.0.0.1:12345" - processors: - - decode_json_fields: - fields: ["message"] - target: "" - - timestamp: - field: "talos-time" - layouts: - - "2006-01-02T15:04:05.999999999Z07:00" - - drop_fields: - fields: ["message", "talos-time"] - - rename: - fields: - - from: "msg" - to: "message" - - daemonSet: - updateStrategy: - rollingUpdate: - maxUnavailable: 100% - podTemplate: - spec: - dnsPolicy: ClusterFirstWithHostNet - hostNetwork: true - securityContext: - runAsUser: 0 - containers: - - name: filebeat - ports: - - protocol: UDP - containerPort: 12345 - hostPort: 12345 -``` - -The input configuration ensures that messages and timestamps are extracted properly. -Refer to the Filebeat documentation on how to forward logs to other outputs. - -Also note the `hostNetwork: true` in the `daemonSet` configuration. - -This ensures filebeat uses the host network, and listens on `127.0.0.1:12345` -(UDP) on every machine, which can then be specified as a logging endpoint in -the machine configuration. diff --git a/website/content/v0.14/guides/managing-pki.md b/website/content/v0.14/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.14/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.14/guides/rbac.md b/website/content/v0.14/guides/rbac.md deleted file mode 100644 index 2376ec7d2..000000000 --- a/website/content/v0.14/guides/rbac.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Role-based access control (RBAC) ---- - -Talos v0.11 introduced initial support for role-based access control (RBAC). -This guide will explain what that is and how to enable it without losing access to the cluster. - -## RBAC in Talos - -Talos uses certificates to authorize users. -The certificate subject's organization field is used to encode user roles. -There is a set of predefined roles that allow access to different [API methods](../../reference/api/): - -* `os:admin` grants access to all methods; -* `os:reader` grants access to "safe" methods (for example, that includes the ability to list files, but does not include the ability to read files content); -* `os:etcd:backup` grants access to [`/machine.MachineService/EtcdSnapshot`](../../reference/api/#machine.EtcdSnapshotRequest) method. - -Roles in the current `talosconfig` can be checked with the following command: - -```sh -$ talosctl config info - -[...] -Roles: os:admin -[...] -``` - -RBAC is enabled by default in new clusters created with `talosctl` v0.11+ and disabled otherwise. - -## Enabling RBAC - -First, both the Talos cluster and `talosctl` tool should be [upgraded](../upgrading-talos/). -Then the `talosctl config new` command should be used to generate a new client configuration with the `os:admin` role. -Additional configurations and certificates for different roles can be generated by passing `--roles` flag: - -```sh -talosctl config new --roles=os:reader reader -``` - -That command will create a new client configuration file `reader` with a new certificate with `os:reader` role. - -After that, RBAC should be enabled in the machine configuration: - -```yaml -machine: - features: - rbac: true -``` diff --git a/website/content/v0.14/guides/resetting-a-machine.md b/website/content/v0.14/guides/resetting-a-machine.md deleted file mode 100644 index f2366ed49..000000000 --- a/website/content/v0.14/guides/resetting-a-machine.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -> WARNING: Running a `talosctl reset` on cloud VM's might result in the VM being unable to boot as this wipes the entire disk. -It might be more useful to just wipe the `STATE` and `EPHEMERAL` partitions on a cloud VM if not booting via `iPXE`. -`talosctl reset --system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL` - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact keep other partitions intact -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.14/guides/storage.md b/website/content/v0.14/guides/storage.md deleted file mode 100644 index 860236222..000000000 --- a/website/content/v0.14/guides/storage.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -In Kubernetes, using storage in the right way is well-facilitated by the API. -However, unless you are running in a major public cloud, that API may not be hooked up to anything. -This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. -There are a _lot_ of options out there, and it can be fairly bewildering. - -For Talos, we try to limit the options somewhat to make the decision-making easier. - -## Public Cloud - -If you are running on a major public cloud, use their block storage. -It is easy and automatic. - -## Storage Clusters - -> **Talos** recommends having a separate disks (apart from the Talos install disk) to be used for storage. - -Redundancy in storage is usually very important. -Scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. - -Running a storage cluster can be a very good choice when managing your own storage, and there are two project we recommend, depending on your situation. - -If you need vast amounts of storage composed of more than a dozen or so disks, just use Rook to manage Ceph. -Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. -Ceph also bundles in an S3-compatible object store. -The down side of Ceph is that there are a lot of moving parts. - -> Please note that _most_ people should _never_ use mount-many semantics. -> NFS is pervasive because it is old and easy, _not_ because it is a good idea. -> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. - -If your storage needs are small enough to not need Ceph, use Mayastor. - -### Rook/Ceph - -[Ceph](https://ceph.io) is the grandfather of open source storage clusters. -It is big, has a lot of pieces, and will do just about anything. -It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. -It comes bundled with RadosGW, an S3-compatible object store. -It comes with CephFS, a NFS-like clustered filesystem. -And of course, it comes with RBD, a block storage system. - -With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. - -So if Ceph is so great, why not use it for everything? - -Ceph can be rather slow for small clusters. -It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. -Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. - -Troubleshooting Ceph can be difficult if you do not understand its architecture. -There are lots of acronyms and the documentation assumes a fair level of knowledge. -There are very good tools for inspection and debugging, but this is still frequently seen as a concern. - -### Mayastor - -[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. -(Despite the name, Mayastor does _not_ require you to have NVME drives.) -It is fast and lean but still cluster-oriented and cloud native. -Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. - -Unlike Ceph, Mayastor is _just_ a block store. -It focuses on block storage and does it well. -It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. - -Mayastor is new, maybe _too_ new. -If you're looking for something well-tested and battle-hardened, this is not it. -If you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. - -### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -This information is gathered from the Mayastor [documentation](https://mayastor.gitbook.io/introduction/quickstart/preparing-the-cluster). -We need to set the `vm.nr_hugepages` sysctl and add `openebs.io/engine=mayastor` labels to the nodes which are meant to be storage nodes -This can be done with `talosctl patch machineconfig` or via config patches during `talosctl gen config`. - -Some examples are shown below, modify as needed. - -Using gen config - -```bash -talosctl gen config my-cluster https://mycluster.local:6443 --config-patch '[{"op": "add", "path": "/machine/sysctls", "value": {"vm.nr_hugepages": "1024"}}, {"op": "add", "path": "/machine/kubelet/extraArgs", "value": {"node-labels": "openebs.io/engine=mayastor"}}]' -``` - -Patching an existing node - -```bash -talosctl patch --immediate machineconfig -n --patch '[{"op": "add", "path": "/machine/sysctls", "value": {"vm.nr_hugepages": "1024"}}, {"op": "add", "path": "/machine/kubelet/extraArgs", "value": {"node-labels": "openebs.io/engine=mayastor"}}]' -``` - -> Note: If you are adding/updating the `vm.nr_hugepages` on a node which already had the `openebs.io/engine=mayastor` label set, you'd need to restart kubelet so that it picks up the new value, by issuing the following command - -```bash -talosctl -n service kubelet restart -``` - -### Deploy Mayastor - -Continue setting up [Mayastor](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) using the official documentation. - -## NFS - -NFS is an old pack animal long past its prime. -However, it is supported by a wide variety of systems. -You don't want to use it unless you have to, but unfortunately, that "have to" is too frequent. - -NFS is slow, has all kinds of bottlenecks involving contention, distributed locking, single points of service, and more. - -The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. -This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. -You can reduce some of the contention problems by parceling Persistent Volumes from separate underlying directories. - -## Object storage - -Ceph comes with an S3-compatible object store, but there are other options, as -well. -These can often be built on top of other storage backends. -For instance, you may have your block storage running with Mayastor but assign a -Pod a large Persistent Volume to serve your object store. - -One of the most popular open source add-on object stores is [MinIO](https://min.io/). - -## Others (iSCSI) - -The most common remaining systems involve iSCSI in one form or another. -This includes things like the original OpenEBS, Rancher's Longhorn, and many proprietary systems. -Unfortunately, Talos does _not_ support iSCSI-based systems. -iSCSI in Linux is facilitated by [open-iscsi](https://github.com/open-iscsi/open-iscsi). -This system was designed long before containers caught on, and it is not well -suited to the task, especially when coupled with a read-only host operating -system. - -One day, we hope to work out a solution for facilitating iSCSI-based systems, but this is not yet available. diff --git a/website/content/v0.14/guides/troubleshooting-control-plane.md b/website/content/v0.14/guides/troubleshooting-control-plane.md deleted file mode 100644 index 1c3d8102c..000000000 --- a/website/content/v0.14/guides/troubleshooting-control-plane.md +++ /dev/null @@ -1,427 +0,0 @@ ---- -title: "Troubleshooting Control Plane" -description: "Troubleshoot control plane failures for running cluster and bootstrap process." ---- - - - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.14/guides/upgrading-kubernetes.md b/website/content/v0.14/guides/upgrading-kubernetes.md deleted file mode 100644 index fdcb24557..000000000 --- a/website/content/v0.14/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,522 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To check what is going to be upgraded you can run `talosctl upgrade-k8s` with `--dry-run` flag: - -```bash -$ talosctl --nodes upgrade-k8s --to 1.23.0 --dry-run -WARNING: found resources which are going to be deprecated/migrated in the version 1.22.0 -RESOURCE COUNT -validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 -mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 -customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 -apiservices.v1beta1.apiregistration.k8s.io 54 -leases.v1beta1.coordination.k8s.io 4 -automatically detected the lowest Kubernetes version 1.22.4 -checking for resource APIs to be deprecated in version 1.23.0 -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -discovered worker nodes ["172.20.0.5" "172.20.0.6"] -updating "kube-apiserver" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.3": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.4": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > skipped in dry-run -updating "kube-controller-manager" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.3": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.4": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > skipped in dry-run -updating "kube-scheduler" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.3": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.4": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > skipped in dry-run -updating daemonset "kube-proxy" to version "1.23.0" -skipped in dry-run -updating kubelet to version "1.23.0" - > "172.20.0.2": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.3": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.4": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.5": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > skipped in dry-run - > "172.20.0.6": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > skipped in dry-run -updating manifests - > apply manifest Secret bootstrap-token-3lb63t - > apply skipped in dry run - > apply manifest ClusterRoleBinding system-bootstrap-approve-node-client-csr - > apply skipped in dry run - > apply manifest ClusterRoleBinding system-bootstrap-node-bootstrapper - > apply skipped in dry run - > apply manifest ClusterRoleBinding system-bootstrap-node-renewal - > apply skipped in dry run - > apply manifest ClusterRoleBinding system:default-sa - > apply skipped in dry run - > apply manifest ClusterRole psp:privileged - > apply skipped in dry run - > apply manifest ClusterRoleBinding psp:privileged - > apply skipped in dry run - > apply manifest PodSecurityPolicy privileged - > apply skipped in dry run - > apply manifest ClusterRole flannel - > apply skipped in dry run - > apply manifest ClusterRoleBinding flannel - > apply skipped in dry run - > apply manifest ServiceAccount flannel - > apply skipped in dry run - > apply manifest ConfigMap kube-flannel-cfg - > apply skipped in dry run - > apply manifest DaemonSet kube-flannel - > apply skipped in dry run - > apply manifest ServiceAccount kube-proxy - > apply skipped in dry run - > apply manifest ClusterRoleBinding kube-proxy - > apply skipped in dry run - > apply manifest ServiceAccount coredns - > apply skipped in dry run - > apply manifest ClusterRoleBinding system:coredns - > apply skipped in dry run - > apply manifest ClusterRole system:coredns - > apply skipped in dry run - > apply manifest ConfigMap coredns - > apply skipped in dry run - > apply manifest Deployment coredns - > apply skipped in dry run - > apply manifest Service kube-dns - > apply skipped in dry run - > apply manifest ConfigMap kubeconfig-in-cluster - > apply skipped in dry run -``` - -To upgrade Kubernetes from v1.22.4 to v1.23.0 run: - -```bash -$ talosctl --nodes upgrade-k8s --to 1.24.0 -automatically detected the lowest Kubernetes version 1.22.4 -checking for resource APIs to be deprecated in version 1.23.0 -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -discovered worker nodes ["172.20.0.5" "172.20.0.6"] -updating "kube-apiserver" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > "172.20.0.2": machine configuration patched - > "172.20.0.2": waiting for API server state pod update - < "172.20.0.2": successfully updated - > "172.20.0.3": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > "172.20.0.3": machine configuration patched - > "172.20.0.3": waiting for API server state pod update - < "172.20.0.3": successfully updated - > "172.20.0.4": starting update - > update kube-apiserver: v1.22.4 -> 1.23.0 - > "172.20.0.4": machine configuration patched - > "172.20.0.4": waiting for API server state pod update - < "172.20.0.4": successfully updated -updating "kube-controller-manager" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > "172.20.0.2": machine configuration patched - > "172.20.0.2": waiting for API server state pod update - < "172.20.0.2": successfully updated - > "172.20.0.3": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > "172.20.0.3": machine configuration patched - > "172.20.0.3": waiting for API server state pod update - < "172.20.0.3": successfully updated - > "172.20.0.4": starting update - > update kube-controller-manager: v1.22.4 -> 1.23.0 - > "172.20.0.4": machine configuration patched - > "172.20.0.4": waiting for API server state pod update - < "172.20.0.4": successfully updated -updating "kube-scheduler" to version "1.23.0" - > "172.20.0.2": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > "172.20.0.2": machine configuration patched - > "172.20.0.2": waiting for API server state pod update - < "172.20.0.2": successfully updated - > "172.20.0.3": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > "172.20.0.3": machine configuration patched - > "172.20.0.3": waiting for API server state pod update - < "172.20.0.3": successfully updated - > "172.20.0.4": starting update - > update kube-scheduler: v1.22.4 -> 1.23.0 - > "172.20.0.4": machine configuration patched - > "172.20.0.4": waiting for API server state pod update - < "172.20.0.4": successfully updated -updating daemonset "kube-proxy" to version "1.23.0" -updating kubelet to version "1.23.0" - > "172.20.0.2": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > "172.20.0.2": machine configuration patched - > "172.20.0.2": waiting for kubelet restart - > "172.20.0.2": waiting for node update - < "172.20.0.2": successfully updated - > "172.20.0.3": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > "172.20.0.3": machine configuration patched - > "172.20.0.3": waiting for kubelet restart - > "172.20.0.3": waiting for node update - < "172.20.0.3": successfully updated - > "172.20.0.4": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > "172.20.0.4": machine configuration patched - > "172.20.0.4": waiting for kubelet restart - > "172.20.0.4": waiting for node update - < "172.20.0.4": successfully updated - > "172.20.0.5": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > "172.20.0.5": machine configuration patched - > "172.20.0.5": waiting for kubelet restart - > "172.20.0.5": waiting for node update - < "172.20.0.5": successfully updated - > "172.20.0.6": starting update - > update kubelet: v1.22.4 -> 1.23.0 - > "172.20.0.6": machine configuration patched - > "172.20.0.6": waiting for kubelet restart - > "172.20.0.6": waiting for node update - < "172.20.0.6": successfully updated -updating manifests - > apply manifest Secret bootstrap-token-3lb63t - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding system-bootstrap-approve-node-client-csr - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding system-bootstrap-node-bootstrapper - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding system-bootstrap-node-renewal - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding system:default-sa - > apply skipped: nothing to update - > apply manifest ClusterRole psp:privileged - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding psp:privileged - > apply skipped: nothing to update - > apply manifest PodSecurityPolicy privileged - > apply skipped: nothing to update - > apply manifest ClusterRole flannel - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding flannel - > apply skipped: nothing to update - > apply manifest ServiceAccount flannel - > apply skipped: nothing to update - > apply manifest ConfigMap kube-flannel-cfg - > apply skipped: nothing to update - > apply manifest DaemonSet kube-flannel - > apply skipped: nothing to update - > apply manifest ServiceAccount kube-proxy - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding kube-proxy - > apply skipped: nothing to update - > apply manifest ServiceAccount coredns - > apply skipped: nothing to update - > apply manifest ClusterRoleBinding system:coredns - > apply skipped: nothing to update - > apply manifest ClusterRole system:coredns - > apply skipped: nothing to update - > apply manifest ConfigMap coredns - > apply skipped: nothing to update - > apply manifest Deployment coredns - > apply skipped: nothing to update - > apply manifest Service kube-dns - > apply skipped: nothing to update - > apply manifest ConfigMap kubeconfig-in-cluster - > apply skipped: nothing to update -``` - -Script runs in several phases: - -1. Every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. -2. The script updates `kube-proxy` daemonset with the new image version. -3. On every node in the cluster, `kubelet` version is updated. - The script waits for the `kubelet` service to be restarted, become healthy. - Update is verified with the `Node` resource state. -4. Kubernetes bootstrap manifests are re-applied to the cluster. - The script never deletes any resources from the cluster, they should be deleted manually. - Updated bootstrap manifests might come with new Talos version (e.g. CoreDNS version update), or might be result of machine configuration change. - -If the script fails for any reason, it can be safely restarted to continue upgrade process from the moment of the failure. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -### Bootstrap Manifests - -Bootstrap manifests can be retrieved in a format which works for `kubectl` with the following command: - -```bash -talosctl -n get manifests -o yaml | yq eval-all '.spec | .[] | splitDoc' - > manifests.yaml -``` - -Diff the manifests with the cluster: - -```bash -kubectl diff -f manifests.yaml -``` - -Apply the manifests: - -```bash -kubectl apply -f manifests.yaml -``` - -> Note: if some boostrap resources were removed, they have to be removed from the cluster manually. - -### kubelet - -For every node, patch machine configuration with new kubelet version, wait for the kubelet to restart with new version: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.23.0"}]' -patched mc at the node 172.20.0.2 -``` - -Once `kubelet` restarts with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.23.0 -``` diff --git a/website/content/v0.14/guides/upgrading-talos.md b/website/content/v0.14/guides/upgrading-talos.md deleted file mode 100644 index e47b4d57f..000000000 --- a/website/content/v0.14/guides/upgrading-talos.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -### After Upgrade to 0.14 - -No actions required. - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.14.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.14.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -Talos 0.14 enables cluster discovery by default for new clusters. -Cluster discovery feature won't be enabled after an upgrade if the feature wasn't enabled before the upgrade. diff --git a/website/content/v0.14/guides/vip.md b/website/content/v0.14/guides/vip.md deleted file mode 100644 index 3ae5ce5dd..000000000 --- a/website/content/v0.14/guides/vip.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Virtual IP's can also be configured on a VLAN interface. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 - vlans: - - vlanId: 100 - dhcp: true - vip: - ip: 192.168.1.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.14/introduction/_index.md b/website/content/v0.14/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.14/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.14/introduction/getting-started.md b/website/content/v0.14/introduction/getting-started.md deleted file mode 100644 index c90762549..000000000 --- a/website/content/v0.14/introduction/getting-started.md +++ /dev/null @@ -1,482 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -#### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -#### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.14.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.14.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.14.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.14.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [vmlinuz-amd64](https://github.com/siderolabs/talos/releases/download/v0.14.0/vmlinuz-amd64) [initramfs-amd64.xz](https://github.com/siderolabs/talos/releases/download/v0.14.0/initramfs-amd64.xz) -- ARM64: [vmlinuz-arm64](https://github.com/siderolabs/talos/releases/download/v0.14.0/vmlinuz-arm64) [initramfs-arm64.xz](https://github.com/siderolabs/talos/releases/download/v0.14.0/initramfs-arm64.xz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](../../reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `worker.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Worker - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Worker. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Worker Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Worker Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `worker.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp worker.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. - -The author of this document generally sets a single controlplane node to be the -default node, which provides the most flexible default operation while limiting -the scope of the disaster should a command be entered erroneously: - -```sh - talosctl --talosconfig=./talosconfig \ - config node 192.168.0.2 -``` - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -**IMPORTANT**: the bootstrap operation should only be called **ONCE** and only on a **SINGLE** -controlplane node! - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.14/introduction/quickstart.md b/website/content/v0.14/introduction/quickstart.md deleted file mode 100644 index 6c4e994b3..000000000 --- a/website/content/v0.14/introduction/quickstart.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -## Local Docker Cluster - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -### Prerequisites - -#### `talosctl` - -Download `talosctl`: - -##### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -##### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -#### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -### Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.14.0) containerd://1.5.5 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.14.0) containerd://1.5.5 -``` - -### Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.14/introduction/support-matrix.md b/website/content/v0.14/introduction/support-matrix.md deleted file mode 100644 index 7a6094c74..000000000 --- a/website/content/v0.14/introduction/support-matrix.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Support Matrix -weight: 6 ---- - -| Talos Version | 0.14 | 0.13 | -|----------------------------------------------------------------------------------------------------------------|------------------------------------|------------------------------------| -| Release Date | 2021-12-21 | 2021-10-11 (0.13.0) | -| End of Community Support | 1.0.0 release (2022-03-27, TBD) | 0.14.0 release (2021-12-21) | -| Enterprise Support | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | -| Kubernetes | 1.23, 1.22, 1.21 | 1.22, 1.21, 1.20 | -| Architecture | amd64, arm64 | -| **Platforms** | | | -| - cloud | AWS, GCP, Azure, Digital Ocean, Hetzner, OpenStack, Scaleway, Vultr, Upcloud | -| - bare metal | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | -| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | -| - SBCs | Raspberry Pi4, Banana Pi M64, Pine64, and other | -| - local | Docker, QEMU | -| **Cluster API** | | | -| [CAPI Bootstrap Provider Talos](https://github.com/talos-systems/cluster-api-bootstrap-provider-talos) | >= 0.4.3 | >= 0.3.0 | -| [CAPI Control Plane Provider Talos](https://github.com/talos-systems/cluster-api-control-plane-provider-talos) | >= 0.4.1 | >= 0.1.1 | -| [Sidero](https://www.sidero.dev/) | >= 0.4.1 | >= 0.3.0 | -| **UI** | | | -| [Theila](https://github.com/talos-systems/theila) | ✓ | ✓ | - -## Platform Tiers - -Tier 1: Automated tests, high-priority fixes. -Tier 2: Tested from time to time, medium-priority bugfixes. -Tier 3: Not tested by core Talos team, community tested. - -### Tier 1 - -* Metal -* AWS -* GCP - -### Tier 2 - -* Azure -* Digital Ocean -* OpenStack -* VMWare - -### Tier 3 - -* Hetzner -* nocloud -* Scaleway -* Vultr -* Upcloud diff --git a/website/content/v0.14/introduction/system-requirements.md b/website/content/v0.14/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.14/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.14/introduction/what-is-new.md b/website/content/v0.14/introduction/what-is-new.md deleted file mode 100644 index a386369ef..000000000 --- a/website/content/v0.14/introduction/what-is-new.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: What's New in Talos 0.14 -weight: 5 ---- - -### Kubelet - -Kubelet configuration can be updated without node restart (`.machine.kubelet` section of machine configuration) with commands -`talosctl edit mc --immediate`, `talosctl apply-config --immediate`, `talosctl patch mc --immediate`. - -Kubelet service can now be restarted with `talosctl service kubelet restart`. - -Kubelet node IP configuration (`.machine.kubelet.nodeIP.validSubnets`) can now include negative subnet matches (prefixed with `!`). - -### Kubernetes Upgrade Enhancements - -`talosctl upgrade-k8s` was improved to: - -* sync all boostrap manifest resources in the Kubernetes cluster with versions bundled with current version Talos -* upgrade `kubelet` to the version of the control plane components (without node reboot) - -So there is no need to update CoreDNS, Flannel container manually after running `upgrade-k8s` anymore. - -### Log Shipping - -Talos can now [ship system logs](../../guides/logging/) -to the configured destination using either JSON-over-UDP or JSON-over-TCP: -see `.machine.logging` machine configuration option. - -### NTP Sync - -Talos NTP sync process was improved to align better with kernel time adjustment periods and to filter out spikes. - -### `talosctl support` - -`talosctl` CLI tool now has a new subcommand `support` that gathers all -cluster information that could help with debugging in. - -Output of the command is a `zip` archive with all Talos service logs, Kubernetes pod logs and manifests, -Talos resources manifests and so on. -Generated archive does not contain any secret information, so it is safe to send it for analysis to a third party. - -### Component Updates - -* Linux: 5.15.6 -* etcd: 3.5.1 -* containerd: 1.5.8 -* runc: 1.0.3 -* Kubernetes: 1.23.1 -* CoreDNS: 1.8.6 -* Flannel (default CNI): 0.15.1 - -Talos is built with Go 1.17.5 - -### Cluster Discovery - -[Cluster Discovery](../../guides/discovery/) is enabled by default for Talos 0.14. -Cluster Discovery can be disabled with `talosctl gen config --with-cluster-discovery=false`. - -## Kexec and capabilities - -When kexec support is disabled -Talos no longer drops Linux capabilities (`CAP_SYS_BOOT` and `CAP_SYS_MODULES`) for child processes. -That is helpful for advanced use-cases like Docker-in-Docker. - -If you want to permanently disable kexec and capabilities dropping, pass `kexec_load_disabled=1` argument to the kernel. - -For example: - -```yaml -install: - extraKernelArgs: - - sysctl.kernel.kexec_load_disabled=1 -``` - -Please note that capabilities are dropped before machine configuration is loaded, -so disabling kexec via `machine.sysctls` will not be enough. - -### `installer` and `imager` images - -Talos supports two target architectures: `amd64` and `arm64`, so all Talos images are built for both `amd64` and `arm64`. - -New image `imager` was added which contains Talos assets for both architectures which allows to generate Talos disk images -cross-arch: e.g. generate Talos Raspberry PI disk image on `amd64` machine. - -As `installer` image is used only to do initial install and upgrades, it now contains Talos assets for a specific architecture. -This reduces size of the `installer` image leading to faster upgrades and less memory usage. - -There are no user-visible changes except that now `imager` container image should be used to produce Talos disk images. - -### SideroLink - -A set of Talos ehancements is going to unlock a number of exciting features in the upcoming release of [Sidero](https://www.sidero.dev/): - -* `SideroLink`: a point-to-point Wireguard tunnel connecting Talos node back to the provisioning platform (Sidero). -* event sink (kernel arg `talos.event.sink=http://10.0.0.1:4000`) delivers Talos internal events to the specified destination. -* kmsg log delivery (kernel arg `talos.logging.kernel=tcp://10.0.0.1:4001`) sends kernel logs as JSON lines over TCP or UDP. - -### VLAN Enhancements - -Talos now supports setting MTU and Virtual IPs on VLAN interfaces. diff --git a/website/content/v0.14/introduction/what-is-talos.md b/website/content/v0.14/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.14/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.14/learn-more/_index.md b/website/content/v0.14/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.14/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.14/learn-more/architecture.md b/website/content/v0.14/learn-more/architecture.md deleted file mode 100644 index abdec8761..000000000 --- a/website/content/v0.14/learn-more/architecture.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## File system partitions - -Talos uses these partitions with the following labels: - -1. **EFI** - stores EFI boot data. -1. **BIOS** - used for GRUB's second stage boot. -1. **BOOT** - used for the boot loader, stores initramfs and kernel data. -1. **META** - stores metadata about the talos node, such as node id's. -1. **STATE** - stores machine configuration, node identity data for cluster discovery and KubeSpan info -1. **EPHEMERAL** - stores ephemeral state information, mounted at `/var` - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.14/learn-more/components.md b/website/content/v0.14/learn-more/components.md deleted file mode 100644 index eed0fdee7..000000000 --- a/website/content/v0.14/learn-more/components.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.14/learn-more/control-plane.md b/website/content/v0.14/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.14/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.14/learn-more/controllers-resources.md b/website/content/v0.14/learn-more/controllers-resources.md deleted file mode 100644 index d46cfae4e..000000000 --- a/website/content/v0.14/learn-more/controllers-resources.md +++ /dev/null @@ -1,229 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, -listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v0.14/learn-more/developing-talos.md b/website/content/v0.14/learn-more/developing-talos.md deleted file mode 100644 index 0ff56b9d5..000000000 --- a/website/content/v0.14/learn-more/developing-talos.md +++ /dev/null @@ -1,233 +0,0 @@ ---- -title: "Developing Talos" -weight: 13 ---- - -This guide outlines steps and tricks to develop Talos operating systems and related components. -The guide assumes Linux operating system on the development host. -Some steps might work under Mac OS X, but using Linux is highly advised. - -## Prepare - -Check out the [Talos repository](https://github.com/talos-systems/talos). - -Try running `make help` to see available `make` commands. -You would need Docker and `buildx` installed on the host. - -> Note: Usually it is better to install up to date Docker from Docker apt repositories, e.g. [Ubuntu instructions](https://docs.docker.com/engine/install/ubuntu/). -> -> If `buildx` plugin is not available with OS docker packages, it can be installed [as a plugin from GitHub releases](https://docs.docker.com/buildx/working-with-buildx/#install). - -Set up a builder with access to the host network: - -```bash - docker buildx create --driver docker-container --driver-opt network=host --name local1 --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use -``` - -> Note: `network=host` allows buildx builder to access host network, so that it can push to a local container registry (see below). - -Make sure the following steps work: - -- `make talosctl` -- `make initramfs kernel` - -Set up a local docker registry: - -```bash -docker run -d -p 5005:5000 \ - --restart always \ - --name local registry:2 -``` - -Try to build and push to local registry an installer image: - -```bash -make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true -``` - -Record the image name output in the step above. - -> Note: it is also possible to force a stable image tag by using `TAG` variable: `make installer IMAGE_REGISTRY=127.0.0.1:5005 TAG=v1.0.0-beta.1 PUSH=true`. - -## Running Talos cluster - -Set up local caching docker registries (this speeds up Talos cluster boot a lot), script is in the Talos repo: - -```bash -bash hack/start-registry-proxies.sh -``` - -Start your local cluster with: - -```bash -sudo -E _out/talosctl-linux-amd64 cluster create \ - --provisioner=qemu \ - --cidr=172.20.0.0/24 \ - --registry-mirror docker.io=http://172.20.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.20.0.1:5001 \ - --registry-mirror quay.io=http://172.20.0.1:5002 \ - --registry-mirror gcr.io=http://172.20.0.1:5003 \ - --registry-mirror ghcr.io=http://172.20.0.1:5004 \ - --registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005 \ - --install-image=127.0.0.1:5005/talos-systems/installer: \ - --masters 3 \ - --workers 2 \ - --with-bootloader=false -``` - -- `--provisioner` selects QEMU vs. default Docker -- custom `--cidr` to make QEMU cluster use different network than default Docker setup (optional) -- `--registry-mirror` uses the caching proxies set up above to speed up boot time a lot, last one adds your local registry (installer image was pushed to it) -- `--install-image` is the image you built with `make installer` above -- `--masters` & `--workers` configure cluster size, choose to match your resources; 3 masters give you HA control plane; 1 master is enough, never do 2 masters -- `--with-bootloader=false` disables boot from disk (Talos will always boot from `_out/vmlinuz-amd64` and `_out/initramfs-amd64.xz`). - This speeds up development cycle a lot - no need to rebuild installer and perform install, rebooting is enough to get new code. - -> Note: as boot loader is not used, it's not necessary to rebuild `installer` each time (old image is fine), but sometimes it's needed (when configuration changes are done and old installer doesn't validate the config). -> -> `talosctl cluster create` derives Talos machine configuration version from the install image tag, so sometimes early in the development cycle (when new minor tag is not released yet), machine config version can be overridden with `--talos-version=v0.14`. - -If the `--with-bootloader=false` flag is not enabled, for Talos cluster to pick up new changes to the code (in `initramfs`), it will require a Talos upgrade (so new `installer` should be built). -With `--with-bootloader=false` flag, Talos always boots from `initramfs` in `_out/` directory, so simple reboot is enough to pick up new code changes. - -If the installation flow needs to be tested, `--with-bootloader=false` shouldn't be used. - -## Console Logs - -Watching console logs is easy with `tail`: - -```bash -tail -F ~/.talos/clusters/talos-default/talos-default-*.log -``` - -## Interacting with Talos - -Once `talosctl cluster create` finishes successfully, `talosconfig` and `kubeconfig` will be set up automatically to point to your cluster. - -Start playing with `talosctl`: - -```bash -talosctl -n 172.20.0.2 version -talosctl -n 172.20.0.3,172.20.0.4 dashboard -talosctl -n 172.20.0.4 get members -``` - -Same with `kubectl`: - -```bash -kubectl get nodes -o wide -``` - -You can deploy some Kubernetes workloads to the cluster. - -You can edit machine config on the fly with `talosctl edit mc --immediate`, config patches can be applied via `--config-patch` flags, also many features have specific flags in `talosctl cluster create`. - -## Quick Reboot - -To reboot whole cluster quickly (e.g. to pick up a change made in the code): - -```bash -for socket in ~/.talos/clusters/talos-default/talos-default-*.monitor; do echo "q" | sudo socat - unix-connect:$socket; done -``` - -Sending `q` to a single socket allows to reboot a single node. - -> Note: This command performs immediate reboot (as if the machine was powered down and immediately powered back up), for normal Talos reboot use `talosctl reboot`. - -## Development Cycle - -Fast development cycle: - -- bring up a cluster -- make code changes -- rebuild `initramfs` with `make initramfs` -- reboot a node to pick new `initramfs` -- verify code changes -- more code changes... - -Some aspects of Talos development require to enable bootloader (when working on `installer` itself), in that case quick development cycle is no longer possible, and cluster should be destroyed and recreated each time. - -## Running Integration Tests - -If integration tests were changed (or when running them for the first time), first rebuild the integration test binary: - -```bash -rm -f _out/integration-test-linux-amd64; make _out/integration-test-linux-amd64 -``` - -Running short tests against QEMU provisioned cluster: - -```bash -_out/integration-test-linux-amd64 \ - -talos.provisioner=qemu \ - -test.v \ - -talos.crashdump=false \ - -test.short \ - -talos.talosctlpath=$PWD/_out/talosctl-linux-amd64 -``` - -Whole test suite can be run removing `-test.short` flag. - -Specfic tests can be run with `-test.run=TestIntegration/api.ResetSuite`. - -## Build Flavors - -`make WITH_RACE=1` enables Go race detector, Talos runs slower and uses more memory, but memory races are detected. - -`make WITH_DEBUG=1` enables Go profiling and other debug features, useful for local development. - -## Destroying Cluster - -```bash -sudo -E ../talos/_out/talosctl-linux-amd64 cluster destroy --provisioner=qemu -``` - -This command stops QEMU and helper processes, tears down bridged network on the host, and cleans up -cluster state in `~/.talos/clusters`. - -> Note: if the host machine is rebooted, QEMU instances and helpers processes won't be started back. -> In that case it's required to clean up files in `~/.talos/clusters/` directory manually. - -## Optional - -Set up cross-build environment with: - -```bash -docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -``` - -> Note: the static qemu binaries which come with Ubuntu 21.10 seem to be broken. - -## Unit tests - -Unit tests can be run in buildx with `make unit-tests`, on Ubuntu systems some tests using `loop` devices will fail because Ubuntu uses low-index `loop` devices for snaps. - -Most of the unit-tests can be run standalone as well, with regular `go test`, or using IDE integration: - -```bash -go test -v ./internal/pkg/circular/ -``` - -This provides much faster feedback loop, but some tests require either elevated privileges (running as `root`) or additional binaries available only in Talos `rootfs` (containerd tests). - -Running tests as root can be done with `-exec` flag to `go test`, but this is risky, as test code has root access and can potentially make undesired changes: - -```bash -go test -exec sudo -v ./internal/app/machined/pkg/controllers/network/... -``` - -## Go Profiling - -Build `initramfs` with debug enabled: `make initramfs WITH_DEBUG=1`. - -Launch Talos cluster with bootloader disabled, and use `go tool pprof` to capture the profile and show the output in your browser: - -```bash -go tool pprof http://172.20.0.2:9982/debug/pprof/heap -``` - -The IP address `172.20.0.2` is the address of the Talos node, and port `:9982` depends on the Go application to profile: - -- 9981: `apid` -- 9982: `machined` -- 9983: `trustd` diff --git a/website/content/v0.14/learn-more/discovery.md b/website/content/v0.14/learn-more/discovery.md deleted file mode 100644 index c4c1df98a..000000000 --- a/website/content/v0.14/learn-more/discovery.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: "Discovery" -weight: 11 ---- - -We maintain a public discovery service whereby members of your cluster can use a common and unique key to coordinate the most basic connection information (i.e. the set of possible "endpoints", or IP:port pairs). -We call this data "affiliate data." - -> Note: If KubeSpan is enabled the data has the addition of the WireGuard public key. - -Before sending data to the discovery service, Talos will encrypt the affiliate data with AES-GCM encryption and separately encrypt endpoints with AES in ECB mode so that endpoints coming from different sources can be deduplicated server-side. -Each node submits it's data encrypted plus it submits the endpoints it sees from other peers to the discovery service -The discovery service aggregates the data, deduplicates the endpoints, and sends updates to each connected peer. -Each peer receives information back about other affiliates from the discovery service, decrypts it and uses it to drive KubeSpan and cluster discovery. -Moreover, the discovery service has no persistence. -Data is stored in memory only with a TTL set by the clients (i.e. Talos). -The cluster ID is used as a key to select the affiliates (so that different clusters see different affiliates). - -To summarize, the discovery service knows the client version, cluster ID, the number of affiliates, some encrypted data for each affiliate, and a list of encrypted endpoints. diff --git a/website/content/v0.14/learn-more/faqs.md b/website/content/v0.14/learn-more/faqs.md deleted file mode 100644 index f6738804f..000000000 --- a/website/content/v0.14/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remediation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.14/learn-more/kubespan.md b/website/content/v0.14/learn-more/kubespan.md deleted file mode 100644 index 685914121..000000000 --- a/website/content/v0.14/learn-more/kubespan.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: "KubeSpan" -weight: 12 ---- - -## WireGuard Peer Discovery - -The key pieces of information needed for WireGuard generally are: - -- the public key of the host you wish to connect to -- an IP address and port of the host you wish to connect to - -The latter is really only required of _one_ side of the pair. -Once traffic is received, that information is known and updated by WireGuard automatically and internally. - -For Kubernetes, though, this is not quite sufficient. -Kubernetes also needs to know which traffic goes to which WireGuard peer. -Because this information may be dynamic, we need a way to be able to constantly keep this information up to date. - -If we have a functional connection to Kubernetes otherwise, it's fairly easy: we can just keep that information in Kubernetes. -Otherwise, we have to have some way to discover it. - -In our solution, we have a multi-tiered approach to gathering this information. -Each tier can operate independently, but the amalgamation of the tiers produces a more robust set of connection criteria. - -For this discussion, we will point out two of these tiers: - -- an external service -- a Kubernetes-based system - -See [discovery service](../discovery) to learn more about the external service. - -The Kubernetes-based system utilises annotations on Kubernetes Nodes which describe each node's public key and local addresses. - -On top of this, we also route Pod subnets. -This is often (maybe even usually) taken care of by the CNI, but there are many situations where the CNI fails to be able to do this itself, across networks. -So we also scrape the Kubernetes Node resource to discover its `podCIDRs`. - -## NAT, Multiple Routes, Multiple IPs - -One of the difficulties in communicating across networks is that there is often not a single address and port which can identify a connection for each node on the system. -For instance, a node sitting on the same network might see its peer as `192.168.2.10`, but a node across the internet may see it as `2001:db8:1ef1::10`. - -We need to be able to handle any number of addresses and ports, and we also need to have a mechanism to _try_ them. -WireGuard only allows us to select one at a time. - -For our implementation, then, we have built a controller which continuously discovers and rotates these IP:port pairs until a connection is established. -It then starts trying again if that connection ever fails. - -## Packet Routing - -After we have established a WireGuard connection, our work is not done. -We still have to make sure that the right packets get sent to the WireGuard interface. - -WireGuard supplies a convenient facility for tagging packets which come from _it_, which is great. -But in our case, we need to be able to allow traffic which both does _not_ come from WireGuard and _also_ is not destined for another Kubernetes node to flow through the normal mechanisms. - -Unlike many corporate or privacy-oriented VPNs, we need to allow general internet traffic to flow normally. - -Also, as our cluster grows, this set of IP addresses can become quite large and quite dynamic. -This would be very cumbersome and slow in `iptables`. -Luckily, the kernel supplies a convenient mechanism by which to define this arbitrarily large set of IP addresses: IP sets. - -Talos collects all of the IPs and subnets which are considered "in-cluster" and maintains these in the kernel as an IP set. - -Now that we have the IP set defined, we need to tell the kernel how to use it. - -The traditional way of doing this would be to use `iptables`. -However, there is a big problem with IPTables. -It is a common namespace in which any number of other pieces of software may dump things. -We have no surety that what we add will not be wiped out by something else (from Kubernetes itself, to the CNI, to some workload application), be rendered unusable by higher-priority rules, or just generally cause trouble and conflicts. - -Instead, we use a three-pronged system which is both more foundational and less centralised. - -NFTables offers a separately namespaced, decentralised way of marking packets for later processing based on IP sets. -Instead of a common set of well-known tables, NFTables uses hooks into the kernel's netfilter system, which are less vulnerable to being usurped, bypassed, or a source of interference than IPTables, but which are rendered down by the kernel to the same underlying XTables system. - -Our NFTables system is where we store the IP sets. -Any packet which enters the system, either by forward from inside Kubernetes or by generation from the host itself, is compared against a hash table of this IP set. -If it is matched, it is marked for later processing by our next stage. -This is a high-performance system which exists fully in the kernel and which ultimately becomes an eBPF program, so it scales well to hundreds of nodes. - -The next stage is the kernel router's route rules. -These are defined as a common ordered list of operations for the whole operating system, but they are intended to be tightly constrained and are rarely used by applications in any case. -The rules we add are very simple: if a packet is marked by our NFTables system, send it to an alternate routing table. - -This leads us to our third and final stage of packet routing. -We have a custom routing table with two rules: - -- send all IPv4 traffic to the WireGuard interface -- send all IPv6 traffic to the WireGuard interface - -So in summary, we: - -- mark packets destined for Kubernetes applications or Kubernetes nodes -- send marked packets to a special routing table -- send anything which is sent to that routing table through the WireGuard interface - -This gives us an isolated, resilient, tolerant, and non-invasive way to route Kubernetes traffic safely, automatically, and transparently through WireGuard across almost any set of network topologies. diff --git a/website/content/v0.14/learn-more/networking-resources.md b/website/content/v0.14/learn-more/networking-resources.md deleted file mode 100644 index f9e58a549..000000000 --- a/website/content/v0.14/learn-more/networking-resources.md +++ /dev/null @@ -1,394 +0,0 @@ ---- -title: "Networking Resources" -weight: 10 ---- - -Starting with version 0.11, a new implementation of the network configuration subsystem is powered by [COSI](../controllers-resources/). -The new implementation is still using the same machine configuration file format and external sources to configure a node's network, so there should be no difference -in the way Talos works in 0.11. - -The most notable change in Talos 0.11 is that all changes to machine configuration `.machine.network` can be applied now in immediate mode (without a reboot) via -`talosctl edit mc --immediate` or `talosctl apply-config --immediate`. - -## Resources - -There are six basic network configuration items in Talos: - -* `Address` (IP address assigned to the interface/link); -* `Route` (route to a destination); -* `Link` (network interface/link configuration); -* `Resolver` (list of DNS servers); -* `Hostname` (node hostname and domainname); -* `TimeServer` (list of NTP servers). - -Each network configuration item has two counterparts: - -* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); -* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. - -| Resource | Status | Spec | -|--------------------|------------------------|----------------------| -| `Address` | `AddressStatus` | `AddressSpec` | -| `Route` | `RouteStatus` | `RouteSpec` | -| `Link` | `LinkStatus` | `LinkSpec` | -| `Resolver` | `ResolverStatus` | `ResolverSpec` | -| `Hostname` | `HostnameStatus` | `HostnameSpec` | -| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | - -Status resources have aliases with the `Status` suffix removed, so for example -`AddressStatus` is also available as `Address`. - -Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. - -## Observing State - -The current network configuration state can be observed by querying `*Status` resources via -`talosctl`: - -```sh -$ talosctl get addresses -NODE NAMESPACE TYPE ID VERSION ADDRESS LINK -172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 -172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 -172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 -172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 -172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo -172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo -``` - -In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and -addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). - -Talos networking controllers watch the kernel state and update resources -accordingly. - -Additional details about the address can be accessed via the YAML output: - -```sh -$ talosctl get address eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressStatuses.net.talos.dev - id: eth0/172.20.0.2/24 - version: 1 - owner: network.AddressStatusController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - address: 172.20.0.2/24 - local: 172.20.0.2 - broadcast: 172.20.0.255 - linkIndex: 4 - linkName: eth0 - family: inet4 - scope: global - flags: permanent -``` - -Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. - -Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. -For example: - -```sh -$ talosctl get resolvers -NODE NAMESPACE TYPE ID VERSION RESOLVERS -172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] -``` - -## Inspecting Configuration - -The desired networking configuration is combined from multiple sources and presented -as `*Spec` resources: - -```sh -$ talosctl get addressspecs -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 -172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 -172.20.0.2 network AddressSpec lo/::1/128 2 -``` - -These `AddressSpecs` are applied to the Linux kernel to reach the desired state. -If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. - -`*Spec` resources can't be manipulated directly, they are generated automatically by Talos -from multiple configuration sources (see a section below for details). - -If a `*Spec` resource is queried in YAML format, some additional information is available: - -```sh -$ talosctl get addressspecs eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressSpecs.net.talos.dev - id: eth0/172.20.0.2/24 - version: 2 - owner: network.AddressMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.AddressSpecController -spec: - address: 172.20.0.2/24 - linkName: eth0 - family: inet4 - scope: global - flags: permanent - layer: operator -``` - -An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. - -## Configuration Merging - -Spec resources described in the previous section show the final merged configuration state, -while initial specs are put to a different unmerged namespace `network-config`. -Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. - -Let's take `HostnameSpec` as an example. -The final merged representation is: - -```sh -$ talosctl get hostnamespec -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: HostnameSpecs.net.talos.dev - id: hostname - version: 2 - owner: network.HostnameMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.HostnameSpecController -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that the final configuration for the hostname is `talos-default-master-1`. -And this is the hostname that was actually applied. -This can be verified by querying a `HostnameStatus` resource: - -```sh -$ talosctl get hostnamestatus -NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME -172.20.0.2 network HostnameStatus hostname 1 talos-default-master-1 -``` - -Initial configuration for the hostname in the `network-config` namespace is: - -```sh -$ talosctl get hostnamespec -o yaml --namespace network-config -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: default/hostname - version: 2 - owner: network.HostnameConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-172-20-0-2 - domainname: "" - layer: default ---- -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: dhcp4/eth0/hostname - version: 1 - owner: network.OperatorSpecController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that there are two specs for the hostname: - -* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); -* another one from the layer `operator` that defines the hostname as `talos-default-master-1` (DHCP). - -Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. -Here is the order of precedence from low to high: - -* `default` (defaults provided by Talos); -* `cmdline` (from the kernel command line); -* `platform` (driven by the cloud provider); -* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); -* `configuration` (derived from the machine configuration). - -So in our example the `operator` layer `HostnameSpec` overwrites the `default` layer producing the final hostname `talos-default-master-1`. - -The merge process applies to all six core networking specs. -For each spec, the `layer` controls the merge behavior -If multiple configuration specs -appear at the same layer, they can be merged together if possible, otherwise merge result -is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). - -`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. - -## Network Operators - -Network operators provide dynamic network configuration which can change over time as the node is running: - -* DHCPv4 -* DHCPv6 -* Virtual IP - -Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. - -Operators are configured with `OperatorSpec` resources which describe when operators -should run and additional configuration for the operator: - -```sh -$ talosctl get operatorspecs -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: OperatorSpecs.net.talos.dev - id: dhcp4/eth0 - version: 1 - owner: network.OperatorConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - operator: dhcp4 - linkName: eth0 - requireUp: true - dhcp4: - routeMetric: 1024 -``` - -`OperatorSpec` resources are generated by Talos based on machine configuration mostly. -DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. -This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. - -Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: - -```sh -$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 -``` - -## Other Network Resources - -There are some additional resources describing the network subsystem state. - -The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: - -```sh -$ talosctl get nodeaddresses -NODE NAMESPACE TYPE ID VERSION ADDRESSES -10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] -``` - -* `default` is the node default address; -* `current` is the set of addresses a node currently has; -* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). - -`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. - -Another important resource is `Nodename` which provides `Node` name in Kubernetes: - -```sh -$ talosctl get nodename -NODE NAMESPACE TYPE ID VERSION NODENAME -10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v -``` - -Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. - -`NetworkStatus` aggregates the current state of the network configuration: - -```sh -$ talosctl get networkstatus -o yaml -node: 10.100.2.23 -metadata: - namespace: network - type: NetworkStatuses.net.talos.dev - id: status - version: 5 - owner: network.StatusController - phase: running - created: 2021-06-24T18:56:00Z - updated: 2021-06-24T18:56:02Z -spec: - addressReady: true - connectivityReady: true - hostnameReady: true - etcFilesReady: true -``` - -## Network Controllers - -For each of the six basic resource types, there are several controllers: - -* `*StatusController` populates `*Status` resources observing the Linux kernel state. -* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. -* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. -* `*SpecController` applies merged `*Spec` resources to the kernel state. - -For the network operators: - -* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. -* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. - -## Configuration Sources - -There are several configuration sources for the network configuration, which are described in this section. - -### Defaults - -* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; -* hostname is set to the `talos-` where `IP` is the default node address; -* resolvers are set to `8.8.8.8`, `1.1.1.1`; -* time servers are set to `pool.ntp.org`; -* DHCP4 operator is run on any physical interface which is not configured explicitly. - -### Cmdline - -The kernel command line is parsed for the following options: - -* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; -* `talos.hostname=` option is used to set node hostname; -* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. - -### Platform - -Platform configuration delivers cloud environment-specific options (e.g. the hostname). - -### Operator - -Network operators provide configuration for all basic resource types. - -### Machine Configuration - -The machine configuration is parsed for link configuration, addresses, routes, hostname, -resolvers and time servers. -Any changes to `.machine.network` configuration can be applied in immediate mode. - -## Network Configuration Debugging - -Most of the network controller operations and failures are logged to the kernel console, -additional logs with `debug` level are available with `talosctl logs controller-runtime` command. -If the network configuration can't be established and the API is not available, `debug` level -logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v0.14/learn-more/philosophy.md b/website/content/v0.14/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.14/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.14/learn-more/talosctl.md b/website/content/v0.14/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.14/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.14/learn-more/upgrades.md b/website/content/v0.14/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.14/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.14/local-platforms/_index.md b/website/content/v0.14/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.14/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.14/local-platforms/docker.md b/website/content/v0.14/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.14/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.14/local-platforms/qemu.md b/website/content/v0.14/local-platforms/qemu.md deleted file mode 100644 index c0f70ba4f..000000000 --- a/website/content/v0.14/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.14.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.14.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.14.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.14.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Worker 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.14/local-platforms/virtualbox.md b/website/content/v0.14/local-platforms/virtualbox.md deleted file mode 100644 index f194a45e2..000000000 --- a/website/content/v0.14/local-platforms/virtualbox.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.14.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.14.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig kubeconfig . -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.14/reference/_index.md b/website/content/v0.14/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.14/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.14/reference/api.md b/website/content/v0.14/reference/api.md deleted file mode 100644 index 59e4a9f54..000000000 --- a/website/content/v0.14/reference/api.md +++ /dev/null @@ -1,3273 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - - - [File-level Extensions](#common/common.proto-extensions) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [AddressEvent](#machine.AddressEvent) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [ConfigLoadErrorEvent](#machine.ConfigLoadErrorEvent) - - [ConfigValidationErrorEvent](#machine.ConfigValidationErrorEvent) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FeaturesInfo](#machine.FeaturesInfo) - - [FileInfo](#machine.FileInfo) - - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) - - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) - - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootRequest](#machine.RebootRequest) - - [RebootResponse](#machine.RebootResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RebootRequest.Mode](#machine.RebootRequest.Mode) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - -### File-level Extensions -| Extension | Type | Base | Number | Description | -| --------- | ---- | ---- | ------ | ----------- | -| remove_deprecated_enum | string | .google.protobuf.EnumOptions | 93117 | Indicates the Talos version when this deprecated enum will be removed from API. | -| remove_deprecated_enum_value | string | .google.protobuf.EnumValueOptions | 93117 | Indicates the Talos version when this deprecated enum value will be removed from API. | -| remove_deprecated_field | string | .google.protobuf.FieldOptions | 93117 | Indicates the Talos version when this deprecated filed will be removed from API. | -| remove_deprecated_message | string | .google.protobuf.MessageOptions | 93117 | Indicates the Talos version when this deprecated message will be removed from API. | -| remove_deprecated_method | string | .google.protobuf.MethodOptions | 93117 | Indicates the Talos version when this deprecated method will be removed from API. | -| remove_deprecated_service | string | .google.protobuf.ServiceOptions | 93117 | Indicates the Talos version when this deprecated service will be removed from API. | - - - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | -| INPUT_DESTROY_READY | 4 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### AddressEvent -AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| addresses | [string](#string) | repeated | | - - - - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### ConfigLoadErrorEvent -ConfigLoadErrorEvent is reported when the config loading has failed. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| error | [string](#string) | | | - - - - - - - - -### ConfigValidationErrorEvent -ConfigValidationErrorEvent is reported when config validation has failed. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| error | [string](#string) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | -| is_learner | [bool](#bool) | | learner flag | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FeaturesInfo -FeaturesInfo describes individual Talos features that can be switched on or off. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | -| uid | [uint32](#uint32) | | Owner uid | -| gid | [uint32](#uint32) | | Owner gid | - - - - - - - - -### GenerateClientConfiguration - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | -| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | -| key | [bytes](#bytes) | | PEM-encoded generated client key. | -| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | - - - - - - - - -### GenerateClientConfigurationRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| roles | [string](#string) | repeated | Roles in the generated client certificate. | -| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | - - - - - - - - -### GenerateClientConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesResponse -rpc processes - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootRequest -rpc reboot - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| mode | [RebootRequest.Mode](#machine.RebootRequest.Mode) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | -| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_WORKER | 3 | | -| TYPE_JOIN | 3 | Deprecated alias for TYPE_WORKER. It will be removed in v0.15. | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RebootRequest.Mode - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| DEFAULT | 0 | | -| POWERCYCLE | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | Bootstrap method makes control plane node enter etcd bootstrap mode. - -Node aborts etcd join sequence and creates single-node etcd cluster. - -If recover_etcd argument is specified, etcd is recovered from a snapshot uploaded with EtcdRecover. | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [RebootRequest](#machine.RebootRequest) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | -| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| created | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| updated | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| tail_events | [uint32](#uint32) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.14/reference/cli.md b/website/content/v0.14/reference/cli.md deleted file mode 100644 index deffa9324..000000000 --- a/website/content/v0.14/reference/cli.md +++ /dev/null @@ -1,2163 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --bad-rtc launch VM with bad RTC state (QEMU only) - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.14.0-alpha.2/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - --extra-boot-kernel-args string add extra kernel args to the initial boot from vmlinuz and initramfs (QEMU only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.23.1") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-cluster-discovery enable cluster discovery (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-kubespan enable KubeSpan system - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or QEMU-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash, fish or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash, fish or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for fish[1] into the current shell - talosctl completion fish | source -# Set the talosctl completion code for fish[1] to autoload on startup - talosctl completion fish > ~/.config/fish/completions/talosctl.fish -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup - talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config contexts - -List defined contexts - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config info - -Show information about the current context - -``` -talosctl config info [flags] -``` - -### Options - -``` - -h, --help help for info -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config merge - -Merge additional contexts from another client configuration file - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config new - -Generate a new client configuration file - -``` -talosctl config new [] [flags] -``` - -### Options - -``` - --crt-ttl duration certificate TTL (default 87600h0m0s) - -h, --help help for new - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config - -Manage the client configuration file (talosconfig) - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config info](#talosctl-config-info) - Show information about the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file -* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use -a control plane node, common in a single node control plane setup, use port 6443 as -this is the port that the API server binds to on every control plane node. For an HA -setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch string patch generated machineconfigs (applied to all node types) - --config-patch-control-plane string patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker string patch generated machineconfigs (applied to 'worker' type) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-cluster-discovery enable cluster discovery feature (default true) - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) - --with-kubespan enable KubeSpan feature -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -### Synopsis - -Similar to 'kubectl get', 'talosctl get' returns a set of resources from the OS. -To get a list of all available resource definitions, issue 'talosctl get rd' - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - -i, --insecure get resources using the insecure (encrypted with no auth) maintenance service - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (json, table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot - -m, --mode string select the reboot mode: "default", "powercyle" (skips kexec) (default "default") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl support - -Dump debug information about the cluster - -### Synopsis - -Generated bundle contains the following debug information: - -- For each node: - - - Kernel logs. - - All Talos internal services logs. - - All kube-system pods logs. - - Talos COSI resources without secrets. - - COSI runtime state graph. - - Processes snapshot. - - IO pressure snapshot. - - Mounts list. - - PCI devices info. - - Talos version. - -- For the cluster: - - - Kubernetes nodes and kube-system pods manifests. - - -``` -talosctl support [flags] -``` - -### Options - -``` - -h, --help help for support - -w, --num-workers int number of workers per node (default 1) - -O, --output string output file to write support archive to - -v, --verbose verbose output -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --dry-run skip the actual upgrade and show the upgrade plan instead - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.23.1") - --upgrade-kubelet upgrade kubelet service (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash, fish or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl support](#talosctl-support) - Dump debug information about the cluster -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.14/reference/configuration.md b/website/content/v0.14/reference/configuration.md deleted file mode 100644 index 75af2207b..000000000 --- a/website/content/v0.14/reference/configuration.md +++ /dev/null @@ -1,5853 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: - - talosctl gen config --version v1alpha1 - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
-
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
-
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - -This node type was previously known as "join"; that value is still supported but deprecated. - - -Valid values: - - - - init - - - controlplane - - - worker -
- -
-
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
-
- -controlPlane MachineControlPlaneConfig - -
-
- -Provides machine specific contolplane configuration options. - - - -Examples: - - -``` yaml -controlPlane: - # Controller manager machine specific configuration options. - controllerManager: - disabled: false # Disable kube-controller-manager on the node. - # Scheduler machine specific configuration options. - scheduler: - disabled: true # Disable kube-scheduler on the node. -``` - - -
- -
-
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.23.1 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - bind - # - rshared - # - rw - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 -``` - - -
- -
-
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. -``` - - -
- -
-
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
-
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
-
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
-
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com - bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -``` - - -
- -
-
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
-
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
-
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - - -
- -
-
- -features FeaturesConfig - -
-
- -Features describe individual Talos features that can be switched on or off. - - - -Examples: - - -``` yaml -features: - rbac: true # Enable role-based access control (RBAC). -``` - - -
- -
-
- -udev UdevConfig - -
-
- -Configures the udev system. - - - -Examples: - - -``` yaml -udev: - # List of udev rules to apply to the udev system - rules: - - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" -``` - - -
- -
-
- -logging LoggingConfig - -
-
- -Configures the logging system. - - - -Examples: - - -``` yaml -logging: - # Logging destination. - destinations: - - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - format: json_lines # Logs format. -``` - - -
- -
- - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -id string - -
-
- -Globally unique identifier for this cluster (base64 encoded random 32 bytes). - -
- -
-
- -secret string - -
-
- -Shared secret of cluster (base64 encoded random 32 bytes). -This secret is shared among cluster members but should never be sent over the network. - -
- -
-
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
-
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
-
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
-
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
-
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.23.1 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
-
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.23.1 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
-
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.23.1 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
-
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.23.1 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
-
- -discovery ClusterDiscoveryConfig - -
-
- -Configures cluster member discovery. - - - -Examples: - - -``` yaml -discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -``` - - -
- -
-
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.5.1 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" - - # # The subnet from which the advertise URL should be. - # subnet: 10.0.0.0/8 -``` - - -
- -
-
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.6 # The `image` field is an override to the default coredns image. -``` - - -
- -
-
- -externalCloudProvider ExternalCloudProviderConfig - -
-
- -External cloud provider configuration. - - - -Examples: - - -``` yaml -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
-
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
-
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the extraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
-
- -inlineManifests ClusterInlineManifests - -
-
- -A list of inline Kubernetes manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -``` - - -
- -
-
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
-
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - -## ExtraMount -ExtraMount wraps OCI Mount specification. - -Appears in: - -- KubeletConfig.extraMounts - - -``` yaml -- destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -``` - - - - -## MachineControlPlaneConfig -MachineControlPlaneConfig machine specific configuration options. - -Appears in: - -- MachineConfig.controlPlane - - -``` yaml -# Controller manager machine specific configuration options. -controllerManager: - disabled: false # Disable kube-controller-manager on the node. -# Scheduler machine specific configuration options. -scheduler: - disabled: true # Disable kube-scheduler on the node. -``` - -
- -
- -controllerManager MachineControllerManagerConfig - -
-
- -Controller manager machine specific configuration options. - -
- -
-
- -scheduler MachineSchedulerConfig - -
-
- -Scheduler machine specific configuration options. - -
- -
- - - -## MachineControllerManagerConfig -MachineControllerManagerConfig represents the machine specific ControllerManager config values. - -Appears in: - -- MachineControlPlaneConfig.controllerManager - - - -
- -
- -disabled bool - -
-
- -Disable kube-controller-manager on the node. - -
- -
- - - -## MachineSchedulerConfig -MachineSchedulerConfig represents the machine specific Scheduler config values. - -Appears in: - -- MachineControlPlaneConfig.scheduler - - - -
- -
- -disabled bool - -
-
- -Disable kube-scheduler on the node. - -
- -
- - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.23.1 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. -# clusterDNS: -# - 10.96.0.10 -# - 169.254.2.53 - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - bind -# - rshared -# - rw - -# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. -# nodeIP: -# # The `validSubnets` field configures the networks to pick kubelet node IP from. -# validSubnets: -# - 10.0.0.0/8 -# - '!10.0.0.3/32' -# - fdc7::/16 -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.23.1 -``` - - -
- -
-
- -clusterDNS []string - -
-
- -The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - - - -Examples: - - -``` yaml -clusterDNS: - - 10.96.0.10 - - 169.254.2.53 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
-
- -extraMounts []ExtraMount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. -Note that either `bind` or `rbind` are required in the `options`. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -``` - - -
- -
-
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -nodeIP KubeletNodeIPConfig - -
-
- -The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. -This is used when a node has multiple addresses to choose from. - - - -Examples: - - -``` yaml -nodeIP: - # The `validSubnets` field configures the networks to pick kubelet node IP from. - validSubnets: - - 10.0.0.0/8 - - '!10.0.0.3/32' - - fdc7::/16 -``` - - -
- -
- - - -## KubeletNodeIPConfig -KubeletNodeIPConfig represents the kubelet node IP configuration. - -Appears in: - -- KubeletConfig.nodeIP - - -``` yaml -# The `validSubnets` field configures the networks to pick kubelet node IP from. -validSubnets: - - 10.0.0.0/8 - - '!10.0.0.3/32' - - fdc7::/16 -``` - -
- -
- -validSubnets []string - -
-
- -The `validSubnets` field configures the networks to pick kubelet node IP from. -For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6. -IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`. -Negative subnet matches should be specified last to filter out IPs picked by positive matches. -If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both. - -
- -
- - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld - -# # Configures KubeSpan feature. -# kubespan: -# enabled: true # Enable the KubeSpan feature. -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
-
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
-
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
-
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
-
- -kubespan NetworkKubeSpan - -
-
- -Configures KubeSpan feature. - - - -Examples: - - -``` yaml -kubespan: - enabled: true # Enable the KubeSpan feature. -``` - - -
- -
- - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk attributes like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
-
- -diskSelector InstallDiskSelector - -
-
- -Look up disk using disk attributes like model, size, serial and others. -Always has priority over `disk`. - - - -Examples: - - -``` yaml -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. -``` - - -
- -
-
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
-
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
-
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -legacyBIOSSupport bool - -
-
- -Indicates if MBR partition should be marked as bootable (active). -Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme. - -
- -
- - - -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - -- InstallConfig.diskSelector - - -``` yaml -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -``` - -
- -
- -size InstallDiskSizeMatcher - -
-
- -Disk size. - - - -Examples: - - -``` yaml -size: 4GB -``` - -``` yaml -size: '> 1TB' -``` - -``` yaml -size: <= 2TB -``` - - -
- -
-
- -name string - -
-
- -Disk name `/sys/block//device/name`. - -
- -
-
- -model string - -
-
- -Disk model `/sys/block//device/model`. - -
- -
-
- -serial string - -
-
- -Disk serial number `/sys/block//serial`. - -
- -
-
- -modalias string - -
-
- -Disk modalias `/sys/block//device/modalias`. - -
- -
-
- -uuid string - -
-
- -Disk UUID `/sys/block//uuid`. - -
- -
-
- -wwid string - -
-
- -Disk WWID `/sys/block//wwid`. - -
- -
-
- -type InstallDiskType - -
-
- -Disk Type. - - -Valid values: - - - - ssd - - - hdd - - - nvme - - - sd -
- -
- - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
-
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - -
- -
-
- -bootTimeout Duration - -
-
- -Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -NTP sync will be still running in the background. -Defaults to "infinity" (waiting forever for time sync) - -
- -
- - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
-
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.6 # The `image` field is an override to the default coredns image. -``` - -
- -
- -disabled bool - -
-
- -Disable coredns deployment on cluster bootstrap. - -
- -
-
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - -- ControlPlaneConfig.endpoint -- LoggingDestination.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` -``` yaml -udp://127.0.0.1:12345 -``` -``` yaml -tcp://1.2.3.4:12345 -``` - - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
-
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.23.1 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.23.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
-
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
-
- -disablePodSecurityPolicy bool - -
-
- -Disable PodSecurityPolicy in the API server and default manifests. - -
- -
- - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.23.1 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.23.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.23.1 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
-
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.23.1 -``` - - -
- -
-
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.23.1 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.23.1 -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
-
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.5.1 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" - -# # The subnet from which the advertise URL should be. -# subnet: 10.0.0.0/8 -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.5.1 -``` - - -
- -
-
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
-
- -subnet string - -
-
- -The subnet from which the advertise URL should be. - - - -Examples: - - -``` yaml -subnet: 10.0.0.0/8 -``` - - -
- -
- - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "urls". -The "name" key supports the following options: "flannel", "custom", and "none". -"flannel" uses Talos-managed Flannel CNI, and that's the default option. -"custom" uses custom manifests that should be provided in "urls". -"none" indicates that Talos will not manage any CNI installation. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml -``` - - -
- -
-
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
-
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
-
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - - -Valid values: - - - - flannel - - - custom - - - none -
- -
-
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. -Should be present for "custom", must be empty for "flannel" and "none". - -
- -
- - - -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - -- ClusterConfig.externalCloudProvider - - -``` yaml -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - -
- -
- -enabled bool - -
-
- -Enable external cloud provider. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
-
- -manifests []string - -
-
- -A list of urls that point to additional manifests for an external cloud provider. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -``` - - -
- -
- - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
-
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
-
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - -- SystemDiskEncryptionConfig.state -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
-
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
-
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - - -Valid values: - - - - aes-xts-plain64 - - - xchacha12,aes-adiantum-plain64 - - - xchacha20,aes-adiantum-plain64 - - -Examples: - - -``` yaml -cipher: aes-xts-plain64 -``` - - -
- -
-
- -keySize uint - -
-
- -Defines the encryption key length. - -
- -
-
- -blockSize uint64 - -
-
- -Defines the encryption sector size. - - - -Examples: - - -``` yaml -blockSize: 4096 -``` - - -
- -
-
- -options []string - -
-
- -Additional --perf parameters for the LUKS2 encryption. - - -Valid values: - - - - no_read_workqueue - - - no_write_workqueue - - - same_cpu_crypt - - -Examples: - - -``` yaml -options: - - no_read_workqueue - - no_write_workqueue -``` - - -
- -
- - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
-
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
-
- -slot int - -
-
- -Key slot number for LUKS2 encryption. - -
- -
- - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - -- EncryptionKey.nodeID - - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
-
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
-
- -path string - -
-
- -The path of the file. - -
- -
-
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
-
- -aliases []string - -
-
- -The host alias. - -
- -
- - - -## Device -Device represents a network interface. - -Appears in: - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
-
- -addresses []string - -
-
- -Assigns static IP addresses to the interface. -An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed). - - - -Examples: - - -``` yaml -addresses: - - 10.5.0.0/16 - - 192.168.3.7 -``` - - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
-
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
-
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
-
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
-
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
-
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
-
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
-
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
-
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
-
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
-
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
-
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
-
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
-
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
-
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
-
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
-
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - -- Device.vip -- Vlan.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
-
- -equinixMetal VIPEquinixMetalConfig - -
-
- -Specifies the Equinix Metal API settings to assign VIP to the node. - -
- -
-
- -hcloud VIPHCloudConfig - -
-
- -Specifies the Hetzner Cloud API settings to assign VIP to the node. - -
- -
- - - -## VIPEquinixMetalConfig -VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. - -Appears in: - -- DeviceVIPConfig.equinixMetal - - - -
- -
- -apiToken string - -
-
- -Specifies the Equinix Metal API Token. - -
- -
- - - -## VIPHCloudConfig -VIPHCloudConfig contains settings for Hetzner Cloud VIP management. - -Appears in: - -- DeviceVIPConfig.hcloud - - - -
- -
- -apiToken string - -
-
- -Specifies the Hetzner Cloud API Token. - -
- -
- - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
-
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. -Not supported at the moment. - -
- -
-
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
-
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - -- Device.vlans - - - -
- -
- -addresses []string - -
-
- -The addresses in CIDR notation or as plain IPs to use. - -
- -
-
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
-
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
-
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
-
- -mtu uint32 - -
-
- -The VLAN's MTU. - -
- -
-
- -vip DeviceVIPConfig - -
-
- -The VLAN's virtual IP address configuration. - -
- -
- - - -## Route -Route represents a network route. - -Appears in: - -- Device.routes -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
-
- -gateway string - -
-
- -The route's gateway. - -
- -
-
- -source string - -
-
- -The route's source address (optional). - -
- -
-
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
-
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
-
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
-
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
-
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - -## FeaturesConfig -FeaturesConfig describe individual Talos features that can be switched on or off. - -Appears in: - -- MachineConfig.features - - -``` yaml -rbac: true # Enable role-based access control (RBAC). -``` - -
- -
- -rbac bool - -
-
- -Enable role-based access control (RBAC). - -
- -
- - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - -- APIServerConfig.extraVolumes -- ControllerManagerConfig.extraVolumes -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
-
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
-
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - -
- -
- -name string - -
-
- -Name of the manifest. -Name should be unique. - - - -Examples: - - -``` yaml -name: csi -``` - - -
- -
-
- -contents string - -
-
- -Manifest contents as a string. - - - -Examples: - - -``` yaml -contents: /etc/kubernetes/auth -``` - - -
- -
- - - -## NetworkKubeSpan -NetworkKubeSpan struct describes KubeSpan configuration. - -Appears in: - -- NetworkConfig.kubespan - - -``` yaml -enabled: true # Enable the KubeSpan feature. -``` - -
- -
- -enabled bool - -
-
- -Enable the KubeSpan feature. -Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled. - -
- -
-
- -allowDownPeerBypass bool - -
-
- -Skip sending traffic via KubeSpan if the peer connection state is not up. -This provides configurable choice between connectivity and security: either traffic is always -forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly -to the peer if Wireguard connection can't be established. - -
- -
- - - -## ClusterDiscoveryConfig -ClusterDiscoveryConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterConfig.discovery - - -``` yaml -enabled: true # Enable the cluster membership discovery feature. -# Configure registries used for cluster member discovery. -registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -``` - -
- -
- -enabled bool - -
-
- -Enable the cluster membership discovery feature. -Cluster discovery is based on individual registries which are configured under the registries field. - -
- -
-
- -registries DiscoveryRegistriesConfig - -
-
- -Configure registries used for cluster member discovery. - -
- -
- - - -## DiscoveryRegistriesConfig -DiscoveryRegistriesConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterDiscoveryConfig.registries - - - -
- -
- -kubernetes RegistryKubernetesConfig - -
-
- -Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information -as annotations on the Node resources. - -
- -
-
- -service RegistryServiceConfig - -
-
- -Service registry is using an external service to push and pull information about cluster members. - -
- -
- - - -## RegistryKubernetesConfig -RegistryKubernetesConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.kubernetes - - - -
- -
- -disabled bool - -
-
- -Disable Kubernetes discovery registry. - -
- -
- - - -## RegistryServiceConfig -RegistryServiceConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.service - - - -
- -
- -disabled bool - -
-
- -Disable external service discovery registry. - -
- -
-
- -endpoint string - -
-
- -External service endpoint. - - - -Examples: - - -``` yaml -endpoint: https://discovery.talos.dev/ -``` - - -
- -
- - - -## UdevConfig -UdevConfig describes how the udev system should be configured. - -Appears in: - -- MachineConfig.udev - - -``` yaml -# List of udev rules to apply to the udev system -rules: - - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" -``` - -
- -
- -rules []string - -
-
- -List of udev rules to apply to the udev system - -
- -
- - - -## LoggingConfig -LoggingConfig struct configures Talos logging. - -Appears in: - -- MachineConfig.logging - - -``` yaml -# Logging destination. -destinations: - - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - format: json_lines # Logs format. -``` - -
- -
- -destinations []LoggingDestination - -
-
- -Logging destination. - -
- -
- - - -## LoggingDestination -LoggingDestination struct configures Talos logging destination. - -Appears in: - -- LoggingConfig.destinations - - - -
- -
- -endpoint Endpoint - -
-
- -Where to send logs. Supported protocols are "tcp" and "udp". - - - -Examples: - - -``` yaml -endpoint: udp://127.0.0.1:12345 -``` - -``` yaml -endpoint: tcp://1.2.3.4:12345 -``` - - -
- -
-
- -format string - -
-
- -Logs format. - - -Valid values: - - - - json_lines -
- -
- - diff --git a/website/content/v0.14/reference/kernel.md b/website/content/v0.14/reference/kernel.md deleted file mode 100644 index 8bb02ee05..000000000 --- a/website/content/v0.14/reference/kernel.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `ip` - - Initial configuration of the interface, routes, DNS, NTP servers. - - Full documentation is available in the [Linux kernel docs](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt). - - `ip=:::::::::` - - Talos will use the configuration supplied via the kernel parameter as the initial network configuration. - This parameter is useful in the environments where DHCP doesn't provide IP addresses or when default DNS and NTP servers should be overridden - before loading machine configuration. - Partial configuration can be applied as well, e.g. `ip=<:::::::::` sets only the DNS and NTP servers. -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automatic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. diff --git a/website/content/v0.14/reference/platform.md b/website/content/v0.14/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.14/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.14/single-board-computers/_index.md b/website/content/v0.14/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.14/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.14/single-board-computers/bananapi_m64.md b/website/content/v0.14/single-board-computers/bananapi_m64.md deleted file mode 100644 index bc48c4c61..000000000 --- a/website/content/v0.14/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.14/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.14/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index a0b7e8f2a..000000000 --- a/website/content/v0.14/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.14/single-board-computers/pine64.md b/website/content/v0.14/single-board-computers/pine64.md deleted file mode 100644 index bc30430b3..000000000 --- a/website/content/v0.14/single-board-computers/pine64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64" -description: "Installing Talos on a Pine64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-pine64-arm64.img.xz -xz -d metal-pine64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-pine64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.14/single-board-computers/rock64.md b/website/content/v0.14/single-board-computers/rock64.md deleted file mode 100644 index 27827e8ae..000000000 --- a/website/content/v0.14/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.14/single-board-computers/rockpi_4.md b/website/content/v0.14/single-board-computers/rockpi_4.md deleted file mode 100644 index f0f78b6a7..000000000 --- a/website/content/v0.14/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Boot Talos from an eMMC or SSD Drive - -> Note: this is only tested on Rock PI 4c - -It is possible to run Talos without any SD cards right from either an eMMC or SSD disk. - -The pre-installed SPI loader won't be able to chain Talos u-boot on the device because it's too outdated. - -Instead, it is necessary to update u-boot to a more recent version for this process to work. -The Armbian u-boot build for Rock PI 4c has been proved to work: [https://users.armbian.com/piter75/](https://users.armbian.com/piter75/). - -### Steps - -- Flash the Rock PI 4c variant of [Debian](https://wiki.radxa.com/Rockpi4/downloads) to the SD card. -- Check that /dev/mtdblock0 exists otherwise the command will silently fail; e.g. `lsblk`. -- Download Armbian u-boot and update SPI flash: - -```bash -curl -LO https://users.armbian.com/piter75/rkspi_loader-v20.11.2-trunk-v2.img -sudo dd if=rkspi_loader-v20.11.2-trunk-v2.img of=/dev/mtdblock0 bs=4K -``` - -- Optionally, you can also write Talos image to the SSD drive right from your Rock PI board: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -sudo dd if=metal-rockpi_4-arm64.img.xz of=/dev/nvme0n1 -``` - -- remove SD card and reboot. - -After these steps, Talos will boot from the SSD and enter maintenance mode. -The rest of the flow is the same as running Talos from the SD card. diff --git a/website/content/v0.14/single-board-computers/rpi_4.md b/website/content/v0.14/single-board-computers/rpi_4.md deleted file mode 100644 index c2bff5617..000000000 --- a/website/content/v0.14/single-board-computers/rpi_4.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and use [Raspberry Pi Imager](https://www.raspberrypi.org/software/) -to install the bootloader on it (select Operating System > Misc utility images > Bootloader > SD Card Boot). -Alternatively, you can use the console on Linux or macOS. -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on macOS. -In this example, we will assume `/dev/mmcblk0`. - -```bash -curl -Lo rpi-boot-eeprom-recovery.zip https://github.com/raspberrypi/rpi-eeprom/releases/download/v2021.04.29-138a1/rpi-boot-eeprom-recovery-2021-04-29-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0p1 /mnt -sudo bsdtar rpi-boot-eeprom-recovery.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached to the port closest to the power/USB-C port, -the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -> Note: if you have an HDMI display attached and it shows only a rainbow splash, -> please use the other HDMI port, the one closest to the power/USB-C port. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.14/virtualized-platforms/_index.md b/website/content/v0.14/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.14/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.14/virtualized-platforms/hyper-v.md b/website/content/v0.14/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.14/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.14/virtualized-platforms/kvm.md b/website/content/v0.14/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.14/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.14/virtualized-platforms/proxmox.md b/website/content/v0.14/virtualized-platforms/proxmox.md deleted file mode 100644 index 4577fbcfe..000000000 --- a/website/content/v0.14/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.14.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.14.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". - -### With DHCP server - -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -### Without DHCP server - -To apply the machine configurations in maintenance mode, VM has to have IP on the network. -So you can set it on boot time manually. - - - -Press `e` on the boot time. -And set the IP parameters for the VM. -[Format is](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt): - -```bash -ip=:::::: -``` - -For example $CONTROL_PLANE_IP will be 192.168.0.100 and gateway 192.168.0.1 - -```bash -linux /boot/vmlinuz init_on_alloc=1 slab_nomerge pti=on panic=0 consoleblank=0 printk.devkmsg=on earlyprintk=ttyS0 console=tty0 console=ttyS0 talos.platform=metal ip=192.168.0.100::192.168.0.1:255.255.255.0::eth0:off -``` - - - -Then press Ctrl-x or F10 - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the `_out` directory: controlplane.yaml, worker.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `controlplane.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/controlplane.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/worker.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -### Bootstrap Etcd - -Set the `endpoints` and `nodes`: - -```bash -talosctl --talosconfig _out/talosconfig config endpoint -talosctl --talosconfig _out/talosconfig config node -``` - -Bootstrap `etcd`: - -```bash -talosctl --talosconfig _out/talosconfig bootstrap -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig _out/talosconfig kubeconfig . -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.14/virtualized-platforms/vmware.md b/website/content/v0.14/virtualized-platforms/vmware.md deleted file mode 100644 index 009800689..000000000 --- a/website/content/v0.14/virtualized-platforms/vmware.md +++ /dev/null @@ -1,313 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 2 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -## Prereqs/Assumptions - -This guide will use the virtual IP ("VIP") functionality that is built into Talos in order to provide a stable, known IP for the Kubernetes control plane. -This simply means the user should pick an IP on their "VM Network" to designate for this purpose and keep it handy for future steps. - -## Create the Machine Configuration Files - -### Generating Base Configurations - -Using the VIP chosen in the prereq steps, we will now generate the base configuration files for the Talos machines. -This can be done with the `talosctl gen config ...` command. -Take note that we will also use a JSON6902 patch when creating the configs so that the control plane nodes get some special information about the VIP we chose earlier, as well as a daemonset to install vmware tools on talos nodes. - -First, download `the cp.patch` to your local machine and edit the VIP to match your chosen IP. -You can do this by issuing `https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v1.0/Virtualized%20Platforms/vmware/cp.patch`. -It's contents should look like the following: - -```yaml -- op: add - path: /machine/network - value: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: -- op: replace - path: /cluster/extraManifests - value: - - "https://raw.githubusercontent.com/mologie/talos-vmtoolsd/master/deploy/unstable.yaml" -``` - -With the patch in hand, generate machine configs with: - -```bash -$ talosctl gen config vmware-test https://: --config-patch-control-plane "$(yq r -j cp.patch)" -created controlplane.yaml -created worker.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking if needed. -Optionally, you can specify additional patches by adding to the `cp.patch` file downloaded earlier, or create your own patch files. - -### Validate the Configuration Files - -```bash -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config worker.yaml --mode cloud -worker.yaml is valid for cloud mode -``` - -## Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -## Choose Install Approach - -As part of this guide, we have a more automated install script that handles some of the complexity of importing OVAs and creating VMs. -If you wish to use this script, we will detail that next. -If you wish to carry out the manual approach, simply skip ahead to the "Manual Approach" section. - -### Scripted Install - -Download the `vmware.sh` script to your local machine. -You can do this by issuing `curl -fsSLO "https://raw.githubusercontent.com/talos-systems/talos/master/website/content/docs/v1.0/Virtualized%20Platforms/vmware/vmware.sh"`. -This script has default variables for things like Talos version and cluster name that may be interesting to tweak before deploying. - -#### Import OVA - -To create a content library and import the Talos OVA corresponding to the mentioned Talos version, simply issue: - -```bash -./vsphere.sh upload_ova -``` - -#### Create Cluster - -With the OVA uploaded to the content library, you can create a 5 node (by default) cluster with 3 control plane and 2 worker nodes: - -```bash -./vsphere.sh create -``` - -This step will create a VM from the OVA, edit the settings based on the env variables used for VM size/specs, then power on the VMs. - -You may now skip past the "Manual Approach" section down to "Bootstrap Cluster". - -### Manual Approach - -#### Import the OVA into vCenter - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -Create a content library (if needed) with: - -```bash -govc library.create -``` - -Import the OVA to the library with: - -```bash -govc library.import -n talos-${TALOS_VERSION} /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc library.deploy /talos-${TALOS_VERSION} control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat controlplane.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc library.deploy /talos-${TALOS_VERSION} control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm control-plane-2 - -govc library.deploy /talos-${TALOS_VERSION} control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm control-plane-2 - -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G - -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 - -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc library.deploy /talos-${TALOS_VERSION} worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm worker-1 - -govc library.deploy /talos-${TALOS_VERSION} worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 worker.yaml)" \ - -e "disk.enableUUID=1" \ - -vm worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm worker-1 - -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 10G - -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on worker-1 - -govc vm.power -on worker-2 -``` - -#### Bootstrap Cluster - -In the vSphere UI, open a console to one of the control plane nodes. -You should see some output stating that etcd should be bootstrapped. -This text should look like: - -```bash -"etcd is waiting to join the cluster, if this node is the first node in the cluster, please run `talosctl bootstrap` against one of the following IPs: -``` - -Take note of the IP mentioned here and issue: - -```bash -talosctl --talosconfig talosconfig bootstrap -e -n -``` - -Keep this IP handy for the following steps as well. - -#### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` - -#### Configure `talos-vmtoolsd` - -The talos-vmtoolsd application was deployed as a daemonset as part of the cluster creation; however, we must now provide a talos credentials file for it to use. - -Create a new talosconfig with: - -```bash -talosctl -n config new vmtoolsd-secret.yaml --roles os:admin -``` - -Create a secret from the talosconfig: - -```bash -kubectl -n kube-system create secret generic talos-vmtoolsd-config \ - --from-file=talosconfig=./vmtoolsd-secret.yaml -``` - -Clean up the generated file from local system: - -```bash -rm vmtoolsd-secret.yaml -``` - -Once configured, you should now see these daemonset pods go into "Running" state and in vCenter, you will now see IPs and info from the Talos nodes present in the UI. diff --git a/website/content/v0.14/virtualized-platforms/vmware/cp.patch b/website/content/v0.14/virtualized-platforms/vmware/cp.patch deleted file mode 100644 index 988edd6c9..000000000 --- a/website/content/v0.14/virtualized-platforms/vmware/cp.patch +++ /dev/null @@ -1,12 +0,0 @@ -- op: add - path: /machine/network - value: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: -- op: replace - path: /cluster/extraManifests - value: - - "https://raw.githubusercontent.com/mologie/talos-vmtoolsd/master/deploy/unstable.yaml" diff --git a/website/content/v0.14/virtualized-platforms/vmware/vmware.sh b/website/content/v0.14/virtualized-platforms/vmware/vmware.sh deleted file mode 100644 index adbaf5c5a..000000000 --- a/website/content/v0.14/virtualized-platforms/vmware/vmware.sh +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/bash - -set -e - -## The following commented environment variables should be set -## before running this script - -# export GOVC_USERNAME='administrator@vsphere.local' -# export GOVC_PASSWORD='xxx' -# export GOVC_INSECURE=true -# export GOVC_URL='https://172.16.199.151' -# export GOVC_DATASTORE='xxx' - -CLUSTER_NAME=${CLUSTER_NAME:=vmware-test} -TALOS_VERSION=v0.14.0 -OVA_PATH=${OVA_PATH:="https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/vmware-amd64.ova"} - -CONTROL_PLANE_COUNT=${CONTROL_PLANE_COUNT:=3} -CONTROL_PLANE_CPU=${CONTROL_PLANE_CPU:=2} -CONTROL_PLANE_MEM=${CONTROL_PLANE_MEM:=4096} -CONTROL_PLANE_DISK=${CONTROL_PLANE_DISK:=10G} -CONTROL_PLANE_MACHINE_CONFIG_PATH=${CONTROL_PLANE_MACHINE_CONFIG_PATH:="./controlplane.yaml"} - -WORKER_COUNT=${WORKER_COUNT:=2} -WORKER_CPU=${WORKER_CPU:=2} -WORKER_MEM=${WORKER_MEM:=4096} -WORKER_DISK=${WORKER_DISK:=10G} -WORKER_MACHINE_CONFIG_PATH=${WORKER_MACHINE_CONFIG_PATH:="./worker.yaml"} - -upload_ova () { - ## Import desired Talos Linux OVA into a new content library - govc library.create ${CLUSTER_NAME} - govc library.import -n talos-${TALOS_VERSION} ${CLUSTER_NAME} ${OVA_PATH} -} - -create () { - ## Encode machine configs - CONTROL_PLANE_B64_MACHINE_CONFIG=$(cat ${CONTROL_PLANE_MACHINE_CONFIG_PATH}| base64 | tr -d '\n') - WORKER_B64_MACHINE_CONFIG=$(cat ${WORKER_MACHINE_CONFIG_PATH} | base64 | tr -d '\n') - - ## Create control plane nodes and edit their settings - for i in $(seq 1 ${CONTROL_PLANE_COUNT}); do - echo "" - echo "launching control plane node: ${CLUSTER_NAME}-control-plane-${i}" - echo "" - - govc library.deploy ${CLUSTER_NAME}/talos-${TALOS_VERSION} ${CLUSTER_NAME}-control-plane-${i} - - govc vm.change \ - -c ${CONTROL_PLANE_CPU}\ - -m ${CONTROL_PLANE_MEM} \ - -e "guestinfo.talos.config=${CONTROL_PLANE_B64_MACHINE_CONFIG}" \ - -e "disk.enableUUID=1" \ - -vm ${CLUSTER_NAME}-control-plane-${i} - - govc vm.disk.change -vm ${CLUSTER_NAME}-control-plane-${i} -disk.name disk-1000-0 -size ${CONTROL_PLANE_DISK} - - govc vm.power -on ${CLUSTER_NAME}-control-plane-${i} - done - - ## Create worker nodes and edit their settings - for i in $(seq 1 ${WORKER_COUNT}); do - echo "" - echo "launching worker node: ${CLUSTER_NAME}-worker-${i}" - echo "" - - govc library.deploy ${CLUSTER_NAME}/talos-${TALOS_VERSION} ${CLUSTER_NAME}-worker-${i} - - govc vm.change \ - -c ${WORKER_CPU}\ - -m ${WORKER_MEM} \ - -e "guestinfo.talos.config=${WORKER_B64_MACHINE_CONFIG}" \ - -e "disk.enableUUID=1" \ - -vm ${CLUSTER_NAME}-worker-${i} - - govc vm.disk.change -vm ${CLUSTER_NAME}-worker-${i} -disk.name disk-1000-0 -size ${WORKER_DISK} - - govc vm.power -on ${CLUSTER_NAME}-worker-${i} - done - -} - -destroy() { - for i in $(seq 1 ${CONTROL_PLANE_COUNT}); do - echo "" - echo "destroying control plane node: ${CLUSTER_NAME}-control-plane-${i}" - echo "" - - govc vm.destroy ${CLUSTER_NAME}-control-plane-${i} - done - - for i in $(seq 1 ${WORKER_COUNT}); do - echo "" - echo "destroying worker node: ${CLUSTER_NAME}-worker-${i}" - echo "" - govc vm.destroy ${CLUSTER_NAME}-worker-${i} - done -} - -delete_ova() { - govc library.rm ${CLUSTER_NAME} -} - -"$@" diff --git a/website/content/v0.14/virtualized-platforms/xen.md b/website/content/v0.14/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.14/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.6/_index.md b/website/content/v0.6/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.6/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.6/bare-metal-platforms/_index.md b/website/content/v0.6/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.6/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.6/bare-metal-platforms/digital-rebar.md b/website/content/v0.6/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 141ee0d17..000000000 --- a/website/content/v0.6/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: "Digital Rebar" ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `init.yaml`, `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with init, controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- init -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview.](../../guides/metal/overview) - -### Retrieve the `kubeconfig` - -Once everything is running we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.6/bare-metal-platforms/equinix-metal.md b/website/content/v0.6/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index 64f633046..000000000 --- a/website/content/v0.6/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Equinix Metal" ---- - -Talos is known to work on Equinix Metal; however, it is currently undocumented. diff --git a/website/content/v0.6/bare-metal-platforms/matchbox.md b/website/content/v0.6/bare-metal-platforms/matchbox.md deleted file mode 100644 index ed814b2af..000000000 --- a/website/content/v0.6/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: "Matchbox" ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `init.yaml`, `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### The Bootstrap Node - -```json -{ - "id": "init", - "name": "init", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/init.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Additional Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "init", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.6/bare-metal-platforms/sidero.md b/website/content/v0.6/bare-metal-platforms/sidero.md deleted file mode 100644 index f3bdce75a..000000000 --- a/website/content/v0.6/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Sidero" ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.6/cloud-platforms/_index.md b/website/content/v0.6/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.6/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.6/cloud-platforms/aws.md b/website/content/v0.6/cloud-platforms/aws.md deleted file mode 100644 index ecc0b3bd2..000000000 --- a/website/content/v0.6/cloud-platforms/aws.md +++ /dev/null @@ -1,255 +0,0 @@ ---- -title: "AWS" ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --group-id $SECURITY_GROUP \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 \ - --group-id $SECURITY_GROUP -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 \ - --group-id $SECURITY_GROUP -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Bootstrap Node - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://init.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-0}]" -``` - -#### Create the Remaining Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 3 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.6/cloud-platforms/azure.md b/website/content/v0.6/cloud-platforms/azure.md deleted file mode 100644 index 07936be79..000000000 --- a/website/content/v0.6/cloud-platforms/azure.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: "Azure" ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create controlplane 0 -az vm create \ - --name talos-controlplane-0 \ - --image talos \ - --custom-data ./init.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-0 \ - --availability-set talos-controlplane-av-set \ - --no-wait - -# Create 2 more controlplane nodes -for i in $( seq 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.6/cloud-platforms/digitalocean.md b/website/content/v0.6/cloud-platforms/digitalocean.md deleted file mode 100644 index fbd3eb77e..000000000 --- a/website/content/v0.6/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: "DigitalOcean" ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-name talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/digital-ocean.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Bootstrap Node - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file init.yaml \ - --ssh-keys \ - talos-control-plane-1 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Remaining Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Retrieve the `kubeconfig` - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.6/cloud-platforms/gcp.md b/website/content/v0.6/cloud-platforms/gcp.md deleted file mode 100644 index 9c1b1aab1..000000000 --- a/website/content/v0.6/cloud-platforms/gcp.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "GCP" ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks - gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create control plane 0 -gcloud compute instances create talos-controlplane-0 \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./init.yaml - -# Create control plane 1/2 -for i in $( seq 1 2 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 2 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') - -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.6/guides/_index.md b/website/content/v0.6/guides/_index.md deleted file mode 100644 index b00551514..000000000 --- a/website/content/v0.6/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Gides" -weight: 60 ---- diff --git a/website/content/v0.6/guides/advanced-networking.md b/website/content/v0.6/guides/advanced-networking.md deleted file mode 100644 index 2d844bdef..000000000 --- a/website/content/v0.6/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - time: - servers: - - time.cloudflare.com - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.6/guides/configuring-containerd.md b/website/content/v0.6/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.6/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.6/guides/configuring-corporate-proxies.md b/website/content/v0.6/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.6/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.6/guides/configuring-pull-through-cache.md b/website/content/v0.6/guides/configuring-pull-through-cache.md deleted file mode 100644 index e30a727e8..000000000 --- a/website/content/v0.6/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](docker) or [fireracker](firecracker). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `gcr.io` and `quay.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002). - -## Using Caching Registries with `firecracker` Local Cluster - -With a [firecracker](firecracker) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner firecracker \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](docker) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.6/guides/configuring-the-cluster-endpoint.md b/website/content/v0.6/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index ec0fee103..000000000 --- a/website/content/v0.6/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. init.yaml, controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../configuration/v1alpha1#controlplane) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.6/guides/customizing-the-kernel.md b/website/content/v0.6/guides/customizing-the-kernel.md deleted file mode 100644 index 74086bd8f..000000000 --- a/website/content/v0.6/guides/customizing-the-kernel.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM docker.io/andrewrynhard/installer:latest -COPY --from= /boot/vmlinuz /usr/install/vmlinuz -``` - -```bash -docker build --build-arg RM="/lib/modules" -t talos-installer . -``` - -> Note: You can use the `--squash` flag to create smaller images. - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.6/guides/customizing-the-root-filesystem.md b/website/content/v0.6/guides/customizing-the-root-filesystem.md deleted file mode 100644 index ac4d8aac7..000000000 --- a/website/content/v0.6/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM docker.io/autonomy/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.6/guides/managing-pki.md b/website/content/v0.6/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.6/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.6/guides/resetting-a-machine.md b/website/content/v0.6/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.6/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.6/guides/upgrading-kubernetes.md b/website/content/v0.6/guides/upgrading-kubernetes.md deleted file mode 100644 index a3e6cfee2..000000000 --- a/website/content/v0.6/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,272 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Kubelet Image - -In Kubernetes 1.19, the official `hyperkube` image was removed. -This means that in order to upgrade Kubernetes, Talos users will have to change the `command`, and `image` fields of each control plane component. -The `kubelet` image will also have to be updated, if you wish to specify the `kubelet` image explicitly. -The default used by Talos is sufficient in most cases. - -## Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### Automated Kubernetes Upgrade - -In Talos v0.6.1 we introduced the `upgrade-k8s` command in `talosctl`. -This command can be used to automate the Kubernetes upgrade process. -For example, to upgrade from Kubernetes v1.18.6 to v1.19.0 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.18.6 --to 1.19.0 -updating pod-checkpointer grace period to "0m" -sleeping 5m0s to let the pod-checkpointer self-checkpoint be updated -temporarily taking "kube-apiserver" out of pod-checkpointer control -updating daemonset "kube-apiserver" to version "1.19.0" -updating daemonset "kube-controller-manager" to version "1.19.0" -updating daemonset "kube-scheduler" to version "1.19.0" -updating daemonset "kube-proxy" to version "1.19.0" -updating pod-checkpointer grace period to "5m0s" -``` - -### Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -#### pod-checkpointer - -Talos runs `pod-checkpointer` component which helps to recover control plane components (specifically, API server) if control plane is not healthy. - -However, the way checkpoints interact with API server upgrade may make an upgrade take a lot longer due to a race condition on API server listen port. - -In order to speed up upgrades, first lower `pod-checkpointer` grace period to zero (`kubectl -n kube-system edit daemonset pod-checkpointer`), change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s -``` - -Wait for 5 minutes to let `pod-checkpointer` update self-checkpoint to the new grace period. - -#### API Server - -In the API server's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: ... - command: - - ./hyperkube - - kube-apiserver -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: k8s.gcr.io/kube-apiserver:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-apiserver -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-apiserver -``` - -#### Controller Manager - -In the controller manager's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: ... - command: - - ./hyperkube - - kube-controller-manager -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: k8s.gcr.io/kube-controller-manager:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-controller-manager -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-controller-manager -``` - -#### Scheduler - -In the scheduler's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-scheduler - image: ... - command: - - ./hyperkube - - kube-scheduler -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-sceduler - image: k8s.gcr.io/kube-scheduler:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-scheduler -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-scheduler -``` - -#### Restoring pod-checkpointer - -Restore grace period of 5 minutes (`kubectl -n kube-system edit daemonset pod-checkpointer`), change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s -``` - -### Kubelet - -The Talos team now maintains an image for the `kubelet` that should be used starting with Kubernetes 1.19. -The image for this release is `docker.io/autonomy/kubelet:v1.19.0`. -To explicitly set the image, we can use the [official documentation](../../configuration/v1alpha1#kubelet). -For example: - -```yaml -machine: - ... - kubelet: - image: docker.io/autonomy/kubelet:v1.19.0 -``` diff --git a/website/content/v0.6/guides/upgrading-talos.md b/website/content/v0.6/guides/upgrading-talos.md deleted file mode 100644 index 377e55938..000000000 --- a/website/content/v0.6/guides/upgrading-talos.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Upgrading Talos ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Talos - -In an effort to create more production ready clusters, Talos will now taint control plane nodes as unschedulable. -This means that any application you might have deployed must tolerate this taint if you intend on running the application on control plane nodes. - -Another feature you will notice is the automatic uncordoning of nodes that have been upgraded. -Talos will now uncordon a node if the cordon was initiated by the upgrade process. - -## Talosctl - -The `talosctl` CLI now requires an explicit set of nodes. -This can be configured with `talos config nodes` or set on the fly with `talos --nodes`. diff --git a/website/content/v0.6/introduction/_index.md b/website/content/v0.6/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.6/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.6/introduction/quickstart.md b/website/content/v0.6/introduction/quickstart.md deleted file mode 100644 index bc279f0c1..000000000 --- a/website/content/v0.6/introduction/quickstart.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.6/introduction/system-requirements.md b/website/content/v0.6/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.6/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.6/introduction/what-is-talos.md b/website/content/v0.6/introduction/what-is-talos.md deleted file mode 100644 index 3959ea766..000000000 --- a/website/content/v0.6/introduction/what-is-talos.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is an open source platform to host and maintain Kubernetes clusters. -It includes a purpose-built operating system and associated management tools. -It can run on all major cloud providers, virtualization platforms, and bare metal hardware. - -All system management is done via an API, and there is no shell or interactive console. -Some of the capabilities and benefits provided by Talos include: - -- **Security**: Talos reduces your attack surface by practicing the Principle of Least Privilege (PoLP) and by securing the API with mutual TLS (mTLS) authentication. -- **Predictability**: Talos eliminates unneeded variables and reduces unknown factors in your environment by employing immutable infrastructure ideology. -- **Evolvability**: Talos simplifies your architecture and increases your ability to easily accommodate future changes. - -Talos is flexible and can be deployed in a variety of ways, but the easiest way to get started and experiment with the system is to run a local cluster on your laptop or workstation. -There are two options: - -- [Run a Docker-based local cluster](../../local-platforms/docker/) on your Linux or Mac workstation -- [Run a Firecracker micro-VM-based](../../local-platforms/docker/) cluster on your Linux workstation diff --git a/website/content/v0.6/learn-more/_index.md b/website/content/v0.6/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.6/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.6/learn-more/architecture.md b/website/content/v0.6/learn-more/architecture.md deleted file mode 100644 index 6cc5bab8c..000000000 --- a/website/content/v0.6/learn-more/architecture.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -In this section we will discuss the various components of which Talos is comprised. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [apid](apid) | When interacting with Talos, the gRPC API endpoint you're interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `routerd`. | -| [containerd](containerd) | An industry-standard container runtime with an emphasis on simplicity, robustness and portability. To learn more see the [containerd website](https://containerd.io). | -| [machined](machined) | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| [networkd](networkd) | Handles all of the host level network configuration. Configuration is defined under the `networking` key | -| [timed](timed) | Handles the host time synchronization by acting as a NTP-client. | -| [kernel](kernel) | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| [routerd](routerd) | Responsible for routing an incoming API request from `apid` to the appropriate backend (e.g. `osd`, `machined` and `timed`). | -| [trustd](trustd) | To run and operate a Kubernetes cluster a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| [udevd](udevd) | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag is used to denote which Talos node ( via `apid` ) should handle the connection. -Typically this is a public facing server. -The `-n | --nodes` flag is used to denote which Talos node(s) should respond to the request. -If `--nodes` is not specified, the first endpoint will be used. - -> Note: Typically there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02` which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards is to `node01`, `node02`, and `node03` which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos as well as Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- [containerd](containerd) -- [kubeadm](kubeadm) -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- [networkd](networkd) -- [timed](timed) -- [trustd](trustd) -- [udevd](udevd) - -### networkd - -Networkd handles all of the host level network configuration. -Configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### timed - -Timed handles the host time synchronization. - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires the distribution of sensitive PKI data. - -To that end, we created `trustd`. -Based on the concept of a Root of Trust, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -It can, for example, accept a write request from another node to place a file on disk. - -Additional methods and capability will be added to the `trustd` component in support of new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.6/learn-more/faqs.md b/website/content/v0.6/learn-more/faqs.md deleted file mode 100644 index 0faab4680..000000000 --- a/website/content/v0.6/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 4 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.6/local-platforms/_index.md b/website/content/v0.6/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.6/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.6/local-platforms/docker.md b/website/content/v0.6/local-platforms/docker.md deleted file mode 100644 index 85d25c3d5..000000000 --- a/website/content/v0.6/local-platforms/docker.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Docker ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.6/local-platforms/firecracker.md b/website/content/v0.6/local-platforms/firecracker.md deleted file mode 100644 index fe81d406d..000000000 --- a/website/content/v0.6/local-platforms/firecracker.md +++ /dev/null @@ -1,313 +0,0 @@ ---- -title: Firecracker ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.6.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.8.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz -L -o cni-plugins-linux-amd64-v0.8.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.8.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.6.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.6/local-platforms/qemu.md b/website/content/v0.6/local-platforms/qemu.md deleted file mode 100644 index 460b20dab..000000000 --- a/website/content/v0.6/local-platforms/qemu.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: QEMU ---- - -In this guide we will create a Kubernetes cluster using QEMU. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.6.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.8.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz -L -o cni-plugins-linux-amd64-v0.8.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.8.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.6.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download/v0.6.0/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl -n 10.5.0.2 kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.6/reference/_index.md b/website/content/v0.6/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.6/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.6/reference/configuration.md b/website/content/v0.6/reference/configuration.md deleted file mode 100644 index 89f31ced7..000000000 --- a/website/content/v0.6/reference/configuration.md +++ /dev/null @@ -1,1584 +0,0 @@ ---- -title: Configuration -description: "" ---- - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -We can generate the files using `talosctl`. -This configuration is enough to get started in most cases, however it can be customized as needed. - -```bash -talosctl config generate --version v1alpha1 -``` - -This will generate a machine config for each node type, and a talosconfig. -The following is an example of an `init.yaml`: - -```yaml -version: v1alpha1 -machine: - type: init - token: 5dt69c.npg6duv71zwqhzbg - ca: - crt: - key: - certSANs: [] - kubelet: {} - network: {} - install: - disk: /dev/sda - image: docker.io/autonomy/installer:latest - bootloader: true - wipe: false - force: false -cluster: - controlPlane: - endpoint: https://1.2.3.4 - clusterName: example - network: - cni: "" - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 - token: wlzjyw.bei2zfylhs2by0wd - certificateKey: 20d9aafb46d6db4c0958db5b3fc481c8c14fc9b1abd8ac43194f4246b77131be - aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= - ca: - crt: - key: - apiServer: {} - controllerManager: {} - scheduler: {} - etcd: - ca: - crt: - key: -``` - -### Config - -#### version - -Indicates the schema used to decode the contents. - -Type: `string` - -Valid Values: - -- `v1alpha1` - -#### debug - -Enable verbose logging. - -Type: `bool` - -Valid Values: - -- `true` -- `yes` -- `false` -- `no` - -#### persist - -Indicates whether to pull the machine config upon every boot. - -Type: `bool` - -Valid Values: - -- `true` -- `yes` -- `false` -- `no` - -#### machine - -Provides machine specific configuration options. - -Type: `MachineConfig` - -#### cluster - -Provides cluster specific configuration options. - -Type: `ClusterConfig` - ---- - -### MachineConfig - -#### type - -Defines the role of the machine within the cluster. - -##### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -##### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -##### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - -Type: `string` - -Valid Values: - -- `init` -- `controlplane` -- `join` - -#### token - -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - -Type: `string` - -Examples: - -```yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default - -#### ca - -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - -Type: `PEMEncodedCertificateAndKey` - -Examples: - -```yaml -ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJIekNCMHF... - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM... -``` - -#### certSANs - -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - -Type: `array` - -Examples: - -```yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - -#### kubelet - -Used to provide additional options to the kubelet. - -Type: `KubeletConfig` - -Examples: - -```yaml -kubelet: - image: - extraArgs: - key: value -``` - -#### network - -Used to configure the machine's network. - -Type: `NetworkConfig` - -Examples: - -```yaml -network: - hostname: worker-1 - interfaces: - nameservers: - - 9.8.7.6 - - 8.7.6.5 -``` - -#### disks - -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy full disk. - -Type: `array` - -Examples: - -```yaml -disks: - - device: /dev/sdb - partitions: - - mountpoint: /var/lib/extra - size: 10000000000 -``` - -> Note: `size` is in units of bytes. - -#### install - -Used to provide instructions for bare-metal installations. - -Type: `InstallConfig` - -Examples: - -```yaml -install: - disk: /dev/sda - extraKernelArgs: - - option=value - image: docker.io/autonomy/installer:latest - bootloader: true - wipe: false - force: false -``` - -#### files - -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - -Type: `array` - -Examples: - -```yaml -files: - - content: | - ... - permissions: 0666 - path: /tmp/file.txt - op: append -``` - -> Note: The specified `path` is relative to `/var`. - -#### env - -The `env` field allows for the addition of environment variables to a machine. -All environment variables are set on the machine in addition to every service. - -Type: `Env` - -Valid Values: - -- `GRPC_GO_LOG_VERBOSITY_LEVEL` -- `GRPC_GO_LOG_SEVERITY_LEVEL` -- `http_proxy` -- `https_proxy` -- `no_proxy` - -Examples: - -```yaml -env: - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - GRPC_GO_LOG_SEVERITY_LEVEL: info - https_proxy: http://SERVER:PORT/ -``` - -```yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -```yaml -env: - https_proxy: http://DOMAIN\\USERNAME:PASSWORD@SERVER:PORT/ -``` - -#### time - -Used to configure the machine's time settings. - -Type: `TimeConfig` - -Examples: - -```yaml -time: - servers: - - time.cloudflare.com -``` - -#### sysctls - -Used to configure the machine's sysctls. - -Type: `map` - -Examples: - -```yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - -#### registries - -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -Section `mirrors` allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -Section `config` provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - -Type: `RegistriesConfig` - -Examples: - -```yaml -registries: - mirrors: - docker.io: - endpoints: - - https://registry-1.docker.io - '*': - endpoints: - - http://some.host:123/ - config: - "some.host:123": - tls: - CA: ... # base64-encoded CA certificate in PEM format - clientIdentity: - cert: ... # base64-encoded client certificate in PEM format - key: ... # base64-encoded client key in PEM format - auth: - username: ... - password: ... - auth: ... - identityToken: ... - -``` - ---- - -### ClusterConfig - -#### controlPlane - -Provides control plane specific configuration options. - -Type: `ControlPlaneConfig` - -Examples: - -```yaml -controlPlane: - endpoint: https://1.2.3.4 - localAPIServerPort: 443 -``` - -#### clusterName - -Configures the cluster's name. - -Type: `string` - -#### network - -Provides cluster network configuration. - -Type: `ClusterNetworkConfig` - -Examples: - -```yaml -network: - cni: - name: flannel - dnsDomain: cluster.local - podSubnets: - - 10.244.0.0/16 - serviceSubnets: - - 10.96.0.0/12 -``` - -#### token - -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/). - -Type: `string` - -Examples: - -```yaml -wlzjyw.bei2zfylhs2by0wd -``` - -#### aescbcEncryptionSecret - -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - -Type: `string` - -Examples: - -```yaml -z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - -#### ca - -The base64 encoded root certificate authority used by Kubernetes. - -Type: `PEMEncodedCertificateAndKey` - -Examples: - -```yaml -ca: - crt: LS0tLS1CRUdJTiBDRV... - key: LS0tLS1CRUdJTiBSU0... -``` - -#### apiServer - -API server specific configuration options. - -Type: `APIServerConfig` - -Examples: - -```yaml -apiServer: - image: ... - extraArgs: - key: value - certSANs: - - 1.2.3.4 - - 5.6.7.8 -``` - -#### controllerManager - -Controller manager server specific configuration options. - -Type: `ControllerManagerConfig` - -Examples: - -```yaml -controllerManager: - image: ... - extraArgs: - key: value -``` - -#### proxy - -Kube-proxy server-specific configuration options - -Type: `ProxyConfig` - -Examples: - -```yaml -proxy: - mode: ipvs - extraArgs: - key: value -``` - -#### scheduler - -Scheduler server specific configuration options. - -Type: `SchedulerConfig` - -Examples: - -```yaml -scheduler: - image: ... - extraArgs: - key: value -``` - -#### etcd - -Etcd specific configuration options. - -Type: `EtcdConfig` - -Examples: - -```yaml -etcd: - ca: - crt: LS0tLS1CRUdJTiBDRV... - key: LS0tLS1CRUdJTiBSU0... - image: ... -``` - -#### podCheckpointer - -Pod Checkpointer specific configuration options. - -Type: `PodCheckpointer` - -Examples: - -```yaml -podCheckpointer: - image: ... -``` - -#### coreDNS - -Core DNS specific configuration options. - -Type: `CoreDNS` - -Examples: - -```yaml -coreDNS: - image: ... -``` - -#### extraManifests - -A list of urls that point to additional manifests. -These will get automatically deployed by bootkube. - -Type: `array` - -Examples: - -```yaml -extraManifests: - - "https://www.mysweethttpserver.com/manifest1.yaml" - - "https://www.mysweethttpserver.com/manifest2.yaml" -``` - -#### extraManifestHeaders - -A map of key value pairs that will be added while fetching the ExtraManifests. - -Type: `map` - -Examples: - -```yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - -#### adminKubeconfig - -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - -Type: `AdminKubeconfigConfig` - -Examples: - -```yaml -adminKubeconfig: - certLifetime: 1h -``` - ---- - -### KubeletConfig - -#### image - -The `image` field is an optional reference to an alternative kubelet image. - -Type: `string` - -Examples: - -```yaml -image: docker.io//kubelet:latest -``` - -#### extraArgs - -The `extraArgs` field is used to provide additional flags to the kubelet. - -Type: `map` - -Examples: - -```yaml -extraArgs: - key: value -``` - -#### extraMounts - -The `extraMounts` field is used to add additional mounts to the kubelet container. - -Type: `array` - -Examples: - -```yaml -extraMounts: - - source: /var/lib/example - destination: /var/lib/example - type: bind - options: - - rshared - - ro -``` - ---- - -### NetworkConfig - -#### hostname - -Used to statically set the hostname for the host. - -Type: `string` - -#### interfaces - -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - -##### machine.network.interfaces.interface - -This is the interface name that should be configured. - -##### machine.network.interfaces.cidr - -`cidr` is used to specify a static IP address to the interface. -This should be in proper CIDR notation ( `192.168.2.5/24` ). - -> Note: This option is mutually exclusive with DHCP. - -##### machine.network.interfaces.dhcp - -`dhcp` is used to specify that this device should be configured via DHCP. - -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. - -##### machine.network.interfaces.ignore - -`ignore` is used to exclude a specific interface from configuration. -This parameter is optional. - -##### machine.network.interfaces.dummy - -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. -This parameter is optional. - -##### machine.network.interfaces.routes - -`routes` is used to specify static routes that may be necessary. -This parameter is optional. - -Routes can be repeated and includes a `Network` and `Gateway` field. - -Type: `array` - -#### nameservers - -Used to statically set the nameservers for the host. -Defaults to `1.1.1.1` and `8.8.8.8` - -Type: `array` - -#### extraHostEntries - -Allows for extra entries to be added to /etc/hosts file - -Type: `array` - -Examples: - -```yaml -extraHostEntries: - - ip: 192.168.1.100 - aliases: - - test - - test.domain.tld -``` - ---- - -### InstallConfig - -#### disk - -The disk used to install the bootloader, and ephemeral partitions. - -Type: `string` - -Examples: - -```yaml -/dev/sda -``` - -```yaml -/dev/nvme0 -``` - -#### extraKernelArgs - -Allows for supplying extra kernel args to the bootloader config. - -Type: `array` - -Examples: - -```yaml -extraKernelArgs: - - a=b -``` - -#### image - -Allows for supplying the image used to perform the installation. - -Type: `string` - -Examples: - -```yaml -image: docker.io//installer:latest -``` - -#### bootloader - -Indicates if a bootloader should be installed. - -Type: `bool` - -Valid Values: - -- `true` -- `yes` -- `false` -- `no` - -#### wipe - -Indicates if zeroes should be written to the `disk` before performing and installation. -Defaults to `true`. - -Type: `bool` - -Valid Values: - -- `true` -- `yes` -- `false` -- `no` - -#### force - -Indicates if filesystems should be forcefully created. - -Type: `bool` - -Valid Values: - -- `true` -- `yes` -- `false` -- `no` - ---- - -### TimeConfig - -#### servers - -Specifies time (ntp) servers to use for setting system time. -Defaults to `pool.ntp.org` - -> Note: This parameter only supports a single time server - -Type: `array` - ---- - -### RegistriesConfig - -#### mirrors - -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -Name '\*' catches any registry names not specified explicitly. - -Type: `map` - -#### config - -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - -Type: `map` - ---- - -### PodCheckpointer - -#### image - -The `image` field is an override to the default pod-checkpointer image. - -Type: `string` - ---- - -### CoreDNS - -#### image - -The `image` field is an override to the default coredns image. - -Type: `string` - ---- - -### Endpoint - ---- - -### ControlPlaneConfig - -#### endpoint - -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - -Type: `Endpoint` - -Examples: - -```yaml -https://1.2.3.4:443 -``` - -#### localAPIServerPort - -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is 6443. - -Type: `int` - ---- - -### APIServerConfig - -#### image - -The container image used in the API server manifest. - -Type: `string` - -#### extraArgs - -Extra arguments to supply to the API server. - -Type: `map` - -#### certSANs - -Extra certificate subject alternative names for the API server's certificate. - -Type: `array` - ---- - -### ControllerManagerConfig - -#### image - -The container image used in the controller manager manifest. - -Type: `string` - -#### extraArgs - -Extra arguments to supply to the controller manager. - -Type: `map` - ---- - -### ProxyConfig - -#### image - -The container image used in the kube-proxy manifest. - -Type: `string` - -#### mode - -proxy mode of kube-proxy. -By default, this is 'iptables'. - -Type: `string` - -#### extraArgs - -Extra arguments to supply to kube-proxy. - -Type: `map` - ---- - -### SchedulerConfig - -#### image - -The container image used in the scheduler manifest. - -Type: `string` - -#### extraArgs - -Extra arguments to supply to the scheduler. - -Type: `map` - ---- - -### EtcdConfig - -#### image - -The container image used to create the etcd service. - -Type: `string` - -#### ca - -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - -Type: `PEMEncodedCertificateAndKey` - -Examples: - -```yaml -ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJIekNCMHF... - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM... -``` - -#### extraArgs - -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -Type: `map` - -Examples: - -```yaml -extraArgs: - initial-cluster: https://1.2.3.4:2380 - advertise-client-urls: https://1.2.3.4:2379 -``` - ---- - -### ClusterNetworkConfig - -#### cni - -The CNI used. -Composed of "name" and "url". -The "name" key only supports upstream bootkube options of "flannel" or "custom". -URLs is only used if name is equal to "custom". -URLs should point to a single yaml file that will get deployed. -Empty struct or any other name will default to bootkube's flannel. - -Type: `CNIConfig` - -Examples: - -```yaml -cni: - name: "custom" - urls: - - "https://www.mysweethttpserver.com/supersecretcni.yaml" -``` - -#### dnsDomain - -The domain used by Kubernetes DNS. -The default is `cluster.local` - -Type: `string` - -Examples: - -```yaml -cluser.local -``` - -#### podSubnets - -The pod subnet CIDR. - -Type: `array` - -Examples: - -```yaml -podSubnets: - - 10.244.0.0/16 -``` - -#### serviceSubnets - -The service subnet CIDR. - -Type: `array` - -Examples: - -```yaml -serviceSubnets: - - 10.96.0.0/12 -``` - ---- - -### CNIConfig - -#### name - -Name of CNI to use. - -Type: `string` - -#### urls - -URLs containing manifests to apply for CNI. - -Type: `array` - ---- - -### AdminKubeconfigConfig - -#### certLifetime - -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -Type: `Duration` - ---- - -### MachineDisk - -#### device - -The name of the disk to use. -Type: `string` - -#### partitions - -A list of partitions to create on the disk. -Type: `array` - ---- - -### DiskPartition - -#### size - -The size of the partition in bytes. If `size:` is omitted, the partition is sized to occupy the full disk. - -Type: `uint` - -#### mountpoint - -Where to mount the partition. -Type: `string` - ---- - -### MachineFile - -#### content - -The contents of file. -Type: `string` - -#### permissions - -The file's permissions in octal. -Type: `FileMode` - -#### path - -The path of the file. -Type: `string` - -#### op - -The operation to use -Type: `string` - -Valid Values: - -- `create` -- `append` - ---- - -### ExtraHost - -#### ip - -The IP of the host. -Type: `string` - -#### aliases - -The host alias. -Type: `array` - ---- - -### Device - -#### interface - -The interface name. -Type: `string` - -#### cidr - -The CIDR to use. -Type: `string` - -#### routes - -A list of routes associated with the interface. -Type: `array` - -#### bond - -Bond specific options. -Type: `Bond` - -#### vlans - -VLAN specific options. -Type: `array` - -#### mtu - -The interface's MTU. -Type: `int` - -#### dhcp - -Indicates if DHCP should be used. -Type: `bool` - -#### ignore - -Indicates if the interface should be ignored. -Type: `bool` - -#### dummy - -Indicates if the interface is a dummy interface. -Type: `bool` - ---- - -### Bond - -#### interfaces - -The interfaces that make up the bond. -Type: `array` - -#### arpIPTarget - -A bond option. -Please see the official kernel documentation. - -Type: `array` - -#### mode - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### xmitHashPolicy - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### lacpRate - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### adActorSystem - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### arpValidate - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### arpAllTargets - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### primary - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### primaryReselect - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### failOverMac - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### adSelect - -A bond option. -Please see the official kernel documentation. - -Type: `string` - -#### miimon - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### updelay - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### downdelay - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### arpInterval - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### resendIgmp - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### minLinks - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### lpInterval - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### packetsPerSlave - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - -#### numPeerNotif - -A bond option. -Please see the official kernel documentation. - -Type: `uint8` - -#### tlbDynamicLb - -A bond option. -Please see the official kernel documentation. - -Type: `uint8` - -#### allSlavesActive - -A bond option. -Please see the official kernel documentation. - -Type: `uint8` - -#### useCarrier - -A bond option. -Please see the official kernel documentation. - -Type: `bool` - -#### adActorSysPrio - -A bond option. -Please see the official kernel documentation. - -Type: `uint16` - -#### adUserPortKey - -A bond option. -Please see the official kernel documentation. - -Type: `uint16` - -#### peerNotifyDelay - -A bond option. -Please see the official kernel documentation. - -Type: `uint32` - ---- - -### Vlan - -#### cidr - -The CIDR to use. -Type: `string` - -#### routes - -A list of routes associated with the VLAN. -Type: `array` - -#### dhcp - -Indicates if DHCP should be used. -Type: `bool` - -#### vlanId - -The VLAN's ID. -Type: `uint16` - ---- - -### Route - -#### network - -The route's network. -Type: `string` - -#### gateway - -The route's gateway. -Type: `string` - ---- - -### RegistryMirrorConfig - -#### endpoints - -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -Type: `array` - ---- - -### RegistryConfig - -#### tls - -The TLS configuration for this registry. -Type: `RegistryTLSConfig` - -#### auth - -The auth configuration for this registry. -Type: `RegistryAuthConfig` - ---- - -### RegistryAuthConfig - -#### username - -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -Type: `string` - -#### password - -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -Type: `string` - -#### auth - -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -Type: `string` - -#### identityToken - -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -Type: `string` - ---- - -### RegistryTLSConfig - -#### clientIdentity - -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - -Type: `PEMEncodedCertificateAndKey` - -Examples: - -```yaml -clientIdentity: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJIekNCMHF... - key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM... -``` - -#### ca - -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -Type: `array` - -#### insecureSkipVerify - -Skip TLS server certificate verification (not recommended). - -Type: `bool` - ---- diff --git a/website/content/v0.6/virtualized-platforms/_index.md b/website/content/v0.6/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.6/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.6/virtualized-platforms/hyper-v.md b/website/content/v0.6/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.6/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.6/virtualized-platforms/kvm.md b/website/content/v0.6/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.6/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.6/virtualized-platforms/proxmox.md b/website/content/v0.6/virtualized-platforms/proxmox.md deleted file mode 100644 index 640d9c42e..000000000 --- a/website/content/v0.6/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Proxmox" ---- - -Talos is known to work on Proxmox; however, it is currently undocumented. diff --git a/website/content/v0.6/virtualized-platforms/vmware.md b/website/content/v0.6/virtualized-platforms/vmware.md deleted file mode 100644 index 904b13da9..000000000 --- a/website/content/v0.6/virtualized-platforms/vmware.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: "VMware" ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat init.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.6/virtualized-platforms/xen.md b/website/content/v0.6/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.6/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.7/_index.md b/website/content/v0.7/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.7/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.7/bare-metal-platforms/_index.md b/website/content/v0.7/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.7/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.7/bare-metal-platforms/digital-rebar.md b/website/content/v0.7/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index 141ee0d17..000000000 --- a/website/content/v0.7/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: "Digital Rebar" ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `init.yaml`, `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with init, controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- init -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview.](../../guides/metal/overview) - -### Retrieve the `kubeconfig` - -Once everything is running we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.7/bare-metal-platforms/equinix-metal.md b/website/content/v0.7/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index 64f633046..000000000 --- a/website/content/v0.7/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Equinix Metal" ---- - -Talos is known to work on Equinix Metal; however, it is currently undocumented. diff --git a/website/content/v0.7/bare-metal-platforms/matchbox.md b/website/content/v0.7/bare-metal-platforms/matchbox.md deleted file mode 100644 index ed814b2af..000000000 --- a/website/content/v0.7/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: "Matchbox" ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `init.yaml`, `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### The Bootstrap Node - -```json -{ - "id": "init", - "name": "init", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/init.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Additional Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "page_poison=1", - "slab_nomerge", - "slub_debug=P", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "init", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.7/bare-metal-platforms/sidero.md b/website/content/v0.7/bare-metal-platforms/sidero.md deleted file mode 100644 index f3bdce75a..000000000 --- a/website/content/v0.7/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Sidero" ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.7/cloud-platforms/_index.md b/website/content/v0.7/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.7/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.7/cloud-platforms/aws.md b/website/content/v0.7/cloud-platforms/aws.md deleted file mode 100644 index d3c39c436..000000000 --- a/website/content/v0.7/cloud-platforms/aws.md +++ /dev/null @@ -1,255 +0,0 @@ ---- -title: "AWS" ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --group-id $SECURITY_GROUP \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 \ - --group-id $SECURITY_GROUP -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 \ - --group-id $SECURITY_GROUP -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Bootstrap Node - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://init.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-0}]" -``` - -#### Create the Remaining Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 3 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.7/cloud-platforms/azure.md b/website/content/v0.7/cloud-platforms/azure.md deleted file mode 100644 index d1e97f5e2..000000000 --- a/website/content/v0.7/cloud-platforms/azure.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: "Azure" ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create controlplane 0 -az vm create \ - --name talos-controlplane-0 \ - --image talos \ - --custom-data ./init.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-0 \ - --availability-set talos-controlplane-av-set \ - --no-wait - -# Create 2 more controlplane nodes -for i in $( seq 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.7/cloud-platforms/digitalocean.md b/website/content/v0.7/cloud-platforms/digitalocean.md deleted file mode 100644 index 5fb1a9662..000000000 --- a/website/content/v0.7/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: "DigitalOcean" ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Bootstrap Node - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file init.yaml \ - --ssh-keys \ - talos-control-plane-1 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Remaining Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Retrieve the `kubeconfig` - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.7/cloud-platforms/gcp.md b/website/content/v0.7/cloud-platforms/gcp.md deleted file mode 100644 index 07930bc54..000000000 --- a/website/content/v0.7/cloud-platforms/gcp.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: "GCP" ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create control plane 0 -gcloud compute instances create talos-controlplane-0 \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./init.yaml - -# Create control plane 1/2 -for i in $( seq 1 2 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 2 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') - -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.7/guides/_index.md b/website/content/v0.7/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.7/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.7/guides/advanced-networking.md b/website/content/v0.7/guides/advanced-networking.md deleted file mode 100644 index 2d844bdef..000000000 --- a/website/content/v0.7/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - time: - servers: - - time.cloudflare.com - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.7/guides/air-gapped.md b/website/content/v0.7/guides/air-gapped.md deleted file mode 100644 index 22925f634..000000000 --- a/website/content/v0.7/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](qemu) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](qemu) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.19.1 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.7.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.7/guides/configuring-containerd.md b/website/content/v0.7/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.7/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.7/guides/configuring-corporate-proxies.md b/website/content/v0.7/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.7/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.7/guides/configuring-pull-through-cache.md b/website/content/v0.7/guides/configuring-pull-through-cache.md deleted file mode 100644 index 08dd2dddb..000000000 --- a/website/content/v0.7/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](docker) or [QEMU](qemu). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `gcr.io`, `ghcr.io` and `quay.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](qemu) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](docker) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.7/guides/configuring-the-cluster-endpoint.md b/website/content/v0.7/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index ec0fee103..000000000 --- a/website/content/v0.7/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. init.yaml, controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../configuration/v1alpha1#controlplane) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.7/guides/customizing-the-kernel.md b/website/content/v0.7/guides/customizing-the-kernel.md deleted file mode 100644 index 74086bd8f..000000000 --- a/website/content/v0.7/guides/customizing-the-kernel.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM docker.io/andrewrynhard/installer:latest -COPY --from= /boot/vmlinuz /usr/install/vmlinuz -``` - -```bash -docker build --build-arg RM="/lib/modules" -t talos-installer . -``` - -> Note: You can use the `--squash` flag to create smaller images. - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.7/guides/customizing-the-root-filesystem.md b/website/content/v0.7/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.7/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.7/guides/managing-pki.md b/website/content/v0.7/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.7/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.7/guides/resetting-a-machine.md b/website/content/v0.7/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.7/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.7/guides/upgrading-kubernetes.md b/website/content/v0.7/guides/upgrading-kubernetes.md deleted file mode 100644 index 907bd9c54..000000000 --- a/website/content/v0.7/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,263 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### Automated Kubernetes Upgrade - -To upgrade from Kubernetes v1.18.6 to v1.19.0 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.18.6 --to 1.19.0 -updating pod-checkpointer grace period to "0m" -sleeping 5m0s to let the pod-checkpointer self-checkpoint be updated -temporarily taking "kube-apiserver" out of pod-checkpointer control -updating daemonset "kube-apiserver" to version "1.19.0" -updating daemonset "kube-controller-manager" to version "1.19.0" -updating daemonset "kube-scheduler" to version "1.19.0" -updating daemonset "kube-proxy" to version "1.19.0" -updating pod-checkpointer grace period to "5m0s" -``` - -### Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -#### pod-checkpointer - -Talos runs `pod-checkpointer` component which helps to recover control plane components (specifically, API server) if control plane is not healthy. - -However, the way checkpoints interact with API server upgrade may make an upgrade take a lot longer due to a race condition on API server listen port. - -In order to speed up upgrades, first lower `pod-checkpointer` grace period to zero (`kubectl -n kube-system edit daemonset pod-checkpointer`), change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s -``` - -Wait for 5 minutes to let `pod-checkpointer` update self-checkpoint to the new grace period. - -#### API Server - -In the API server's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: ... - command: - - ./hyperkube - - kube-apiserver -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: k8s.gcr.io/kube-apiserver:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-apiserver -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-apiserver -``` - -#### Controller Manager - -In the controller manager's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: ... - command: - - ./hyperkube - - kube-controller-manager -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: k8s.gcr.io/kube-controller-manager:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-controller-manager -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-controller-manager -``` - -#### Scheduler - -In the scheduler's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-scheduler - image: ... - command: - - ./hyperkube - - kube-scheduler -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-sceduler - image: k8s.gcr.io/kube-scheduler:v1.19.0 - command: - - /go-runner - - /usr/local/bin/kube-scheduler -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-scheduler -``` - -#### Restoring pod-checkpointer - -Restore grace period of 5 minutes (`kubectl -n kube-system edit daemonset pod-checkpointer`), change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s -``` - -### Kubelet - -The Talos team now maintains an image for the `kubelet` that should be used starting with Kubernetes 1.19. -The image for this release is `ghcr.io/talos-systems/kubelet:v1.19.3`. -To explicitly set the image, we can use the [official documentation](/.../../configuration/v1alpha1#kubelet). -For example: - -```yaml -machine: - ... - kubelet: - image: ghcr.io/talos-systems/kubelet:v1.19.3 -``` diff --git a/website/content/v0.7/guides/upgrading-talos.md b/website/content/v0.7/guides/upgrading-talos.md deleted file mode 100644 index a7ff6e2c0..000000000 --- a/website/content/v0.7/guides/upgrading-talos.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this, or you can use the automatic upgrade features provided by the [talos controller manager](https://github.com/talos-systems/talos-controller-manager). - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.7.0-beta.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.7.0-beta.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -## Talos Controller Manager - -The Talos Controller Manager can coordinate upgrades of your nodes -automatically. -It ensures that a controllable number of nodes are being -upgraded at any given time. -It also applies an upgrade flow which allows you to classify some machines as -early adopters and others as getting only stable, tested versions. - -To find out more about the controller manager and to get it installed and -configured, take a look at the [GitHub page](https://github.com/talos-systems/talos-controller-manager). -Please note that the controller manager is still in fairly early development. -More advanced features, such as time slot scheduling, will be coming in the -future. - -## Changelog and Upgrade Notes - -In an effort to create more production ready clusters, Talos will now taint control plane nodes as unschedulable. -This means that any application you might have deployed must tolerate this taint if you intend on running the application on control plane nodes. - -Another feature you will notice is the automatic uncordoning of nodes that have been upgraded. -Talos will now uncordon a node if the cordon was initiated by the upgrade process. - -### Talosctl - -The `talosctl` CLI now requires an explicit set of nodes. -This can be configured with `talos config nodes` or set on the fly with `talos --nodes`. diff --git a/website/content/v0.7/introduction/_index.md b/website/content/v0.7/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.7/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.7/introduction/getting-started.md b/website/content/v0.7/introduction/getting-started.md deleted file mode 100644 index bacdf621c..000000000 --- a/website/content/v0.7/introduction/getting-started.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- identity and create the image -- optionally create a load balancer for Kubernetes -- configure Talos -- create the nodes - -## Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.config`: the HTTP(S) URL at which the machine data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `page_poison=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `slub_debug=P`: required by KSPP -- `pti=on`: required by KSPP - -## CLI - -### Installation - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### Configuration - -The `talosctl` command needs some configuration options to connect to the right node. -By default `talosctl` looks for a file called `config` located at `$HOME/.talos`. - -You can also override which configuration `talosctl` uses by specifying the `--talosconfig` parameter: - -```bash -talosctl --talosconfig talosconfig -``` - -Configuring the endpoints: - -```bash -talosctl config endpoint ... -``` - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -Configuring the nodes: - -```bash -talosctl config nodes ... -``` - -The node is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the -'talosctl' configuration file, it is often useful to simply and explicitly -declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -To verify what node(s) you're currently talking to, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` diff --git a/website/content/v0.7/introduction/quickstart.md b/website/content/v0.7/introduction/quickstart.md deleted file mode 100644 index db7310daa..000000000 --- a/website/content/v0.7/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.19.3 10.5.0.2 Talos (v0.7.0) containerd://1.4.1 -talos-default-worker-1 Ready 115s v1.19.3 10.5.0.3 Talos (v0.7.0) containerd://1.4.1 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.7/introduction/system-requirements.md b/website/content/v0.7/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.7/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.7/introduction/what-is-talos.md b/website/content/v0.7/introduction/what-is-talos.md deleted file mode 100644 index e11fb43d4..000000000 --- a/website/content/v0.7/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a sigle declaritive configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.7/learn-more/_index.md b/website/content/v0.7/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.7/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.7/learn-more/architecture.md b/website/content/v0.7/learn-more/architecture.md deleted file mode 100644 index 5b71ea0e7..000000000 --- a/website/content/v0.7/learn-more/architecture.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. diff --git a/website/content/v0.7/learn-more/components.md b/website/content/v0.7/learn-more/components.md deleted file mode 100644 index 5c4de2ca1..000000000 --- a/website/content/v0.7/learn-more/components.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section we will discuss the various components of which Talos is comprised. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [apid](apid) | When interacting with Talos, the gRPC API endpoint you're interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `routerd`. | -| [containerd](containerd) | An industry-standard container runtime with an emphasis on simplicity, robustness and portability. To learn more see the [containerd website](https://containerd.io). | -| [machined](machined) | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| [networkd](networkd) | Handles all of the host level network configuration. Configuration is defined under the `networking` key | -| [timed](timed) | Handles the host time synchronization by acting as a NTP-client. | -| [kernel](kernel) | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| [routerd](routerd) | Responsible for routing an incoming API request from `apid` to the appropriate backend (e.g. `networkd`, `machined` and `timed`). | -| [trustd](trustd) | To run and operate a Kubernetes cluster a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| [udevd](udevd) | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag is used to denote which Talos node ( via `apid` ) should handle the connection. -Typically this is a public facing server. -The `-n | --nodes` flag is used to denote which Talos node(s) should respond to the request. -If `--nodes` is not specified, the first endpoint will be used. - -> Note: Typically there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02` which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards is to `node01`, `node02`, and `node03` which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos as well as Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- [containerd](containerd) -- [kubeadm](kubeadm) -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- [networkd](networkd) -- [timed](timed) -- [trustd](trustd) -- [udevd](udevd) - -### networkd - -Networkd handles all of the host level network configuration. -Configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### timed - -Timed handles the host time synchronization. - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires the distribution of sensitive PKI data. - -To that end, we created `trustd`. -Based on the concept of a Root of Trust, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -It can, for example, accept a write request from another node to place a file on disk. - -Additional methods and capability will be added to the `trustd` component in support of new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.7/learn-more/concepts.md b/website/content/v0.7/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.7/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.7/learn-more/faqs.md b/website/content/v0.7/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.7/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.7/learn-more/philosophy.md b/website/content/v0.7/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.7/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.7/learn-more/talosctl.md b/website/content/v0.7/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.7/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.7/learn-more/upgrades.md b/website/content/v0.7/learn-more/upgrades.md deleted file mode 100644 index 038a8e47f..000000000 --- a/website/content/v0.7/learn-more/upgrades.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. - -## Kubernetes - -Kubernetes upgrades with Talos also start with an API call. diff --git a/website/content/v0.7/local-platforms/_index.md b/website/content/v0.7/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.7/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.7/local-platforms/docker.md b/website/content/v0.7/local-platforms/docker.md deleted file mode 100644 index 85d25c3d5..000000000 --- a/website/content/v0.7/local-platforms/docker.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Docker ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.7/local-platforms/firecracker.md b/website/content/v0.7/local-platforms/firecracker.md deleted file mode 100644 index 24b4e9aa4..000000000 --- a/website/content/v0.7/local-platforms/firecracker.md +++ /dev/null @@ -1,315 +0,0 @@ ---- -title: Firecracker ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.8.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz -L -o cni-plugins-linux-amd64-v0.8.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.8.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.7.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.7/local-platforms/qemu.md b/website/content/v0.7/local-platforms/qemu.md deleted file mode 100644 index d4287ed9a..000000000 --- a/website/content/v0.7/local-platforms/qemu.md +++ /dev/null @@ -1,298 +0,0 @@ ---- -title: QEMU ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.7.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.7/local-platforms/virtualbox.md b/website/content/v0.7/local-platforms/virtualbox.md deleted file mode 100644 index e5f6a52c3..000000000 --- a/website/content/v0.7/local-platforms/virtualbox.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: VirtualBox ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the _out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.7/reference/_index.md b/website/content/v0.7/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.7/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.7/reference/api.md b/website/content/v0.7/reference/api.md deleted file mode 100644 index 49edac129..000000000 --- a/website/content/v0.7/reference/api.md +++ /dev/null @@ -1,2673 +0,0 @@ ---- -title: API ---- - -## Table of Contents - -- [health/health.proto](#health/health.proto) - - [HealthCheck](#health.HealthCheck) - - [HealthCheckResponse](#health.HealthCheckResponse) - - [HealthWatchRequest](#health.HealthWatchRequest) - - [ReadyCheck](#health.ReadyCheck) - - [ReadyCheckResponse](#health.ReadyCheckResponse) - - - [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) - - [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) - - - [Health](#health.Health) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [CopyRequest](#machine.CopyRequest) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMemberList](#machine.EtcdMemberList) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FileInfo](#machine.FileInfo) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesRequest](#machine.ProcessesRequest) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Recover](#machine.Recover) - - [RecoverRequest](#machine.RecoverRequest) - - [RecoverResponse](#machine.RecoverResponse) - - [Reset](#machine.Reset) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RecoverRequest.Source](#machine.RecoverRequest.Source) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - - [MaintenanceService](#machine.MaintenanceService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [os/os.proto](#os/os.proto) - - [OSService](#os.OSService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - [ReadFileRequest](#securityapi.ReadFileRequest) - - [ReadFileResponse](#securityapi.ReadFileResponse) - - [WriteFileRequest](#securityapi.WriteFileRequest) - - [WriteFileResponse](#securityapi.WriteFileResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## health/health.proto - - - - - -### HealthCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) | | | - - - - - - - - -### HealthCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [HealthCheck](#health.HealthCheck) | repeated | | - - - - - - - - -### HealthWatchRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interval_seconds | [int64](#int64) | | | - - - - - - - - -### ReadyCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) | | | - - - - - - - - -### ReadyCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ReadyCheck](#health.ReadyCheck) | repeated | | - - - - - - - - - - -### HealthCheck.ServingStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SERVING | 1 | | -| NOT_SERVING | 2 | | - - - - - -### ReadyCheck.ReadyStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| READY | 1 | | -| NOT_READY | 2 | | - - - - - - - - - -### Health - - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Check | [.google.protobuf.Empty](#google.protobuf.Empty) | [HealthCheckResponse](#health.HealthCheckResponse) | | -| Watch | [HealthWatchRequest](#health.HealthWatchRequest) | [HealthCheckResponse](#health.HealthCheckResponse) stream | | -| Ready | [.google.protobuf.Empty](#google.protobuf.Empty) | [ReadyCheckResponse](#health.ReadyCheckResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc bootstrap - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMemberList - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| members | [string](#string) | repeated | | - - - - - - - - -### EtcdMemberListRequest - - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMemberList](#machine.EtcdMemberList) | repeated | | - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesRequest -rpc processes - - - - - - - - -### ProcessesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Recover -The recover message containing the recover status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RecoverRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| source | [RecoverRequest.Source](#machine.RecoverRequest.Source) | | | - - - - - - - - -### RecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Recover](#machine.Recover) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetRequest -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | | -| reboot | [bool](#bool) | | | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RecoverRequest.Source - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| ETCD | 0 | | -| APISERVER | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| Recover | [RecoverRequest](#machine.RecoverRequest) | [RecoverResponse](#machine.RecoverResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | - - - - -### MaintenanceService - - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## os/os.proto - - - - - - - - - - - -### OSService -The OS service definition. - -Deprecated: this API is deprecated and merged into Machine API. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Containers | [.machine.ContainersRequest](#machine.ContainersRequest) | [.machine.ContainersResponse](#machine.ContainersResponse) | | -| Dmesg | [.machine.DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [.machine.MemoryResponse](#machine.MemoryResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [.machine.ProcessesResponse](#machine.ProcessesResponse) | | -| Restart | [.machine.RestartRequest](#machine.RestartRequest) | [.machine.RestartResponse](#machine.RestartResponse) | | -| Stats | [.machine.StatsRequest](#machine.StatsRequest) | [.machine.StatsResponse](#machine.StatsResponse) | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - -### ReadFileRequest -The request message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### ReadFileResponse -The response message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | - - - - - - - - -### WriteFileRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | -| data | [bytes](#bytes) | | | -| perm | [int32](#int32) | | | - - - - - - - - -### WriteFileResponse -The response message containing the requested logs. - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | -| ReadFile | [ReadFileRequest](#securityapi.ReadFileRequest) | [ReadFileResponse](#securityapi.ReadFileResponse) | | -| WriteFile | [WriteFileRequest](#securityapi.WriteFileRequest) | [WriteFileResponse](#securityapi.WriteFileResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.7/reference/cli.md b/website/content/v0.7/reference/cli.md deleted file mode 100644 index 85ae9607a..000000000 --- a/website/content/v0.7/reference/cli.md +++ /dev/null @@ -1,1629 +0,0 @@ ---- -title: CLI ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the cluster - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --cidr string CIDR of the cluster network (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.7.0/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string the uncompressed kernel image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run (default "1.19.4") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_osctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config - -Manage the client configuration - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use - a control plane node, common in a single node control plane setup, use port 6443 as - this is the port that the API server binds to on every control plane node. For an HA - setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --arch string the architecture of the cluster (default "amd64") - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run (default "1.19.4") - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --version string the desired machine config version to generate (default "v1alpha1") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl recover - -Recover a control plane - -``` -talosctl recover [flags] -``` - -### Options - -``` - -h, --help help for recover - -s, --source string The data source for restoring the control plane manifests from (valid options are "apiserver" and "etcd") (default "apiserver") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - --check string checks server time against specified ntp server (default "c") - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. Pod-checkpointer is handled in a special way to speed up kube-apisever upgrades. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --arch string the cluster architecture (default "amd64") - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.19.4") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the cluster -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl recover](#talosctl-recover) - Recover a control plane -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.7/reference/configuration.md b/website/content/v0.7/reference/configuration.md deleted file mode 100644 index fb7bc56db..000000000 --- a/website/content/v0.7/reference/configuration.md +++ /dev/null @@ -1,3733 +0,0 @@ ---- -title: Configuration ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: -```bash -talosctl gen config --version v1alpha1 -```` - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
- -
- -debug bool - -
-
- -Enable verbose logging to the console. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
- -
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - - -Valid values: - - - - init - - - controlplane - - - join -
- -
- -
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
- -
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.19.4 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - --feature-gates: ServerSideApply=true - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
- -
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
- -
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. Setting this to 0 will cause the parititon to take up the rest of the disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
- -
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - - -
- -
- -
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
- -
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
- -
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
- -
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
- -
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
- -
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
- -
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- -
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
- -
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver-amd64:v1.19.4 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - --feature-gates: ServerSideApply=true - --http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
- -
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager-amd64:v1.19.4 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - --feature-gates: ServerSideApply=true -``` - - -
- -
- -
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy-amd64:v1.19.4 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - --proxy-mode: iptables -``` - - -
- -
- -
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler-amd64:v1.19.4 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - --feature-gates: AllBeta=true -``` - - -
- -
- -
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.12 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - --election-timeout: "5000" -``` - - -
- -
- -
- -podCheckpointer PodCheckpointer - -
-
- -Pod Checkpointer specific configuration options. - - - -Examples: - - -``` yaml -podCheckpointer: - image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - - -
- -
- -
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: k8s.gcr.io/coredns:1.7.0 # The `image` field is an override to the default coredns image. -``` - - -
- -
- -
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed by bootkube. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
- -
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the ExtraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
- -
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
- -
- -allowSchedulingOnMasters bool - -
-
- -Indicates if master nodes are schedulable. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.19.4 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - --feature-gates: ServerSideApply=true - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.19.4 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
- -
- -extraMounts []Mount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
- - - - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
- -
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- -
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
- -
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
- -
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
- -
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
- -
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
- -
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
- -
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - -Appears in: - - -- ClusterConfig.podCheckpointer - - -``` yaml -image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - - -- ClusterConfig.coreDNS - - -``` yaml -image: k8s.gcr.io/coredns:1.7.0 # The `image` field is an override to the default coredns image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
- -
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver-amd64:v1.19.4 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - --feature-gates: ServerSideApply=true - --http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
- - - - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager-amd64:v1.19.4 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - --feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
- - - - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy-amd64:v1.19.4 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - --proxy-mode: iptables -``` - -
- -
- -image string - -
-
- -The container image used in the kube-proxy manifest. - -
- -
- -
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler-amd64:v1.19.4 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - --feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
- - - - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.12 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - --election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "url". -The "name" key only supports options of "flannel" or "custom". -URLs is only used if name is equal to "custom". -URLs should point to the set of YAML files to be deployed. -An empty struct or any other name will default to bootkube's flannel. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
- -
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
- -
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
- -
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - -
- -
- -
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. - -
- -
- - - - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # This size of partition: either bytes or human readable representation. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
- -
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
- -
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
- -
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
- -
- -path string - -
-
- -The path of the file. - -
- -
- -
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
- -
- -aliases []string - -
-
- -The host alias. - -
- -
- - - - - -## Device -Device represents a network interface. - -Appears in: - - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
- -
- -cidr string - -
-
- -Assigns a static IP address to the interface. -This should be in proper CIDR notation. - -> Note: This option is mutually exclusive with DHCP option. - - - -Examples: - - -``` yaml -cidr: 10.5.0.0/16 -``` - - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
- -
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
- -
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
- -
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. -> -> Note: To configure an interface with *only* IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false -> in order for Talos to skip configuration of addresses. -> All other options will still apply. - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
- -
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
- -
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
- -
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- - - - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
- - - - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
- -
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - - -- Device.vlans - - - -
- -
- -cidr string - -
-
- -The CIDR to use. - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
- -
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - - - -## Route -Route represents a network route. - -Appears in: - - -- Device.routes - -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
- -
- -gateway string - -
-
- -The route's gateway. - -
- -
- -
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
- -
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
diff --git a/website/content/v0.7/reference/platform.md b/website/content/v0.7/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.7/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.7/virtualized-platforms/_index.md b/website/content/v0.7/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.7/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.7/virtualized-platforms/hyper-v.md b/website/content/v0.7/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.7/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.7/virtualized-platforms/kvm.md b/website/content/v0.7/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.7/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.7/virtualized-platforms/proxmox.md b/website/content/v0.7/virtualized-platforms/proxmox.md deleted file mode 100644 index c57242fab..000000000 --- a/website/content/v0.7/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Proxmox ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.7.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download/v0.7.0/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the _out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.7/virtualized-platforms/vmware.md b/website/content/v0.7/virtualized-platforms/vmware.md deleted file mode 100644 index 904b13da9..000000000 --- a/website/content/v0.7/virtualized-platforms/vmware.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: "VMware" ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat init.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.7/virtualized-platforms/xen.md b/website/content/v0.7/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.7/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.8/_index.md b/website/content/v0.8/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.8/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.8/bare-metal-platforms/_index.md b/website/content/v0.8/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.8/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.8/bare-metal-platforms/digital-rebar.md b/website/content/v0.8/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index f769b6e82..000000000 --- a/website/content/v0.8/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](/../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](/../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `init.yaml`, `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with init, controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- init -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview.](/../../guides/metal/overview) - -### Retrieve the `kubeconfig` - -Once everything is running we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/bare-metal-platforms/equinix-metal.md b/website/content/v0.8/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index 7a6e82746..000000000 --- a/website/content/v0.8/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the Equinix Metal CLI installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `init_on_free=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `init.yaml`, `controlplane.yaml`, and `join.yaml` -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -talosctl validate --config init.yaml --mode metal -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config join.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Bootstrap Node - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file init.yaml -``` - -#### Create the Remaining Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file join.yaml -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/bare-metal-platforms/matchbox.md b/website/content/v0.8/bare-metal-platforms/matchbox.md deleted file mode 100644 index 8dfbdb8d7..000000000 --- a/website/content/v0.8/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `init.yaml`, `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### The Bootstrap Node - -```json -{ - "id": "init", - "name": "init", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "init_on_free=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/init.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Additional Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "init_on_free=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "init_on_free=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "init", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/bare-metal-platforms/sidero.md b/website/content/v0.8/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.8/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.8/cloud-platforms/_index.md b/website/content/v0.8/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.8/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.8/cloud-platforms/aws.md b/website/content/v0.8/cloud-platforms/aws.md deleted file mode 100644 index e4c46574b..000000000 --- a/website/content/v0.8/cloud-platforms/aws.md +++ /dev/null @@ -1,266 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Take note that in this version of Talos, the generated configs are too long for AWS userdata field. -Comments can be removed to workaround this with a sed command like: - -```bash -cat init.yaml | sed 's/ #.//' > temp.yaml; mv temp.yaml init.yaml - -cat controlplane.yaml | sed 's/ #.//' > temp.yaml; mv temp.yaml controlplane.yaml -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Bootstrap Node - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://init.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-0}]" -``` - -#### Create the Remaining Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 3 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/cloud-platforms/azure.md b/website/content/v0.8/cloud-platforms/azure.md deleted file mode 100644 index 12786ad58..000000000 --- a/website/content/v0.8/cloud-platforms/azure.md +++ /dev/null @@ -1,282 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create controlplane 0 -az vm create \ - --name talos-controlplane-0 \ - --image talos \ - --custom-data ./init.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-0 \ - --availability-set talos-controlplane-av-set \ - --no-wait - -# Create 2 more controlplane nodes -for i in $( seq 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.8/cloud-platforms/digitalocean.md b/website/content/v0.8/cloud-platforms/digitalocean.md deleted file mode 100644 index 1de0d12a9..000000000 --- a/website/content/v0.8/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Bootstrap Node - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file init.yaml \ - --ssh-keys \ - talos-control-plane-1 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Remaining Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Retrieve the `kubeconfig` - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/cloud-platforms/gcp.md b/website/content/v0.8/cloud-platforms/gcp.md deleted file mode 100644 index 024f8d550..000000000 --- a/website/content/v0.8/cloud-platforms/gcp.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create control plane 0 -gcloud compute instances create talos-controlplane-0 \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./init.yaml - -# Create control plane 1/2 -for i in $( seq 1 2 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 2 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') - -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.8/cloud-platforms/openstack.md b/website/content/v0.8/cloud-platforms/openstack.md deleted file mode 100644 index 0ab2ab4d6..000000000 --- a/website/content/v0.8/cloud-platforms/openstack.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control plane 1. Substitute the correct path to configuration files and the desired flavor. -openstack server create talos-control-plane-1 --flavor m1.small --nic port-id=talos-control-plane-1 --image talos --user-data /path/to/init.yaml - -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 2 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/join.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -```bash -talosctl --talosconfig ./talosconfig config endpoint -talosctl --talosconfig ./talosconfig config node -talosctl --talosconfig ./talosconfig kubeconfig -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.8/guides/_index.md b/website/content/v0.8/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.8/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.8/guides/advanced-networking.md b/website/content/v0.8/guides/advanced-networking.md deleted file mode 100644 index c1d95e68b..000000000 --- a/website/content/v0.8/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.8/guides/air-gapped.md b/website/content/v0.8/guides/air-gapped.md deleted file mode 100644 index 6657e32ff..000000000 --- a/website/content/v0.8/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](qemu) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](qemu) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.8.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.8/guides/configuring-certificate-authorities.md b/website/content/v0.8/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.8/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.8/guides/configuring-containerd.md b/website/content/v0.8/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.8/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.8/guides/configuring-corporate-proxies.md b/website/content/v0.8/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.8/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.8/guides/configuring-network-connectivity.md b/website/content/v0.8/guides/configuring-network-connectivity.md deleted file mode 100644 index 2e6f90c25..000000000 --- a/website/content/v0.8/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - - > Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. - See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -[Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -[Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.8/guides/configuring-pull-through-cache.md b/website/content/v0.8/guides/configuring-pull-through-cache.md deleted file mode 100644 index 08dd2dddb..000000000 --- a/website/content/v0.8/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](docker) or [QEMU](qemu). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `gcr.io`, `ghcr.io` and `quay.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](qemu) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](docker) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.8/guides/configuring-the-cluster-endpoint.md b/website/content/v0.8/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index 11776f7a9..000000000 --- a/website/content/v0.8/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. init.yaml, controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](/../../configuration/v1alpha1#controlplane) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.8/guides/customizing-the-kernel.md b/website/content/v0.8/guides/customizing-the-kernel.md deleted file mode 100644 index 74086bd8f..000000000 --- a/website/content/v0.8/guides/customizing-the-kernel.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM docker.io/andrewrynhard/installer:latest -COPY --from= /boot/vmlinuz /usr/install/vmlinuz -``` - -```bash -docker build --build-arg RM="/lib/modules" -t talos-installer . -``` - -> Note: You can use the `--squash` flag to create smaller images. - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.8/guides/customizing-the-root-filesystem.md b/website/content/v0.8/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.8/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.8/guides/managing-pki.md b/website/content/v0.8/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.8/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.8/guides/resetting-a-machine.md b/website/content/v0.8/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.8/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.8/guides/storage.md b/website/content/v0.8/guides/storage.md deleted file mode 100644 index 8bea15d7d..000000000 --- a/website/content/v0.8/guides/storage.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -Talos is known to work with Rook and NFS. - -## Rook - -We recommend at least Rook v1.5. - -## NFS - -The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. -This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. diff --git a/website/content/v0.8/guides/upgrading-kubernetes.md b/website/content/v0.8/guides/upgrading-kubernetes.md deleted file mode 100644 index e3f8c1ddf..000000000 --- a/website/content/v0.8/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,364 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - - - -## Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### Automated Kubernetes Upgrade - -To upgrade from Kubernetes v1.19.4 to v1.20.1 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.19.4 --to 1.20.1 -patched kube-apiserver secrets for "service-account.key" -updating pod-checkpointer grace period to "0m" -sleeping 5m0s to let the pod-checkpointer self-checkpoint be updated -temporarily taking "kube-apiserver" out of pod-checkpointer control -updating daemonset "kube-apiserver" to version "1.20.1" -updating daemonset "kube-controller-manager" to version "1.20.1" -updating daemonset "kube-scheduler" to version "1.20.1" -updating daemonset "kube-proxy" to version "1.20.1" -updating pod-checkpointer grace period to "5m0s" -``` - -### Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -#### Patching `kube-apiserver` Secrets - -Copy secret value `service-account.key` from the secret `kube-controller-manager` in `kube-system` namespace to the -secret `kube-apiserver`. - -After these changes, `kube-apiserver` secret should contain the following entries: - -```bash -Data -==== -service-account.key: -apiserver.key: -ca.crt: -front-proxy-client.crt: -apiserver-kubelet-client.crt: -encryptionconfig.yaml: -etcd-client.crt: -front-proxy-client.key: -service-account.pub: -apiserver.crt: -auditpolicy.yaml: -etcd-client.key: -apiserver-kubelet-client.key: -front-proxy-ca.crt: -etcd-client-ca.crt: -``` - -#### pod-checkpointer - -Talos runs `pod-checkpointer` component which helps to recover control plane components (specifically, API server) if control plane is not healthy. - -However, the way checkpoints interact with API server upgrade may make an upgrade take a lot longer due to a race condition on API server listen port. - -In order to speed up upgrades, first lower `pod-checkpointer` grace period to zero (`kubectl -n kube-system edit daemonset pod-checkpointer`), change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s -``` - -Wait for 5 minutes to let `pod-checkpointer` update self-checkpoint to the new grace period. - -#### API Server - -In the API server's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: k8s.gcr.io/kube-apiserver:v1.19.4 - command: - - /go-runner - - /usr/local/bin/kube-apiserver - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-apiserver - image: k8s.gcr.io/kube-apiserver:v1.20.1 - command: - - /go-runner - - /usr/local/bin/kube-apiserver - - ... - - --api-audiences= - - --service-account-issuer= - - --service-account-signing-key-file=/etc/kubernetes/secrets/service-account.key - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -Summary of the changes: - -* update image version -* add new toleration -* add three new flags (replace `` with the actual endpoint of the cluster, e.g. `https://10.5.0.1:6443`) - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-apiserver -``` - -#### Controller Manager - -In the controller manager's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: k8s.gcr.io/kube-controller-manager:v1.19.4 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-controller-manager - image: k8s.gcr.io/kube-controller-manager:v1.20.1 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-controller-manager -``` - -#### Scheduler - -In the scheduler's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-scheduler - image: k8s.gcr.io/kube-scheduler:v1.19.4 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-sceduler - image: k8s.gcr.io/kube-scheduler:v1.20.1 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-scheduler -``` - -#### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.19.4 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -#### Restoring pod-checkpointer - -Restore grace period of 5 minutes (`kubectl -n kube-system edit daemonset pod-checkpointer`) and add new toleration, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=0s - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: pod-checkpointer - command: - ... - - --checkpoint-grace-period=5m0s - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -### Kubelet - -The Talos team now maintains an image for the `kubelet` that should be used starting with Kubernetes 1.20. -The image for this release is `ghcr.io/talos-systems/kubelet:v1.20.1`. -To explicitly set the image, we can use the [official documentation](/../../configuration/v1alpha1#kubelet). -For example: - -```yaml -machine: - ... - kubelet: - image: ghcr.io/talos-systems/kubelet:v1.20.1 -``` diff --git a/website/content/v0.8/guides/upgrading-talos.md b/website/content/v0.8/guides/upgrading-talos.md deleted file mode 100644 index b147459fe..000000000 --- a/website/content/v0.8/guides/upgrading-talos.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this, or you can use the automatic upgrade features provided by the [talos controller manager](https://github.com/talos-systems/talos-controller-manager). - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.8.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.8.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -## Talos Controller Manager - -The Talos Controller Manager can coordinate upgrades of your nodes -automatically. -It ensures that a controllable number of nodes are being -upgraded at any given time. -It also applies an upgrade flow which allows you to classify some machines as -early adopters and others as getting only stable, tested versions. - -To find out more about the controller manager and to get it installed and -configured, take a look at the [GitHub page](https://github.com/talos-systems/talos-controller-manager). -Please note that the controller manager is still in fairly early development. -More advanced features, such as time slot scheduling, will be coming in the -future. - -## Changelog and Upgrade Notes - -In an effort to create more production ready clusters, Talos will now taint control plane nodes as unschedulable. -This means that any application you might have deployed must tolerate this taint if you intend on running the application on control plane nodes. - -Another feature you will notice is the automatic uncordoning of nodes that have been upgraded. -Talos will now uncordon a node if the cordon was initiated by the upgrade process. - -### Talosctl - -The `talosctl` CLI now requires an explicit set of nodes. -This can be configured with `talos config nodes` or set on the fly with `talos --nodes`. diff --git a/website/content/v0.8/introduction/_index.md b/website/content/v0.8/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.8/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.8/introduction/getting-started.md b/website/content/v0.8/introduction/getting-started.md deleted file mode 100644 index a2fceadb2..000000000 --- a/website/content/v0.8/introduction/getting-started.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- identity and create the image -- optionally create a load balancer for Kubernetes -- configure Talos -- create the nodes - -## Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.config`: the HTTP(S) URL at which the machine data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `init_on_free=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -## CLI - -### Installation - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### Configuration - -The `talosctl` command needs some configuration options to connect to the right node. -By default `talosctl` looks for a file called `config` located at `$HOME/.talos`. - -You can also override which configuration `talosctl` uses by specifying the `--talosconfig` parameter: - -```bash -talosctl --talosconfig talosconfig -``` - -Configuring the endpoints: - -```bash -talosctl config endpoint ... -``` - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -Configuring the nodes: - -```bash -talosctl config nodes ... -``` - -The node is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the -'talosctl' configuration file, it is often useful to simply and explicitly -declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -To verify what node(s) you're currently talking to, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` diff --git a/website/content/v0.8/introduction/quickstart.md b/website/content/v0.8/introduction/quickstart.md deleted file mode 100644 index ebaddab46..000000000 --- a/website/content/v0.8/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.1 10.5.0.2 Talos (v0.8.0) containerd://1.4.3 -talos-default-worker-1 Ready 115s v1.20.1 10.5.0.3 Talos (v0.8.0) containerd://1.4.3 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.8/introduction/system-requirements.md b/website/content/v0.8/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.8/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.8/introduction/what-is-talos.md b/website/content/v0.8/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.8/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.8/learn-more/_index.md b/website/content/v0.8/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.8/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.8/learn-more/architecture.md b/website/content/v0.8/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.8/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.8/learn-more/components.md b/website/content/v0.8/learn-more/components.md deleted file mode 100644 index 5c4de2ca1..000000000 --- a/website/content/v0.8/learn-more/components.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section we will discuss the various components of which Talos is comprised. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [apid](apid) | When interacting with Talos, the gRPC API endpoint you're interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `routerd`. | -| [containerd](containerd) | An industry-standard container runtime with an emphasis on simplicity, robustness and portability. To learn more see the [containerd website](https://containerd.io). | -| [machined](machined) | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| [networkd](networkd) | Handles all of the host level network configuration. Configuration is defined under the `networking` key | -| [timed](timed) | Handles the host time synchronization by acting as a NTP-client. | -| [kernel](kernel) | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| [routerd](routerd) | Responsible for routing an incoming API request from `apid` to the appropriate backend (e.g. `networkd`, `machined` and `timed`). | -| [trustd](trustd) | To run and operate a Kubernetes cluster a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| [udevd](udevd) | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag is used to denote which Talos node ( via `apid` ) should handle the connection. -Typically this is a public facing server. -The `-n | --nodes` flag is used to denote which Talos node(s) should respond to the request. -If `--nodes` is not specified, the first endpoint will be used. - -> Note: Typically there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02` which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards is to `node01`, `node02`, and `node03` which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos as well as Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- [containerd](containerd) -- [kubeadm](kubeadm) -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- [networkd](networkd) -- [timed](timed) -- [trustd](trustd) -- [udevd](udevd) - -### networkd - -Networkd handles all of the host level network configuration. -Configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### timed - -Timed handles the host time synchronization. - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires the distribution of sensitive PKI data. - -To that end, we created `trustd`. -Based on the concept of a Root of Trust, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -It can, for example, accept a write request from another node to place a file on disk. - -Additional methods and capability will be added to the `trustd` component in support of new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.8/learn-more/concepts.md b/website/content/v0.8/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.8/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.8/learn-more/faqs.md b/website/content/v0.8/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.8/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.8/learn-more/philosophy.md b/website/content/v0.8/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.8/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.8/learn-more/talosctl.md b/website/content/v0.8/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.8/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.8/learn-more/upgrades.md b/website/content/v0.8/learn-more/upgrades.md deleted file mode 100644 index e8e6667e5..000000000 --- a/website/content/v0.8/learn-more/upgrades.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. - -## Upgrade Notes for Talos 0.8 - -Talos 0.8 comes with new [KSPP requirements](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings) compliance check. - -Following kernel arguments are mandatory for Talos to boot successfully: - -- `init_on_alloc=1`: required by KSPP -- `init_on_free=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -Talos installer automatically injects those args while installing Talos, so this mostly is required when PXE booting Talos. - -## Kubernetes - -Kubernetes upgrades with Talos are covered in a [separate document](../../guides/upgrading-kubernetes/). diff --git a/website/content/v0.8/local-platforms/_index.md b/website/content/v0.8/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.8/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.8/local-platforms/docker.md b/website/content/v0.8/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.8/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.8/local-platforms/firecracker.md b/website/content/v0.8/local-platforms/firecracker.md deleted file mode 100644 index b874bc78d..000000000 --- a/website/content/v0.8/local-platforms/firecracker.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Firecracker -description: "Creating Talos Kubernetes cluster using Firecracker VMs." ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.8.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.8.5/cni-plugins-linux-amd64-v0.8.5.tgz -L -o cni-plugins-linux-amd64-v0.8.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.8.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.8.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.8/local-platforms/qemu.md b/website/content/v0.8/local-platforms/qemu.md deleted file mode 100644 index cd07040d9..000000000 --- a/website/content/v0.8/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.8.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.8/local-platforms/virtualbox.md b/website/content/v0.8/local-platforms/virtualbox.md deleted file mode 100644 index 28a216deb..000000000 --- a/website/content/v0.8/local-platforms/virtualbox.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the _out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.8/reference/_index.md b/website/content/v0.8/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.8/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.8/reference/api.md b/website/content/v0.8/reference/api.md deleted file mode 100644 index 29a0b4d3d..000000000 --- a/website/content/v0.8/reference/api.md +++ /dev/null @@ -1,3110 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [health/health.proto](#health/health.proto) - - [HealthCheck](#health.HealthCheck) - - [HealthCheckResponse](#health.HealthCheckResponse) - - [HealthWatchRequest](#health.HealthWatchRequest) - - [ReadyCheck](#health.ReadyCheck) - - [ReadyCheckResponse](#health.ReadyCheckResponse) - - - [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) - - [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) - - - [Health](#health.Health) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMemberList](#machine.EtcdMemberList) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FileInfo](#machine.FileInfo) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesRequest](#machine.ProcessesRequest) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Recover](#machine.Recover) - - [RecoverRequest](#machine.RecoverRequest) - - [RecoverResponse](#machine.RecoverResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RecoverRequest.Source](#machine.RecoverRequest.Source) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - [ReadFileRequest](#securityapi.ReadFileRequest) - - [ReadFileResponse](#securityapi.ReadFileResponse) - - [WriteFileRequest](#securityapi.WriteFileRequest) - - [WriteFileResponse](#securityapi.WriteFileResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [DisksResponse](#storage.DisksResponse) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## health/health.proto - - - - - -### HealthCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) | | | - - - - - - - - -### HealthCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [HealthCheck](#health.HealthCheck) | repeated | | - - - - - - - - -### HealthWatchRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interval_seconds | [int64](#int64) | | | - - - - - - - - -### ReadyCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) | | | - - - - - - - - -### ReadyCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ReadyCheck](#health.ReadyCheck) | repeated | | - - - - - - - - - - -### HealthCheck.ServingStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SERVING | 1 | | -| NOT_SERVING | 2 | | - - - - - -### ReadyCheck.ReadyStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| READY | 1 | | -| NOT_READY | 2 | | - - - - - - - - - -### Health - - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Check | [.google.protobuf.Empty](#google.protobuf.Empty) | [HealthCheckResponse](#health.HealthCheckResponse) | | -| Watch | [HealthWatchRequest](#health.HealthWatchRequest) | [HealthCheckResponse](#health.HealthCheckResponse) stream | | -| Ready | [.google.protobuf.Empty](#google.protobuf.Empty) | [ReadyCheckResponse](#health.ReadyCheckResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| no_reboot | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc bootstrap - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMemberList - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| members | [string](#string) | repeated | | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMemberList](#machine.EtcdMemberList) | repeated | | - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesRequest -rpc processes - - - - - - - - -### ProcessesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Recover -The recover message containing the recover status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RecoverRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| source | [RecoverRequest.Source](#machine.RecoverRequest.Source) | | | - - - - - - - - -### RecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Recover](#machine.Recover) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_JOIN | 3 | | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RecoverRequest.Source - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| ETCD | 0 | | -| APISERVER | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| Recover | [RecoverRequest](#machine.RecoverRequest) | [RecoverResponse](#machine.RecoverResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - -### ReadFileRequest -The request message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### ReadFileResponse -The response message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | - - - - - - - - -### WriteFileRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | -| data | [bytes](#bytes) | | | -| perm | [int32](#int32) | | | - - - - - - - - -### WriteFileResponse -The response message containing the requested logs. - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | -| ReadFile | [ReadFileRequest](#securityapi.ReadFileRequest) | [ReadFileResponse](#securityapi.ReadFileResponse) | | -| WriteFile | [WriteFileRequest](#securityapi.WriteFileRequest) | [WriteFileResponse](#securityapi.WriteFileResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | - - - - - - - - -### DisksResponse -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.8/reference/cli.md b/website/content/v0.8/reference/cli.md deleted file mode 100644 index e22de22f8..000000000 --- a/website/content/v0.8/reference/cli.md +++ /dev/null @@ -1,1811 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --no-reboot apply the config only after the reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the cluster - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --cidr string CIDR of the cluster network (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.8.0-alpha.3/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string the uncompressed kernel image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.20.1") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_osctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config contexts - -List contexts defined in Talos config - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config merge - -Merge additional contexts from another Talos config into the default config - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config - -Manage the client configuration - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List contexts defined in Talos config -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another Talos config into the default config -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use - a control plane node, common in a single node control plane setup, use port 6443 as - this is the port that the API server binds to on every control plane node. For an HA - setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --arch string the architecture of the cluster (default "amd64") - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --version string the desired machine config version to generate (default "v1alpha1") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl recover - -Recover a control plane - -``` -talosctl recover [flags] -``` - -### Options - -``` - -h, --help help for recover - -s, --source string The data source for restoring the control plane manifests from (valid options are "apiserver" and "etcd") (default "apiserver") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace - -c, --use-cri use the CRI driver -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. Pod-checkpointer is handled in a special way to speed up kube-apisever upgrades. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --arch string the cluster architecture (default "amd64") - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.20.1") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the cluster -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl recover](#talosctl-recover) - Recover a control plane -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.8/reference/configuration.md b/website/content/v0.8/reference/configuration.md deleted file mode 100644 index e0c28dd6c..000000000 --- a/website/content/v0.8/reference/configuration.md +++ /dev/null @@ -1,3792 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: -```bash -talosctl gen config --version v1alpha1 -```` - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
- -
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
- -
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - - -Valid values: - - - - init - - - controlplane - - - join -
- -
- -
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
- -
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.20.1 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
- -
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
- -
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
- -
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - - -
- -
- -
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
- -
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
- -
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
- -
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
- -
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
- -
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
- -
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- -
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
- -
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver-amd64:v1.20.1 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
- -
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager-amd64:v1.20.1 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
- -
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy-amd64:v1.20.1 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
- -
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler-amd64:v1.20.1 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
- -
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.14 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" -``` - - -
- -
- -
- -podCheckpointer PodCheckpointer - -
-
- -Pod Checkpointer specific configuration options. - - - -Examples: - - -``` yaml -podCheckpointer: - image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - - -
- -
- -
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: k8s.gcr.io/coredns:1.7.0 # The `image` field is an override to the default coredns image. -``` - - -
- -
- -
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed by bootkube. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
- -
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the ExtraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
- -
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
- -
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.20.1 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.20.1 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
- -
- -extraMounts []Mount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
- - - - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
- -
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- -
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
- -
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
- -
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
- -
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
- -
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
- -
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
- -
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - -Appears in: - - -- ClusterConfig.podCheckpointer - - -``` yaml -image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - - -- ClusterConfig.coreDNS - - -``` yaml -image: k8s.gcr.io/coredns:1.7.0 # The `image` field is an override to the default coredns image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
- -
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver-amd64:v1.20.1 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver-amd64:v1.20.1 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
- - - - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager-amd64:v1.20.1 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager-amd64:v1.20.1 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
- - - - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy-amd64:v1.20.1 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy-amd64:v1.20.1 -``` - - -
- -
- -
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler-amd64:v1.20.1 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler-amd64:v1.20.1 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
- - - - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.14 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.14 -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "url". -The "name" key only supports options of "flannel" or "custom". -URLs is only used if name is equal to "custom". -URLs should point to the set of YAML files to be deployed. -An empty struct or any other name will default to bootkube's flannel. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
- -
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
- -
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
- -
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - -
- -
- -
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. - -
- -
- - - - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
- -
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
- -
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
- -
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
- -
- -path string - -
-
- -The path of the file. - -
- -
- -
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
- -
- -aliases []string - -
-
- -The host alias. - -
- -
- - - - - -## Device -Device represents a network interface. - -Appears in: - - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
- -
- -cidr string - -
-
- -Assigns a static IP address to the interface. -This should be in proper CIDR notation. - -> Note: This option is mutually exclusive with DHCP option. - - - -Examples: - - -``` yaml -cidr: 10.5.0.0/16 -``` - - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
- -
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
- -
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
- -
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. -> -> Note: To configure an interface with *only* IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false -> in order for Talos to skip configuration of addresses. -> All other options will still apply. - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
- -
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
- -
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
- -
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- - - - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
- - - - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
- -
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - - -- Device.vlans - - - -
- -
- -cidr string - -
-
- -The CIDR to use. - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
- -
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - - - -## Route -Route represents a network route. - -Appears in: - - -- Device.routes - -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
- -
- -gateway string - -
-
- -The route's gateway. - -
- -
- -
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
- -
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - - diff --git a/website/content/v0.8/reference/platform.md b/website/content/v0.8/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.8/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.8/single-board-computers/_index.md b/website/content/v0.8/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.8/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.8/single-board-computers/bananapi_m64.md b/website/content/v0.8/single-board-computers/bananapi_m64.md deleted file mode 100644 index d9f8e08ac..000000000 --- a/website/content/v0.8/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/v0.8.4/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/v0.8.4/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.8/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.8/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index 6a4fc6a56..000000000 --- a/website/content/v0.8/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/v0.8.4/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/v0.8.4/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.8/single-board-computers/rock64.md b/website/content/v0.8/single-board-computers/rock64.md deleted file mode 100644 index 7125c90d2..000000000 --- a/website/content/v0.8/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/v0.8.4/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/v0.8.4/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.8/single-board-computers/rpi_4.md b/website/content/v0.8/single-board-computers/rpi_4.md deleted file mode 100644 index 9790df363..000000000 --- a/website/content/v0.8/single-board-computers/rpi_4.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/v0.8.4/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and run the following: -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -```bash -curl -LO https://github.com/raspberrypi/rpi-eeprom/releases/download/v2020.09.03-138a1/rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0 /mnt -sudo bsdtar rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached then the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/v0.8.4/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.8/virtualized-platforms/_index.md b/website/content/v0.8/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.8/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.8/virtualized-platforms/hyper-v.md b/website/content/v0.8/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.8/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.8/virtualized-platforms/kvm.md b/website/content/v0.8/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.8/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.8/virtualized-platforms/proxmox.md b/website/content/v0.8/virtualized-platforms/proxmox.md deleted file mode 100644 index b6445fb29..000000000 --- a/website/content/v0.8/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,182 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.8.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download/v0.8.0/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the _out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.8/virtualized-platforms/vmware.md b/website/content/v0.8/virtualized-platforms/vmware.md deleted file mode 100644 index 70f391d21..000000000 --- a/website/content/v0.8/virtualized-platforms/vmware.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat init.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.8/virtualized-platforms/xen.md b/website/content/v0.8/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.8/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v0.9/_index.md b/website/content/v0.9/_index.md deleted file mode 100644 index 9ecc6d952..000000000 --- a/website/content/v0.9/_index.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos](introduction/what-is-talos/): a quick description of Talos -- [Quickstart](introduction/quickstart/): the fastest way to get a Talos cluster up and running -- [Getting Started](introduction/getting-started/): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/talos-systems/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Mondays at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/day-pxhv-zky). - -You can subscribe to this meeting by joining the community forum above. - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v0.9/bare-metal-platforms/_index.md b/website/content/v0.9/bare-metal-platforms/_index.md deleted file mode 100644 index a4c9c94d2..000000000 --- a/website/content/v0.9/bare-metal-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Bare Metal Platforms" -weight: 20 ---- diff --git a/website/content/v0.9/bare-metal-platforms/digital-rebar.md b/website/content/v0.9/bare-metal-platforms/digital-rebar.md deleted file mode 100644 index b6622d951..000000000 --- a/website/content/v0.9/bare-metal-platforms/digital-rebar.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: "Digital Rebar" -description: "In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes using an existing digital rebar deployment." ---- - -## Prerequisites - -- 3 nodes (please see [hardware requirements](../../guides/getting-started#system-requirements)) -- Loadbalancer -- Digital Rebar Server -- Talosctl access (see [talosctl setup](../../guides/getting-started/talosctl)) - -## Creating a Cluster - -In this guide we will create an Kubernetes cluster with 1 worker node, and 2 controlplane nodes. -We assume an existing digital rebar deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -> The loadbalancer is used to distribute the load across multiple controlplane nodes. -> This isn't covered in detail, because we asume some loadbalancing knowledge before hand. -> If you think this should be added to the docs, please [create a issue](https://github.com/talos-systems/talos/issues). - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -Digital Rebar has a build-in fileserver, which means we can use this feature to expose the talos configuration files. -We will place `init.yaml`, `controlplane.yaml`, and `worker.yaml` into Digital Rebar file server by using the `drpcli` tools. - -Copy the generated files from the step above into your Digital Rebar installation. - -```bash -drpcli file upload .yaml as .yaml -``` - -Replacing `` with init, controlplane or worker. - -### Download the boot files - -Download a recent version of `boot.tar.gz` from [github.](https://github.com/talos-systems/talos/releases/) - -Upload to DRB: - -```bash -$ drpcli isos upload boot.tar.gz as talos.tar.gz -{ - "Path": "talos.tar.gz", - "Size": 96470072 -} -``` - -We have some Digital Rebar [example files](https://github.com/talos-systems/talos/tree/master/hack/test/digitalrebar/) in the Git repo you can use to provision Digital Rebar with drpcli. - -To apply these configs you need to create them, and then apply them as follow: - -```bash -$ drpcli bootenvs create talos -{ - "Available": true, - "BootParams": "", - "Bundle": "", - "Description": "", - "Documentation": "", - "Endpoint": "", - "Errors": [], - "Initrds": [], - "Kernel": "", - "Meta": {}, - "Name": "talos", - "OS": { - "Codename": "", - "Family": "", - "IsoFile": "", - "IsoSha256": "", - "IsoUrl": "", - "Name": "", - "SupportedArchitectures": {}, - "Version": "" - }, - "OnlyUnknown": false, - "OptionalParams": [], - "ReadOnly": false, - "RequiredParams": [], - "Templates": [], - "Validated": true -} -``` - -```bash -drpcli bootenvs update talos - < bootenv.yaml -``` - -> You need to do this for all files in the example directory. -> If you don't have access to the `drpcli` tools you can also use the webinterface. - -It's important to have a corresponding SHA256 hash matching the boot.tar.gz - -#### Bootenv BootParams - -We're using some of Digital Rebar build in templating to make sure the machine gets the correct role assigned. - -`talos.platform=metal talos.config={{ .ProvisionerURL }}/files/{{.Param \"talos/role\"}}.yaml"` - -This is why we also include a `params.yaml` in the example directory to make sure the role is set to one of the following: - -- controlplane -- init -- worker - -The `{{.Param \"talos/role\"}}` then gets populated with one of the above roles. - -### Boot the Machines - -In the UI of Digital Rebar you need to select the machines you want te provision. -Once selected, you need to assign to following: - -- Profile -- Workflow - -This will provision the Stage and Bootenv with the talos values. -Once this is done, you can boot the machine. - -To understand the boot process, we have a higher level overview located at [metal overview.](/../../guides/metal/overview) - -### Retrieve the `kubeconfig` - -Once everything is running we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/bare-metal-platforms/equinix-metal.md b/website/content/v0.9/bare-metal-platforms/equinix-metal.md deleted file mode 100644 index 94835b78d..000000000 --- a/website/content/v0.9/bare-metal-platforms/equinix-metal.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: "Equinix Metal" -description: "Creating Talos cluster using Equinix Metal." ---- - -## Prerequisites - -This guide assumes the user has a working API token, the Equinix Metal CLI installed, and some familiarity with the CLI. - -## Network Booting - -To install Talos to a server a working TFTP and iPXE server are needed. -How this is done varies and is left as an exercise for the user. -In general this requires a Talos kernel vmlinuz and initramfs. -These assets can be downloaded from a given [release](https://github.com/talos-systems/talos/releases). - -## Special Considerations - -### PXE Boot Kernel Parameters - -The following is a list of kernel parameters required by Talos: - -- `talos.platform`: set this to `packet` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -### User Data - - - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `init.yaml`, `controlplane.yaml`, and `join.yaml` -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -talosctl validate --config init.yaml --mode metal -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config join.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Bootstrap Node - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file init.yaml -``` - -#### Create the Remaining Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file join.yaml -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/bare-metal-platforms/matchbox.md b/website/content/v0.9/bare-metal-platforms/matchbox.md deleted file mode 100644 index 7d31bc25d..000000000 --- a/website/content/v0.9/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `init.yaml`, `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### The Bootstrap Node - -```json -{ - "id": "init", - "name": "init", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/init.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Additional Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "init", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/bare-metal-platforms/sidero.md b/website/content/v0.9/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.9/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.9/cloud-platforms/_index.md b/website/content/v0.9/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.9/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.9/cloud-platforms/aws.md b/website/content/v0.9/cloud-platforms/aws.md deleted file mode 100644 index e4c46574b..000000000 --- a/website/content/v0.9/cloud-platforms/aws.md +++ /dev/null @@ -1,266 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Take note that in this version of Talos, the generated configs are too long for AWS userdata field. -Comments can be removed to workaround this with a sed command like: - -```bash -cat init.yaml | sed 's/ #.//' > temp.yaml; mv temp.yaml init.yaml - -cat controlplane.yaml | sed 's/ #.//' > temp.yaml; mv temp.yaml controlplane.yaml -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Bootstrap Node - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://init.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-0}]" -``` - -#### Create the Remaining Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 3 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/cloud-platforms/azure.md b/website/content/v0.9/cloud-platforms/azure.md deleted file mode 100644 index 12786ad58..000000000 --- a/website/content/v0.9/cloud-platforms/azure.md +++ /dev/null @@ -1,282 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create controlplane 0 -az vm create \ - --name talos-controlplane-0 \ - --image talos \ - --custom-data ./init.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-0 \ - --availability-set talos-controlplane-av-set \ - --no-wait - -# Create 2 more controlplane nodes -for i in $( seq 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.9/cloud-platforms/digitalocean.md b/website/content/v0.9/cloud-platforms/digitalocean.md deleted file mode 100644 index 1de0d12a9..000000000 --- a/website/content/v0.9/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Bootstrap Node - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file init.yaml \ - --ssh-keys \ - talos-control-plane-1 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Remaining Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Retrieve the `kubeconfig` - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/cloud-platforms/gcp.md b/website/content/v0.9/cloud-platforms/gcp.md deleted file mode 100644 index 024f8d550..000000000 --- a/website/content/v0.9/cloud-platforms/gcp.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create control plane 0 -gcloud compute instances create talos-controlplane-0 \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./init.yaml - -# Create control plane 1/2 -for i in $( seq 1 2 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 2 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') - -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.9/cloud-platforms/openstack.md b/website/content/v0.9/cloud-platforms/openstack.md deleted file mode 100644 index 0ab2ab4d6..000000000 --- a/website/content/v0.9/cloud-platforms/openstack.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control plane 1. Substitute the correct path to configuration files and the desired flavor. -openstack server create talos-control-plane-1 --flavor m1.small --nic port-id=talos-control-plane-1 --image talos --user-data /path/to/init.yaml - -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 2 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/join.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -```bash -talosctl --talosconfig ./talosconfig config endpoint -talosctl --talosconfig ./talosconfig config node -talosctl --talosconfig ./talosconfig kubeconfig -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.9/guides/_index.md b/website/content/v0.9/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.9/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.9/guides/advanced-networking.md b/website/content/v0.9/guides/advanced-networking.md deleted file mode 100644 index c1d95e68b..000000000 --- a/website/content/v0.9/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.9/guides/air-gapped.md b/website/content/v0.9/guides/air-gapped.md deleted file mode 100644 index 3233380c5..000000000 --- a/website/content/v0.9/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.9.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.9/guides/configuring-certificate-authorities.md b/website/content/v0.9/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.9/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.9/guides/configuring-containerd.md b/website/content/v0.9/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.9/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.9/guides/configuring-corporate-proxies.md b/website/content/v0.9/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.9/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.9/guides/configuring-network-connectivity.md b/website/content/v0.9/guides/configuring-network-connectivity.md deleted file mode 100644 index 83c44b115..000000000 --- a/website/content/v0.9/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.9/guides/configuring-pull-through-cache.md b/website/content/v0.9/guides/configuring-pull-through-cache.md deleted file mode 100644 index 5502f20f7..000000000 --- a/website/content/v0.9/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `gcr.io`, `ghcr.io` and `quay.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.9/guides/configuring-the-cluster-endpoint.md b/website/content/v0.9/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index 2e1343b55..000000000 --- a/website/content/v0.9/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. init.yaml, controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.9/guides/configuring-wireguard-network.md b/website/content/v0.9/guides/configuring-wireguard-network.md deleted file mode 100644 index 27dc41aa3..000000000 --- a/website/content/v0.9/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > join.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - cidr: 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.9/guides/converting-control-plane.md b/website/content/v0.9/guides/converting-control-plane.md deleted file mode 100644 index d68f2d5c2..000000000 --- a/website/content/v0.9/guides/converting-control-plane.md +++ /dev/null @@ -1,262 +0,0 @@ ---- -title: "Converting Control Plane" -description: "How to convert Talos self-hosted Kubernetes control plane (pre-0.9) to static pods based one." ---- - -Talos version 0.9 runs Kubernetes control plane in a new way: static pods managed by Talos. -Talos version 0.8 and below runs self-hosted control plane. -After Talos OS upgrade to version 0.9 Kubernetes control plane should be converted to run as static pods. - -This guide describes automated conversion script and also shows detailed manual conversion process. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Conversion - -First, make sure all nodes are updated to Talos 0.9: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready control-plane,master 58m v1.20.4 172.20.0.2 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-2 Ready control-plane,master 58m v1.20.4 172.20.0.3 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-3 Ready control-plane,master 58m v1.20.4 172.20.0.4 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-worker-1 Ready 58m v1.20.4 172.20.0.5 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -``` - -Start the conversion script: - -```bash -$ talosctl -n convert-k8s -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -current self-hosted status: true -gathering control plane configuration -aggregator CA key can't be recovered from bootkube-boostrapped control plane, generating new CA -patching master node "172.20.0.2" configuration -patching master node "172.20.0.3" configuration -patching master node "172.20.0.4" configuration -waiting for static pod definitions to be generated -waiting for manifests to be generated -Talos generated control plane static pod definitions and bootstrap manifests, please verify them with commands: - talosctl -n get StaticPods.kubernetes.talos.dev - talosctl -n get Manifests.kubernetes.talos.dev - -in order to remove self-hosted control plane, pod-checkpointer component needs to be disabled -once pod-checkpointer is disabled, the cluster shouldn't be rebooted until the entire conversion process is complete -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: -``` - -Script stops at this point waiting for confirmation. -Talos still runs self-hosted control plane, and static pods were not rendered yet. - -As instructed by the script, please verify that static pod definitions are correct: - -```bash -$ talosctl -n get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 1 - phase: running -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "2" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system - spec: - containers: - - command: -... -``` - -Static pod definitions are generated from the machine configuration and should match pod template as generated by Talos on bootstrap of self-hosted control plane unless there were some manual changes applied to the daemonset specs after bootstrap. -Talos patches the machine configuration with the container image versions scraped from the daemonset definition, fetches the service account key from Kubernetes secrets. - -Aggregator CA can't be recovered from the self-hosted control plane, so new CA gets generated. -This is generally harmless and not visible from outside the cluster. -The Aggregator CA is _not_ the same CA as is used by Talos or Kubernetes standard API. -It is a special PKI used for aggregating API extension services inside your cluster. -If you have non-standard apiserver aggregations (fairly rare, and you should know if you do), then you may need to restart these services after the new CA is in place. - -Verify that bootstrap manifests are correct: - -```bash -$ talosctl -n get manifests --namespace controlplane -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -```bash -$ talosctl -n get manifests --namespace=extras -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 extras Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -``` - -Make sure that manifests and static pods are correct across all control plane nodes, as each node reconciles -control plane state on its own. -For example, CNI configuration in machine config should be in sync across all the nodes. -Talos nodes try to create any missing Kubernetes resources from the manifests, but it never -updates or deletes existing resources. - -If something looks wrong, script can be aborted and machine configuration should be updated to fix the problem. -Once configuration is updated, the script can be restarted. - -If static pod definitions and manifests look good, confirm next step to disable `pod-checkpointer`: - -```bash -$ talosctl -n convert-k8s -... -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: yes -disabling pod-checkpointer -deleting daemonset "pod-checkpointer" -checking for active pod checkpoints -2021/03/09 23:37:25 retrying error: found 3 active pod checkpoints: [pod-checkpointer-655gc-talos-default-master-3 pod-checkpointer-pw6mv-talos-default-master-1 pod-checkpointer-zdw9z-talos-default-master-2] -2021/03/09 23:42:25 retrying error: found 1 active pod checkpoints: [pod-checkpointer-pw6mv-talos-default-master-1] -confirm applying static pod definitions and manifests [yes/no]: -``` - -Self-hosted control plane runs `pod-checkpointer` to work around issues with control plane availability. -It should be disabled before conversion starts to allow self-hosted control plane to be removed. -It takes around 5 minutes for the `pod-checkpointer` to be fully disabled. -Script verifies that all checkpoints are removed before proceeding. - -This last confirmation before proceeding is at the point when there is no way to keep running self-hosted control plane: -static pods are released, bootstrap manifests are applied, self-hosted control plane is removed. - -```bash -$ talosctl -n convert-k8s -... -confirm applying static pod definitions and manifests [yes/no]: yes -removing self-hosted initialized key -waiting for static pods for "kube-apiserver" to be present in the API server state -waiting for static pods for "kube-controller-manager" to be present in the API server state -waiting for static pods for "kube-scheduler" to be present in the API server state -deleting daemonset "kube-apiserver" -waiting for static pods for "kube-apiserver" to be present in the API server state -deleting daemonset "kube-controller-manager" -waiting for static pods for "kube-controller-manager" to be present in the API server state -deleting daemonset "kube-scheduler" -waiting for static pods for "kube-scheduler" to be present in the API server state -conversion process completed successfully -``` - -As soon as the control plane static pods are rendered, the kubelet starts the control plane static pods. -It is expected that the pods for `kube-apiserver` will crash initially. -Only one `kube-apiserver` can be bound to the host `Node`'s port 6443 at a time. -Eventually, the old `kube-apiserver` will be killed, and the new one will be able to start. -This is all handled automatically. -The script will continue by removing each self-hosted daemonset and verifying that static pods are ready and healthy. - -## Manual Conversion - -Check that Talos runs self-hosted control plane: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 2 true -``` - -Talos machine configuration need to be updated to the 0.9 format; there are two new required machine configuration settings: - -* `.cluster.serviceAccount` is the service account PEM-encoded private key. -* `.cluster.aggregatorCA` is the aggregator CA for `kube-apiserver` (certficiate and private key). - -Current service account can be fetched from the Kubernetes secrets: - -```bash -$ kubectl -n kube-system get secrets kube-controller-manager -o jsonpath='{.data.service\-account\.key}' -LS0tLS1CRUdJTiBSU0EgUFJJVkFURS... -``` - -All control plane node machine configurations should be patched with the service account key: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/serviceAccount", "value": {"key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURS..."}}]' -patched mc at the node 172.20.0.2 -``` - -Aggregator CA can be generated using OpenSSL or any other certificate generation tools: RSA or ECDSA certificate with CN `front-proxy` valid for 10 years. -PEM-encoded CA certificate and key should be base64-encoded and patched into the machine config at path `/cluster/aggregatorCA`: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/aggregatorCA", "value": {"crt": "S0tLS1CRUdJTiBDRVJUSUZJQ...", "key": "LS0tLS1CRUdJTiBFQy..."}}]' -patched mc at the node 172.20.0.2 -``` - -At this point static pod definitions and bootstrap manifests should be rendered, please see "Automated Conversion" on how to verify generated objects. -Feel free to continue to refine your machine configuration until the generated static pod definitions and bootstrap manifests look good. - -If static pod definitions are not generated, check logs with `talosctl -n logs controller-runtime`. - -Disable `pod-checkpointer` with: - -```bash -$ kubectl -n kube-system delete ds pod-checkpointer -daemonset.apps "pod-checkpointer" deleted -``` - -Wait for all pod checkpoints to be removed: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -pod-checkpointer-8q2lh-talos-default-master-2 1/1 Running 0 3m34s -pod-checkpointer-nnm5w-talos-default-master-3 1/1 Running 0 3m24s -pod-checkpointer-qnmdt-talos-default-master-1 1/1 Running 0 2m21s -``` - -Pod checkpoints have annotation `checkpointer.alpha.coreos.com/checkpoint-of`. - -Once all the pod checkpoints are removed (it takes 5 minutes for the checkpoints to be removed), proceed by removing self-hosted initialized key: - -```bash -talosctl -n convert-k8s --remove-initialized-key -``` - -Talos controllers will now render static pod definitions, and the kubelet will launch any resulting static pods. - -Once static pods are visible in `kubectl get pods -n kube-system` output, proceed by removing each of the self-hosted daemonsets: - -```bash -$ kubectl -n kube-system delete daemonset kube-apiserver -daemonset.apps "kube-apiserver" deleted -``` - -Make sure static pods for `kube-apiserver` got started successfully, pods are running and ready. - -Proceed by deleting `kube-controller-manager` and `kube-scheduler` daemonsets, verifying that static pods are running between each step: - -```bash -$ kubectl -n kube-system delete daemonset kube-controller-manager -daemonset.apps "kube-controller-manager" deleted -``` - -```bash -$ kubectl -n kube-system delete daemonset kube-scheduler -daemonset.apps "kube-scheduler" deleted -``` diff --git a/website/content/v0.9/guides/customizing-the-kernel.md b/website/content/v0.9/guides/customizing-the-kernel.md deleted file mode 100644 index 74086bd8f..000000000 --- a/website/content/v0.9/guides/customizing-the-kernel.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM docker.io/andrewrynhard/installer:latest -COPY --from= /boot/vmlinuz /usr/install/vmlinuz -``` - -```bash -docker build --build-arg RM="/lib/modules" -t talos-installer . -``` - -> Note: You can use the `--squash` flag to create smaller images. - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.9/guides/customizing-the-root-filesystem.md b/website/content/v0.9/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.9/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.9/guides/disk-encryption.md b/website/content/v0.9/guides/disk-encryption.md deleted file mode 100644 index a35b228ff..000000000 --- a/website/content/v0.9/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - keySlot: 0 - - static: - passphrase: newkey - keySlot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - keySlot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.9/guides/editing-machine-configuration.md b/website/content/v0.9/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.9/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.9/guides/managing-pki.md b/website/content/v0.9/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.9/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.9/guides/resetting-a-machine.md b/website/content/v0.9/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.9/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.9/guides/storage.md b/website/content/v0.9/guides/storage.md deleted file mode 100644 index 8bea15d7d..000000000 --- a/website/content/v0.9/guides/storage.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -Talos is known to work with Rook and NFS. - -## Rook - -We recommend at least Rook v1.5. - -## NFS - -The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. -This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. diff --git a/website/content/v0.9/guides/troubleshooting-control-plane.md b/website/content/v0.9/guides/troubleshooting-control-plane.md deleted file mode 100644 index e910b57f8..000000000 --- a/website/content/v0.9/guides/troubleshooting-control-plane.md +++ /dev/null @@ -1,442 +0,0 @@ ---- -title: "Troubleshooting Control Plane" -description: "Troubleshoot control plane failures for running cluster and bootstrap process." ---- - - - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -This document mostly applies only to Talos 0.9 control plane based on static pods. -If Talos was upgraded from version 0.8, it might be still running self-hosted control plane, current status can -be checked with the command `talosctl get bootstrapstatus`: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 1 false -``` - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests --namespace=controlplane -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -```bash -$ talosctl -n get manifests --namespace=extras -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 extras Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.9/guides/upgrading-kubernetes.md b/website/content/v0.9/guides/upgrading-kubernetes.md deleted file mode 100644 index ee4a20d26..000000000 --- a/website/content/v0.9/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To upgrade from Kubernetes v1.20.1 to v1.20.4 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.20.1 --to 1.20.4 -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -updating "kube-apiserver" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:01 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:05 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:55:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-controller-manager" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:56:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-scheduler" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:56:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:56:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:57:08 retrying error: config version mismatch: got "2", expected "3" -updating daemonset "kube-proxy" to version "1.20.4" -``` - -Script runs in two phases: - -1. In the first phase every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. - Messages `config version mismatch` indicate that script is waiting for the updated container to be registered in the API server. -2. In the second phase script updates `kube-proxy` daemonset with the new image version. - -If script fails for any reason, it can be safely restarted to continue upgrade process. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -## Kubelet - -Upgrading Kubelet version requires Talos node reboot after machine configuration change. - -For every node, patch machine configuration with new kubelet version, wait for the node to reboot: - -```bash -$ talosctl -n patch mc -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -Once node boots with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.20.4 -``` diff --git a/website/content/v0.9/guides/upgrading-talos.md b/website/content/v0.9/guides/upgrading-talos.md deleted file mode 100644 index 56116a0ba..000000000 --- a/website/content/v0.9/guides/upgrading-talos.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Upgrading from Talos 0.8 - -Talos 0.9 drops support for `bootkube` and self-hosted control plane. - -Please make sure Talos is upgraded to the latest minor release of 0.8 first (0.8.4 at the moment -of this writing), then proceed with upgrading to the latest minor release of 0.9. - -### Before Upgrade to 0.9 - -If cluster was bootstrapped on Talos version < 0.8.3, add checkpointer annotations to -the `kube-scheduler` and `kube-controller-manager` daemonsets to improve resiliency of -self-hosted control plane to reboots (this is critical for single control-plane node clusters): - -```bash -$ kubectl -n kube-system patch daemonset kube-controller-manager --type json -p '[{"op": "add", "path":"/spec/template/metadata/annotations", "value": {"checkpointer.alpha.coreos.com/checkpoint": "true"}}]' -daemonset.apps/kube-controller-manager patched -$ kubectl -n kube-system patch daemonset kube-scheduler --type json -p '[{"op": "add", "path":"/spec/template/metadata/annotations", "value": {"checkpointer.alpha.coreos.com/checkpoint": "true"}}]' -daemonset.apps/kube-scheduler patched -``` - -Talos 0.9 only supports Kubernetes versions 1.19.x and 1.20.x. -If running 1.18.x, please upgrade Kubernetes before upgrading Talos. - -Make sure cluster is running latest minor release of Talos 0.8. - -Prepare by downloading `talosctl` binary for Talos release 0.9.x. - -### After Upgrade to 0.9 - -After the upgrade to 0.9, Talos will still be running self-hosted control plane until the [conversion process](../converting-control-plane/) is run. - -> Note: Talos 0.9 doesn't include bootkube recovery option (`talosctl recover`), so -> it's not possible to recover self-hosted control plane after upgrading to 0.9. - -As soon as all the nodes get upgraded to 0.9, run `talosctl convert-k8s` to convert the control plane -to the new static pod format for 0.9. - -Once the conversion process is complete, Kubernetes can be upgraded. - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.9.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.9.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -Talos 0.9 introduces new required parameters in machine configuration: - -* `.cluster.aggregatorCA` -* `.cluster.serviceAccount` - -Talos supports both ECDSA and RSA certificates and keys for Kubernetes and etcd, with ECDSA being default. -Talos <= 0.8 supports only RSA keys and certificates. - -Utility `talosctl gen config` generates by default config in 0.9 format which is not compatible with -Talos 0.8, but old format can be generated with `talosctl gen config --talos-version=v0.8`. diff --git a/website/content/v0.9/guides/vip.md b/website/content/v0.9/guides/vip.md deleted file mode 100644 index 12205537d..000000000 --- a/website/content/v0.9/guides/vip.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.9/introduction/_index.md b/website/content/v0.9/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.9/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.9/introduction/getting-started.md b/website/content/v0.9/introduction/getting-started.md deleted file mode 100644 index 864a5e2ce..000000000 --- a/website/content/v0.9/introduction/getting-started.md +++ /dev/null @@ -1,461 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../../introduction/quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/boot-amd64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/boot-amd64.tar.gz) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/boot-ard64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.9.0-beta.0/boot-ard64.tar.gz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](../../reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `init.yaml` -- `join.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml` and `init.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Join - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Join. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Join Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Join Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `join.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp join.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. -The author of this document does not set a default node. - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.9/introduction/quickstart.md b/website/content/v0.9/introduction/quickstart.md deleted file mode 100644 index 78a802294..000000000 --- a/website/content/v0.9/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.9.0) containerd://1.4.3 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.9.0) containerd://1.4.3 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.9/introduction/system-requirements.md b/website/content/v0.9/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.9/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.9/introduction/what-is-new.md b/website/content/v0.9/introduction/what-is-new.md deleted file mode 100644 index efd1946aa..000000000 --- a/website/content/v0.9/introduction/what-is-new.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: What's New in Talos 0.9 -weight: 5 ---- - -## Control Plane as Static Pods - -Talos now runs the Kubernetes control plane as static pods managed via machine configuration. -This change makes the bootstrap process much more stable and resilient to failures. -For single control plane node clusters it eliminates bugs with the control plane being unavailable after a reboot. -As the control plane configuration is managed via the Talos API, even if the control plane configuration was wrong and -the API server is not available, the change can be rolled back using `talosctl` to bring the control plane back up. -When upgrading from Talos 0.8, control plane can be [converted](../../guides/converting-control-plane/) to run as static pods. - -## ECDSA Certificates and Keys for Kubernetes - -Talos now generates uses ECDSA keys for Kubernetes and etcd PKI. -ECDSA keys are much smaller than RSA keys and all PKI operations are much faster (for example, generating a certificate from the CA) which -leads to much faster bootstrap and boot times. - -## Immediate Machine Configuration Updates - -Changes to the `.cluster` part of Talos machine configuration can now be [applied immediately](../../guides/editing-machine-configuration) (without a reboot). -This allows, for example, updating versions of control plane components, adding additional arguments or modifying bootstrap manifests. -Future versions of Talos will expand on this to allow most of the machine configuration to be applied without a reboot. - -## Disk Encryption - -Talos now supports encryption for `STATE` and `EPHEMERAL` partitions of the system disk. -The `STATE` partition holds machine configuration and the `EPHEMERAL` partition is mounted as `/var` which stores container runtime -state, and configuration files laid on top of Talos read-only immutable root filesystem. -The encryption key in Talos 0.9 is derived from the Node UUID which is a unique machine identifier provided by the manufacturer. -Disk encryption is not enabled by default: it needs to be [enabled](../../guides/disk-encryption/) via machine configuration. - -## Virtual IP for the Control Plane Endpoint - -Talos adds support for Virtual L2 [shared IP](../../guides/vip/) for the control plane: control plane nodes ensure only one of the nodes -advertise the shared IP via ARP. -If one of the control plane nodes goes down, another node takes over the shared IP. - -## Updated Components - -Linux: 5.10.1 -> 5.10.19 - -Kubernetes: 1.20.1 -> 1.20.5 - -CoreDNS: 1.7.0 -> 1.8.0 - -etcd: 3.4.14 -> 3.4.15 - -containerd: 1.4.3 -> 1.4.4 diff --git a/website/content/v0.9/introduction/what-is-talos.md b/website/content/v0.9/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.9/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.9/learn-more/_index.md b/website/content/v0.9/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.9/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.9/learn-more/architecture.md b/website/content/v0.9/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.9/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.9/learn-more/components.md b/website/content/v0.9/learn-more/components.md deleted file mode 100644 index a67a8d637..000000000 --- a/website/content/v0.9/learn-more/components.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `routerd`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| timed | Handles the host time synchronization by acting as a NTP-client. | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| routerd | Responsible for routing an incoming API request from `apid` to the appropriate backend (e.g. `networkd`, `machined` and `timed`). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- kubeadm -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- timed -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### timed - -Timed handles the host time synchronization. - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.9/learn-more/concepts.md b/website/content/v0.9/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.9/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.9/learn-more/control-plane.md b/website/content/v0.9/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.9/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.9/learn-more/controllers-resources.md b/website/content/v0.9/learn-more/controllers-resources.md deleted file mode 100644 index 68605b677..000000000 --- a/website/content/v0.9/learn-more/controllers-resources.md +++ /dev/null @@ -1,230 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace extras 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information -for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources.png) diff --git a/website/content/v0.9/learn-more/faqs.md b/website/content/v0.9/learn-more/faqs.md deleted file mode 100644 index 3889509d7..000000000 --- a/website/content/v0.9/learn-more/faqs.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. - -## Why does Talos query `pool.ntp.org` on boot even if configured to use a different time server? - -When Talos boots, before the config is loaded, Talos performs a non-blocking attempt to sync the time with the default nameserver (`pool.ntp.org`). -This initial time sync is required if the node doesn't have an RTC or the RTC is out of sync because TLS (e.g. HTTPS) requires time to be in sync for certificate validation. -As soon as the config is available, Talos starts syncing the time with the configured time server. -Time sync errors on initial boot can be safely ignored. diff --git a/website/content/v0.9/learn-more/philosophy.md b/website/content/v0.9/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.9/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.9/learn-more/talosctl.md b/website/content/v0.9/learn-more/talosctl.md deleted file mode 100644 index 7c465be57..000000000 --- a/website/content/v0.9/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](../../reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.9/learn-more/upgrades.md b/website/content/v0.9/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.9/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.9/local-platforms/_index.md b/website/content/v0.9/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.9/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.9/local-platforms/docker.md b/website/content/v0.9/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.9/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.9/local-platforms/firecracker.md b/website/content/v0.9/local-platforms/firecracker.md deleted file mode 100644 index 8a86e993b..000000000 --- a/website/content/v0.9/local-platforms/firecracker.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Firecracker -description: "Creating Talos Kubernetes cluster using Firecracker VMs." ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.9.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.9.5/cni-plugins-linux-amd64-v0.9.5.tgz -L -o cni-plugins-linux-amd64-v0.9.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.9.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.9.0`: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/vmlinuz -L -o _out/vmlinuz -curl https://github.com/talos-systems/talos/releases/latest/download/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.9/local-platforms/qemu.md b/website/content/v0.9/local-platforms/qemu.md deleted file mode 100644 index b8139abee..000000000 --- a/website/content/v0.9/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.9.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.9.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.9.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.9/local-platforms/virtualbox.md b/website/content/v0.9/local-platforms/virtualbox.md deleted file mode 100644 index 864cedd61..000000000 --- a/website/content/v0.9/local-platforms/virtualbox.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the \_out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.9/reference/_index.md b/website/content/v0.9/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.9/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.9/reference/api.md b/website/content/v0.9/reference/api.md deleted file mode 100644 index d9cd1d6f0..000000000 --- a/website/content/v0.9/reference/api.md +++ /dev/null @@ -1,3572 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [health/health.proto](#health/health.proto) - - [HealthCheck](#health.HealthCheck) - - [HealthCheckResponse](#health.HealthCheckResponse) - - [HealthWatchRequest](#health.HealthWatchRequest) - - [ReadyCheck](#health.ReadyCheck) - - [ReadyCheckResponse](#health.ReadyCheckResponse) - - - [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) - - [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) - - - [Health](#health.Health) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMemberList](#machine.EtcdMemberList) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FileInfo](#machine.FileInfo) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesRequest](#machine.ProcessesRequest) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Recover](#machine.Recover) - - [RecoverRequest](#machine.RecoverRequest) - - [RecoverResponse](#machine.RecoverResponse) - - [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) - - [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RecoverRequest.Source](#machine.RecoverRequest.Source) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - [ReadFileRequest](#securityapi.ReadFileRequest) - - [ReadFileResponse](#securityapi.ReadFileResponse) - - [WriteFileRequest](#securityapi.WriteFileRequest) - - [WriteFileResponse](#securityapi.WriteFileResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - - - - - -

Top

- -## health/health.proto - - - - - -### HealthCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) | | | - - - - - - - - -### HealthCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [HealthCheck](#health.HealthCheck) | repeated | | - - - - - - - - -### HealthWatchRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interval_seconds | [int64](#int64) | | | - - - - - - - - -### ReadyCheck - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| status | [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) | | | - - - - - - - - -### ReadyCheckResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ReadyCheck](#health.ReadyCheck) | repeated | | - - - - - - - - - - -### HealthCheck.ServingStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SERVING | 1 | | -| NOT_SERVING | 2 | | - - - - - -### ReadyCheck.ReadyStatus - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| READY | 1 | | -| NOT_READY | 2 | | - - - - - - - - - -### Health - - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Check | [.google.protobuf.Empty](#google.protobuf.Empty) | [HealthCheckResponse](#health.HealthCheckResponse) | | -| Watch | [HealthWatchRequest](#health.HealthWatchRequest) | [HealthCheckResponse](#health.HealthCheckResponse) stream | | -| Ready | [.google.protobuf.Empty](#google.protobuf.Empty) | [ReadyCheckResponse](#health.ReadyCheckResponse) | | - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| MANAGES | 0 | | -| STRONG | 1 | | -| WEAK | 2 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxilary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | | -| immediate | [bool](#bool) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc bootstrap - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMemberList - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| members | [string](#string) | repeated | | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMemberList](#machine.EtcdMemberList) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified - -TODO: unix timestamp or include proto's Date type | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesRequest -rpc processes - - - - - - - - -### ProcessesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -rpc reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Recover -The recover message containing the recover status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RecoverRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| source | [RecoverRequest.Source](#machine.RecoverRequest.Source) | | | - - - - - - - - -### RecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Recover](#machine.Recover) | repeated | | - - - - - - - - -### RemoveBootkubeInitializedKey -RemoveBootkubeInitializedKeyResponse describes the response to a RemoveBootkubeInitializedKey request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RemoveBootkubeInitializedKeyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### StartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### StopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### StopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| resp | [string](#string) | | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_JOIN | 3 | | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RecoverRequest.Source - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| ETCD | 0 | | -| APISERVER | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [.google.protobuf.Empty](#google.protobuf.Empty) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| Recover | [RecoverRequest](#machine.RecoverRequest) | [RecoverResponse](#machine.RecoverResponse) | | -| RemoveBootkubeInitializedKey | [.google.protobuf.Empty](#google.protobuf.Empty) | [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [.google.protobuf.Empty](#google.protobuf.Empty) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | - - - - - - -

Top

- -## network/network.proto - - - - - -### Interface -Interface represents a net.Interface - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| index | [uint32](#uint32) | | | -| mtu | [uint32](#uint32) | | | -| name | [string](#string) | | | -| hardwareaddr | [string](#string) | | | -| flags | [InterfaceFlags](#network.InterfaceFlags) | | | -| ipaddress | [string](#string) | repeated | | - - - - - - - - -### Interfaces - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| interfaces | [Interface](#network.Interface) | repeated | | - - - - - - - - -### InterfacesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Interfaces](#network.Interfaces) | repeated | | - - - - - - - - -### Route -The messages message containing a route. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | Interface is the interface over which traffic to this destination should be sent | -| destination | [string](#string) | | Destination is the network prefix CIDR which this route provides | -| gateway | [string](#string) | | Gateway is the gateway address to which traffic to this destination should be sent | -| metric | [uint32](#uint32) | | Metric is the priority of the route, where lower metrics have higher priorities | -| scope | [uint32](#uint32) | | Scope desribes the scope of this route | -| source | [string](#string) | | Source is the source prefix CIDR for the route, if one is defined | -| family | [AddressFamily](#network.AddressFamily) | | Family is the address family of the route. Currently, the only options are AF_INET (IPV4) and AF_INET6 (IPV6). | -| protocol | [RouteProtocol](#network.RouteProtocol) | | Protocol is the protocol by which this route came to be in place | -| flags | [uint32](#uint32) | | Flags indicate any special flags on the route | - - - - - - - - -### Routes - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| routes | [Route](#network.Route) | repeated | | - - - - - - - - -### RoutesResponse -The messages message containing the routes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Routes](#network.Routes) | repeated | | - - - - - - - - - - -### AddressFamily - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| AF_UNSPEC | 0 | | -| AF_INET | 2 | | -| IPV4 | 2 | | -| AF_INET6 | 10 | | -| IPV6 | 10 | | - - - - - -### InterfaceFlags - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FLAG_UNKNOWN | 0 | | -| FLAG_UP | 1 | | -| FLAG_BROADCAST | 2 | | -| FLAG_LOOPBACK | 3 | | -| FLAG_POINT_TO_POINT | 4 | | -| FLAG_MULTICAST | 5 | | - - - - - -### RouteProtocol - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| RTPROT_UNSPEC | 0 | | -| RTPROT_REDIRECT | 1 | Route installed by ICMP redirects | -| RTPROT_KERNEL | 2 | Route installed by kernel | -| RTPROT_BOOT | 3 | Route installed during boot | -| RTPROT_STATIC | 4 | Route installed by administrator | -| RTPROT_GATED | 8 | Route installed by gated | -| RTPROT_RA | 9 | Route installed by router advertisement | -| RTPROT_MRT | 10 | Route installed by Merit MRT | -| RTPROT_ZEBRA | 11 | Route installed by Zebra/Quagga | -| RTPROT_BIRD | 12 | Route installed by Bird | -| RTPROT_DNROUTED | 13 | Route installed by DECnet routing daemon | -| RTPROT_XORP | 14 | Route installed by XORP | -| RTPROT_NTK | 15 | Route installed by Netsukuku | -| RTPROT_DHCP | 16 | Route installed by DHCP | -| RTPROT_MROUTED | 17 | Route installed by Multicast daemon | -| RTPROT_BABEL | 42 | Route installed by Babel daemon | - - - - - - - - - -### NetworkService -The network service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Routes | [.google.protobuf.Empty](#google.protobuf.Empty) | [RoutesResponse](#network.RoutesResponse) | | -| Interfaces | [.google.protobuf.Empty](#google.protobuf.Empty) | [InterfacesResponse](#network.InterfacesResponse) | | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| phase | [string](#string) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | | - - - - - - - - -### CertificateResponse -The response message containing the requested logs. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | | -| crt | [bytes](#bytes) | | | - - - - - - - - -### ReadFileRequest -The request message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### ReadFileResponse -The response message for reading a file on disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | - - - - - - - - -### WriteFileRequest -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | -| data | [bytes](#bytes) | | | -| perm | [int32](#int32) | | | - - - - - - - - -### WriteFileResponse -The response message containing the requested logs. - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | -| ReadFile | [ReadFileRequest](#securityapi.ReadFileRequest) | [ReadFileResponse](#securityapi.ReadFileResponse) | | -| WriteFile | [WriteFileRequest](#securityapi.WriteFileRequest) | [WriteFileResponse](#securityapi.WriteFileResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v0.9/reference/cli.md b/website/content/v0.9/reference/cli.md deleted file mode 100644 index 9f7f9b0ce..000000000 --- a/website/content/v0.9/reference/cli.md +++ /dev/null @@ -1,2054 +0,0 @@ ---- -title: CLI -desription: Talosctl CLI tool reference. ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - --immediate apply the config immediately (without a reboot) - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - --interactive apply the config using text based interactive mode - --on-reboot apply the config on reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the cluster - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.10.0-alpha.0/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch string patch generated machineconfigs - --cpus string the share of CPUs as fraction (each container/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - -h, --help help for create - --image string the image to use (default "ghcr.io/talos-systems/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string the uncompressed kernel image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/talos-systems/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.20.5") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each container/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-uefi enable UEFI on x86_64 architecture (always enabled for arm64) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or firecracker-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup -talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config contexts - -List contexts defined in Talos config - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config merge - -Merge additional contexts from another Talos config into the default config - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration - -## talosctl config - -Manage the client configuration - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List contexts defined in Talos config -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another Talos config into the default config -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl convert-k8s - -Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). - -### Synopsis - -Command converts control plane bootstrapped on Talos <= 0.8 to Talos-managed control plane (Talos >= 0.9). -As part of the conversion process tool reads existing configuration of the control plane, updates -Talos node configuration to reflect changes made since the boostrap time. Once config is updated, -tool releases static pods and deletes self-hosted DaemonSets. - -``` -talosctl convert-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --force skip prompts, assume yes - -h, --help help for convert-k8s -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl crashdump - -Dump debug information about the cluster - -``` -talosctl crashdump [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for crashdump - --init-node string specify IPs of init node - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use - a control plane node, common in a single node control plane setup, use port 6443 as - this is the port that the API server binds to on every control plane node. For an HA - setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/talos-systems/installer:latest") - --kubernetes-version string desired kubernetes version to run - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl interfaces - -List network interfaces - -``` -talosctl interfaces [flags] -``` - -### Options - -``` - -h, --help help for interfaces -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - --immediate apply the change immediately (without a reboot) - --namespace string resource namespace (default is to use default namespace per resource) - --on-reboot apply the change on next reboot - -p, --patch string the patch to be applied to the resource file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl recover - -Recover a control plane - -``` -talosctl recover [flags] -``` - -### Options - -``` - -h, --help help for recover - -s, --source string The data source for restoring the control plane manifests from (valid options are "apiserver" and "etcd") (default "apiserver") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl routes - -List network routes - -``` -talosctl routes [flags] -``` - -### Options - -``` - -h, --help help for routes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. Pod-checkpointer is handled in a special way to speed up kube-apisever upgrades. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.20.5") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the cluster -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or firecracker-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl convert-k8s](#talosctl-convert-k8s) - Convert Kubernetes control plane from self-hosted (bootkube) to Talos-managed (static pods). -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl crashdump](#talosctl-crashdump) - Dump debug information about the cluster -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl interfaces](#talosctl-interfaces) - List network interfaces -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl recover](#talosctl-recover) - Recover a control plane -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl routes](#talosctl-routes) - List network routes -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v0.9/reference/configuration.md b/website/content/v0.9/reference/configuration.md deleted file mode 100644 index 9832f3230..000000000 --- a/website/content/v0.9/reference/configuration.md +++ /dev/null @@ -1,4671 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: -```bash -talosctl gen config --version v1alpha1 -```` - -This will generate a machine config for each node type, and a talosconfig for the CLI. - -## Config -Config defines the v1alpha1 configuration file. - - - -``` yaml -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -``` - -
- -
- -version string - -
-
- -Indicates the schema used to decode the contents. - - -Valid values: - - - - v1alpha1 -
- -
- -
- -debug bool - -
-
- -Enable verbose logging to the console. -All system containers logs will flow into serial console. - -> Note: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -persist bool - -
-
- -Indicates whether to pull the machine config upon every boot. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -machine MachineConfig - -
-
- -Provides machine specific configuration options. - -
- -
- -
- -cluster ClusterConfig - -
-
- -Provides cluster specific configuration options. - -
- -
- - - - - -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - - -- Config.machine - - -``` yaml -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -type string - -
-
- -Defines the role of the machine within the cluster. - -#### Init - -Init node type designates the first control plane node to come up. -You can think of it like a bootstrap node. -This node will perform the initial steps to bootstrap the cluster -- generation of TLS assets, starting of the control plane, etc. - -#### Control Plane - -Control Plane node type designates the node as a control plane member. -This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler. - -#### Worker - -Worker node type designates the node as a worker node. -This means it will be an available compute node for scheduling workloads. - - -Valid values: - - - - init - - - controlplane - - - join -
- -
- -
- -token string - -
-
- -The `token` is used by a machine to join the PKI of the cluster. -Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity. - - -> Warning: It is important to ensure that this token is correct since a machine's certificate has a short TTL by default. - - - -Examples: - - -``` yaml -token: 328hom.uqjzh6jnn2eie9oi -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the machine's certificate. -By default, all non-loopback interface IPs are automatically added to the certificate's SANs. - - - -Examples: - - -``` yaml -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -``` - - -
- -
- -
- -kubelet KubeletConfig - -
-
- -Used to provide additional options to the kubelet. - - - -Examples: - - -``` yaml -kubelet: - image: ghcr.io/talos-systems/kubelet:v1.20.5 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - rshared - # - rw -``` - - -
- -
- -
- -network NetworkConfig - -
-
- -Provides machine specific network configuration options. - - - -Examples: - - -``` yaml -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld -``` - - -
- -
- -
- -disks []MachineDisk - -
-
- -Used to partition, format and mount additional disks. -Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`. -Note that the partitioning and formating is done only once, if and only if no existing partitions are found. -If `size:` is omitted, the partition is sized to occupy the full disk. - - -> Note: `size` is in units of bytes. - - - -Examples: - - -``` yaml -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - - -
- -
- -
- -install InstallConfig - -
-
- -Used to provide instructions for installations. - - - -Examples: - - -``` yaml -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - - -
- -
- -
- -files []MachineFile - -
-
- -Allows the addition of user specified files. -The value of `op` can be `create`, `overwrite`, or `append`. -In the case of `create`, `path` must not exist. -In the case of `overwrite`, and `append`, `path` must be a valid file. -If an `op` value of `append` is used, the existing file will be appended. -Note that the file contents are not required to be base64 encoded. - - -> Note: The specified `path` is relative to `/var`. - - - -Examples: - - -``` yaml -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - - -
- -
- -
- -env Env - -
-
- -The `env` field allows for the addition of environment variables. -All environment variables are set on PID 1 in addition to every service. - - -Valid values: - - - - `GRPC_GO_LOG_VERBOSITY_LEVEL` - - - `GRPC_GO_LOG_SEVERITY_LEVEL` - - - `http_proxy` - - - `https_proxy` - - - `no_proxy` - - -Examples: - - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -``` - -``` yaml -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -``` - -``` yaml -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -``` - - -
- -
- -
- -time TimeConfig - -
-
- -Used to configure the machine's time settings. - - - -Examples: - - -``` yaml -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com -``` - - -
- -
- -
- -sysctls map[string]string - -
-
- -Used to configure the machine's sysctls. - - - -Examples: - - -``` yaml -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -``` - - -
- -
- -
- -registries RegistriesConfig - -
-
- -Used to configure the machine's container image registry mirrors. - -Automatically generates matching CRI configuration for registry mirrors. - -The `mirrors` section allows to redirect requests for images to non-default registry, -which might be local registry or caching mirror. - -The `config` section provides a way to authenticate to the registry with TLS client -identity, provide registry CA, or authentication information. -Authentication information has same meaning with the corresponding field in `.docker/config.json`. - -See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md). - - - -Examples: - - -``` yaml -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- -
- -systemDiskEncryption SystemDiskEncryptionConfig - -
-
- -Machine system disk encryption configuration. -Defines each system partition encryption parameters. - - - -Examples: - - -``` yaml -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - - -
- -
- - - - - -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - - -- Config.cluster - - -``` yaml -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -controlPlane ControlPlaneConfig - -
-
- -Provides control plane specific configuration options. - - - -Examples: - - -``` yaml -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -``` - - -
- -
- -
- -clusterName string - -
-
- -Configures the cluster's name. - -
- -
- -
- -network ClusterNetworkConfig - -
-
- -Provides cluster specific network configuration options. - - - -Examples: - - -``` yaml -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- -
- -token string - -
-
- -The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster. - - - -Examples: - - -``` yaml -token: wlzjyw.bei2zfylhs2by0wd -``` - - -
- -
- -
- -aescbcEncryptionSecret string - -
-
- -The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/). - - - -Examples: - - -``` yaml -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The base64 encoded root certificate authority used by Kubernetes. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -aggregatorCA PEMEncodedCertificateAndKey - -
-
- -The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation. - -This CA can be self-signed. - - - -Examples: - - -``` yaml -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -serviceAccount PEMEncodedKey - -
-
- -The base64 encoded private key for service account token generation. - - - -Examples: - - -``` yaml -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -apiServer APIServerConfig - -
-
- -API server specific configuration options. - - - -Examples: - - -``` yaml -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.20.5 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - - -
- -
- -
- -controllerManager ControllerManagerConfig - -
-
- -Controller manager server specific configuration options. - - - -Examples: - - -``` yaml -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.20.5 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -``` - - -
- -
- -
- -proxy ProxyConfig - -
-
- -Kube-proxy server-specific configuration options - - - -Examples: - - -``` yaml -proxy: - image: k8s.gcr.io/kube-proxy:v1.20.5 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -``` - - -
- -
- -
- -scheduler SchedulerConfig - -
-
- -Scheduler server specific configuration options. - - - -Examples: - - -``` yaml -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.20.5 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -``` - - -
- -
- -
- -etcd EtcdConfig - -
-
- -Etcd specific configuration options. - - - -Examples: - - -``` yaml -etcd: - image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" -``` - - -
- -
- -
- -podCheckpointer PodCheckpointer - -
-
- -Pod Checkpointer specific configuration options. - - - -Examples: - - -``` yaml -podCheckpointer: - image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - - -
- -
- -
- -coreDNS CoreDNS - -
-
- -Core DNS specific configuration options. - - - -Examples: - - -``` yaml -coreDNS: - image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image. -``` - - -
- -
- -
- -extraManifests []string - -
-
- -A list of urls that point to additional manifests. -These will get automatically deployed as part of the bootstrap. - - - -Examples: - - -``` yaml -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -``` - - -
- -
- -
- -extraManifestHeaders map[string]string - -
-
- -A map of key value pairs that will be added while fetching the ExtraManifests. - - - -Examples: - - -``` yaml -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -``` - - -
- -
- -
- -adminKubeconfig AdminKubeconfigConfig - -
-
- -Settings for admin kubeconfig generation. -Certificate lifetime can be configured. - - - -Examples: - - -``` yaml -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - - -
- -
- -
- -allowSchedulingOnMasters bool - -
-
- -Allows running workload on master nodes. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - - -- MachineConfig.kubelet - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.20.5 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - rshared -# - rw -``` - -
- -
- -image string - -
-
- -The `image` field is an optional reference to an alternative kubelet image. - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/kubelet:v1.20.5 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -The `extraArgs` field is used to provide additional flags to the kubelet. - - - -Examples: - - -``` yaml -extraArgs: - key: value -``` - - -
- -
- -
- -extraMounts []Mount - -
-
- -The `extraMounts` field is used to add additional mounts to the kubelet container. - - - -Examples: - - -``` yaml -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - rshared - - rw -``` - - -
- -
- -
- -registerWithFQDN bool - -
-
- -The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration. -This is required in clouds like AWS. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - - -- MachineConfig.network - - -``` yaml -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld -``` - -
- -
- -hostname string - -
-
- -Used to statically set the hostname for the machine. - -
- -
- -
- -interfaces []Device - -
-
- -`interfaces` is used to define the network interface configuration. -By default all network interfaces will attempt a DHCP discovery. -This can be further tuned through this configuration parameter. - - - -Examples: - - -``` yaml -interfaces: - - interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- -
- -nameservers []string - -
-
- -Used to statically set the nameservers for the machine. -Defaults to `1.1.1.1` and `8.8.8.8` - - - -Examples: - - -``` yaml -nameservers: - - 8.8.8.8 - - 1.1.1.1 -``` - - -
- -
- -
- -extraHostEntries []ExtraHost - -
-
- -Allows for extra entries to be added to the `/etc/hosts` file - - - -Examples: - - -``` yaml -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - - -
- -
- - - - - -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - - -- MachineConfig.install - - -``` yaml -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/talos-systems/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. -``` - -
- -
- -disk string - -
-
- -The disk used for installations. - - - -Examples: - - -``` yaml -disk: /dev/sda -``` - -``` yaml -disk: /dev/nvme0 -``` - - -
- -
- -
- -extraKernelArgs []string - -
-
- -Allows for supplying extra kernel args via the bootloader. - - - -Examples: - - -``` yaml -extraKernelArgs: - - talos.platform=metal - - reboot=k -``` - - -
- -
- -
- -image string - -
-
- -Allows for supplying the image used to perform the installation. -Image reference for each Talos release can be found on -[GitHub releases page](https://github.com/talos-systems/talos/releases). - - - -Examples: - - -``` yaml -image: ghcr.io/talos-systems/installer:latest -``` - - -
- -
- -
- -bootloader bool - -
-
- -Indicates if a bootloader should be installed. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- -
- -wipe bool - -
-
- -Indicates if the installation disk should be wiped at installation time. -Defaults to `true`. - - -Valid values: - - - - true - - - yes - - - false - - - no -
- -
- - - - - -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - - -- MachineConfig.time - - -``` yaml -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -``` - -
- -
- -disabled bool - -
-
- -Indicates if the time service is disabled for the machine. -Defaults to `false`. - -
- -
- -
- -servers []string - -
-
- -Specifies time (NTP) servers to use for setting the system time. -Defaults to `pool.ntp.org` - - -> This parameter only supports a single time server. - -
- -
- - - - - -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - - -- MachineConfig.registries - - -``` yaml -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - -
- -
- -mirrors map[string]RegistryMirrorConfig - -
-
- -Specifies mirror configuration for each registry. -This setting allows to use local pull-through caching registires, -air-gapped installations, etc. - -Registry name is the first segment of image identifier, with 'docker.io' -being default one. -To catch any registry names not specified explicitly, use '*'. - - - -Examples: - - -``` yaml -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - - -
- -
- -
- -config map[string]RegistryConfig - -
-
- -Specifies TLS & auth configuration for HTTPS image registries. -Mutual TLS can be enabled with 'clientIdentity' option. - -TLS configuration can be skipped if registry has trusted -server certificate. - - - -Examples: - - -``` yaml -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - -Appears in: - - -- ClusterConfig.podCheckpointer - - -``` yaml -image: '...' # The `image` field is an override to the default pod-checkpointer image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default pod-checkpointer image. - -
- -
- - - - - -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - - -- ClusterConfig.coreDNS - - -``` yaml -image: docker.io/coredns/coredns:1.8.0 # The `image` field is an override to the default coredns image. -``` - -
- -
- -image string - -
-
- -The `image` field is an override to the default coredns image. - -
- -
- - - - - -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - - -- ControlPlaneConfig.endpoint - - -``` yaml -https://1.2.3.4:6443 -``` -``` yaml -https://cluster1.internal:6443 -``` - - - -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - - -- ClusterConfig.controlPlane - - -``` yaml -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -``` - -
- -
- -endpoint Endpoint - -
-
- -Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -It is single-valued, and may optionally include a port number. - - - -Examples: - - -``` yaml -endpoint: https://1.2.3.4:6443 -``` - -``` yaml -endpoint: https://cluster1.internal:6443 -``` - - -
- -
- -
- -localAPIServerPort int - -
-
- -The port that the API server listens on internally. -This may be different than the port portion listed in the endpoint field above. -The default is `6443`. - -
- -
- - - - - -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - - -- ClusterConfig.apiServer - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.20.5 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 -``` - -
- -
- -image string - -
-
- -The container image used in the API server manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-apiserver:v1.20.5 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the API server. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the API server static pod. - -
- -
- -
- -certSANs []string - -
-
- -Extra certificate subject alternative names for the API server's certificate. - -
- -
- - - - - -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - - -- ClusterConfig.controllerManager - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.20.5 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -``` - -
- -
- -image string - -
-
- -The container image used in the controller manager manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-controller-manager:v1.20.5 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the controller manager. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the controller manager static pod. - -
- -
- - - - - -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - - -- ClusterConfig.proxy - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.20.5 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -``` - -
- -
- -disabled bool - -
-
- -Disable kube-proxy deployment on cluster bootstrap. - - - -Examples: - - -``` yaml -disabled: false -``` - - -
- -
- -
- -image string - -
-
- -The container image used in the kube-proxy manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-proxy:v1.20.5 -``` - - -
- -
- -
- -mode string - -
-
- -proxy mode of kube-proxy. -The default is 'iptables'. - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to kube-proxy. - -
- -
- - - - - -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - - -- ClusterConfig.scheduler - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.20.5 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -``` - -
- -
- -image string - -
-
- -The container image used in the scheduler manifest. - - - -Examples: - - -``` yaml -image: k8s.gcr.io/kube-scheduler:v1.20.5 -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to the scheduler. - -
- -
- -
- -extraVolumes []VolumeMountConfig - -
-
- -Extra volumes to mount to the scheduler static pod. - -
- -
- - - - - -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - - -- ClusterConfig.etcd - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.15 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" -``` - -
- -
- -image string - -
-
- -The container image used to create the etcd service. - - - -Examples: - - -``` yaml -image: gcr.io/etcd-development/etcd:v3.4.15 -``` - - -
- -
- -
- -ca PEMEncodedCertificateAndKey - -
-
- -The `ca` is the root certificate authority of the PKI. -It is composed of a base64 encoded `crt` and `key`. - - - -Examples: - - -``` yaml -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -extraArgs map[string]string - -
-
- -Extra arguments to supply to etcd. -Note that the following args are not allowed: - -- `name` -- `data-dir` -- `initial-cluster-state` -- `listen-peer-urls` -- `listen-client-urls` -- `cert-file` -- `key-file` -- `trusted-ca-file` -- `peer-client-cert-auth` -- `peer-cert-file` -- `peer-trusted-ca-file` -- `peer-key-file` - -
- -
- - - - - -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - - -- ClusterConfig.network - - -``` yaml -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -``` - -
- -
- -cni CNIConfig - -
-
- -The CNI used. -Composed of "name" and "url". -The "name" key only supports options of "flannel" or "custom". -URLs is only used if name is equal to "custom". -URLs should point to the set of YAML files to be deployed. -An empty struct or any other name will default to Flannel CNI. - - - -Examples: - - -``` yaml -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - - -
- -
- -
- -dnsDomain string - -
-
- -The domain used by Kubernetes DNS. -The default is `cluster.local` - - - -Examples: - - -``` yaml -dnsDomain: cluser.local -``` - - -
- -
- -
- -podSubnets []string - -
-
- -The pod subnet CIDR. - - - -Examples: - - -``` yaml -podSubnets: - - 10.244.0.0/16 -``` - - -
- -
- -
- -serviceSubnets []string - -
-
- -The service subnet CIDR. - - - -Examples: - - -``` yaml -serviceSubnets: - - 10.96.0.0/12 -``` - - -
- -
- - - - - -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - - -- ClusterNetworkConfig.cni - - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml -``` - -
- -
- -name string - -
-
- -Name of CNI to use. - -
- -
- -
- -urls []string - -
-
- -URLs containing manifests to apply for the CNI. - -
- -
- - - - - -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - - -- ClusterConfig.adminKubeconfig - - -``` yaml -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -``` - -
- -
- -certLifetime Duration - -
-
- -Admin kubeconfig certificate lifetime (default is 1 year). -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- - - - - -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - - -- MachineConfig.disks - - -``` yaml -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -``` - -
- -
- -device string - -
-
- -The name of the disk to use. - -
- -
- -
- -partitions []DiskPartition - -
-
- -A list of partitions to create on the disk. - -
- -
- - - - - -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - - -- MachineDisk.partitions - - - -
- -
- -size DiskSize - -
-
- -The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - - -Examples: - - -``` yaml -size: 100 MB -``` - -``` yaml -size: 1073741824 -``` - - -
- -
- -
- -mountpoint string - -
-
- -Where to mount the partition. - -
- -
- - - - - -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - - -- SystemDiskEncryptionConfig.state - -- SystemDiskEncryptionConfig.ephemeral - - - -
- -
- -provider string - -
-
- -Encryption provider to use for the encryption. - - - -Examples: - - -``` yaml -provider: luks2 -``` - - -
- -
- -
- -keys []EncryptionKey - -
-
- -Defines the encryption keys generation and storage method. - -
- -
- -
- -cipher string - -
-
- -Cipher kind to use for the encryption. Depends on the encryption provider. - -
- -
- - - - - -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - - -- EncryptionConfig.keys - - - -
- -
- -static EncryptionKeyStatic - -
-
- -Key which value is stored in the configuration file. - -
- -
- -
- -nodeID EncryptionKeyNodeID - -
-
- -Deterministically generated key from the node UUID and PartitionLabel. - -
- -
- -
- -slot int - -
-
- -Key slot number for luks2 encryption. - -
- -
- - - - - -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - - -- EncryptionKey.static - - - -
- -
- -passphrase string - -
-
- -Defines the static passphrase value. - -
- -
- - - - - -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - - -- EncryptionKey.nodeID - - - - - -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - - -- MachineConfig.files - - -``` yaml -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -``` - -
- -
- -content string - -
-
- -The contents of the file. - -
- -
- -
- -permissions FileMode - -
-
- -The file's permissions in octal. - -
- -
- -
- -path string - -
-
- -The path of the file. - -
- -
- -
- -op string - -
-
- -The operation to use - - -Valid values: - - - - create - - - append - - - overwrite -
- -
- - - - - -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - - -- NetworkConfig.extraHostEntries - - -``` yaml -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -``` - -
- -
- -ip string - -
-
- -The IP of the host. - -
- -
- -
- -aliases []string - -
-
- -The host alias. - -
- -
- - - - - -## Device -Device represents a network interface. - -Appears in: - - -- NetworkConfig.interfaces - - -``` yaml -- interface: eth0 # The interface name. - cidr: 192.168.2.0/24 # Assigns a static IP address to the interface. - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 192.168.2.1 # The route's gateway. - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -interface string - -
-
- -The interface name. - - - -Examples: - - -``` yaml -interface: eth0 -``` - - -
- -
- -
- -cidr string - -
-
- -Assigns a static IP address to the interface. -This should be in proper CIDR notation. - -> Note: This option is mutually exclusive with DHCP option. - - - -Examples: - - -``` yaml -cidr: 10.5.0.0/16 -``` - - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the interface. -If used in combination with DHCP, these routes will be appended to routes returned by DHCP server. - - - -Examples: - - -``` yaml -routes: - - network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. - - network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - - -
- -
- -
- -bond Bond - -
-
- -Bond specific options. - - - -Examples: - - -``` yaml -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -``` - - -
- -
- -
- -vlans []Vlan - -
-
- -VLAN specific options. - -
- -
- -
- -mtu int - -
-
- -The interface's MTU. -If used in combination with DHCP, this will override any MTU settings returned from DHCP server. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used to configure the interface. -The following DHCP options are supported: - -- `OptionClasslessStaticRoute` -- `OptionDomainNameServer` -- `OptionDNSDomainSearchList` -- `OptionHostName` - -> Note: This option is mutually exclusive with CIDR. -> -> Note: To configure an interface with *only* IPv6 SLAAC addressing, CIDR should be set to "" and DHCP to false -> in order for Talos to skip configuration of addresses. -> All other options will still apply. - - - -Examples: - - -``` yaml -dhcp: true -``` - - -
- -
- -
- -ignore bool - -
-
- -Indicates if the interface should be ignored (skips configuration). - -
- -
- -
- -dummy bool - -
-
- -Indicates if the interface is a dummy interface. -`dummy` is used to specify that this interface should be a virtual-only, dummy interface. - -
- -
- -
- -dhcpOptions DHCPOptions - -
-
- -DHCP specific options. -`dhcp` *must* be set to true for these to take effect. - - - -Examples: - - -``` yaml -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -``` - - -
- -
- -
- -wireguard DeviceWireguardConfig - -
-
- -Wireguard specific configuration. -Includes things like private key, listen port, peers. - - - -Examples: - - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -``` yaml -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - - -
- -
- -
- -vip DeviceVIPConfig - -
-
- -Virtual (shared) IP address configuration. - - - -Examples: - - -``` yaml -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -``` - - -
- -
- - - - - -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - - -- Device.dhcpOptions - - -``` yaml -routeMetric: 1024 # The priority of all routes received via DHCP. -``` - -
- -
- -routeMetric uint32 - -
-
- -The priority of all routes received via DHCP. - -
- -
- -
- -ipv4 bool - -
-
- -Enables DHCPv4 protocol for the interface (default is enabled). - -
- -
- -
- -ipv6 bool - -
-
- -Enables DHCPv6 protocol for the interface (default is disabled). - -
- -
- - - - - -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - - -- Device.wireguard - - -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` -``` yaml -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -``` - -
- -
- -privateKey string - -
-
- -Specifies a private key configuration (base64 encoded). -Can be generated by `wg genkey`. - -
- -
- -
- -listenPort int - -
-
- -Specifies a device's listening port. - -
- -
- -
- -firewallMark int - -
-
- -Specifies a device's firewall mark. - -
- -
- -
- -peers []DeviceWireguardPeer - -
-
- -Specifies a list of peer configurations to apply to a device. - -
- -
- - - - - -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - - -- DeviceWireguardConfig.peers - - - -
- -
- -publicKey string - -
-
- -Specifies the public key of this peer. -Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`. - -
- -
- -
- -endpoint string - -
-
- -Specifies the endpoint of this peer entry. - -
- -
- -
- -persistentKeepaliveInterval Duration - -
-
- -Specifies the persistent keepalive interval for this peer. -Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes). - -
- -
- -
- -allowedIPs []string - -
-
- -AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - -
- -
- - - - - -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - - -- Device.vip - - -``` yaml -ip: 172.16.199.55 # Specifies the IP address to be used. -``` - -
- -
- -ip string - -
-
- -Specifies the IP address to be used. - -
- -
- - - - - -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - - -- Device.bond - - -``` yaml -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -``` - -
- -
- -interfaces []string - -
-
- -The interfaces that make up the bond. - -
- -
- -
- -arpIPTarget []string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -mode string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -xmitHashPolicy string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lacpRate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSystem string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpValidate string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpAllTargets string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primary string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -primaryReselect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -failOverMac string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adSelect string - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -miimon uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -updelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -downdelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -arpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -resendIgmp uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -minLinks uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -lpInterval uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -packetsPerSlave uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -numPeerNotif uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -tlbDynamicLb uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -allSlavesActive uint8 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -useCarrier bool - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adActorSysPrio uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -adUserPortKey uint16 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- -
- -peerNotifyDelay uint32 - -
-
- -A bond option. -Please see the official kernel documentation. - -
- -
- - - - - -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - - -- Device.vlans - - - -
- -
- -cidr string - -
-
- -The CIDR to use. - -
- -
- -
- -routes []Route - -
-
- -A list of routes associated with the VLAN. - -
- -
- -
- -dhcp bool - -
-
- -Indicates if DHCP should be used. - -
- -
- -
- -vlanId uint16 - -
-
- -The VLAN's ID. - -
- -
- - - - - -## Route -Route represents a network route. - -Appears in: - - -- Device.routes - -- Vlan.routes - - -``` yaml -- network: 0.0.0.0/0 # The route's network. - gateway: 10.5.0.1 # The route's gateway. -- network: 10.2.0.0/16 # The route's network. - gateway: 10.2.0.1 # The route's gateway. -``` - -
- -
- -network string - -
-
- -The route's network. - -
- -
- -
- -gateway string - -
-
- -The route's gateway. - -
- -
- -
- -metric uint32 - -
-
- -The optional metric for the route. - -
- -
- - - - - -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - - -- RegistriesConfig.mirrors - - -``` yaml -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -``` - -
- -
- -endpoints []string - -
-
- -List of endpoints (URLs) for registry mirrors to use. -Endpoint configures HTTP/HTTPS access mode, host name, -port and path (if path is not set, it defaults to `/v2`). - -
- -
- - - - - -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - - -- RegistriesConfig.config - - -``` yaml -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -``` - -
- -
- -tls RegistryTLSConfig - -
-
- -The TLS configuration for the registry. - - - -Examples: - - -``` yaml -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -``` yaml -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -auth RegistryAuthConfig - -
-
- -The auth configuration for this registry. - - - -Examples: - - -``` yaml -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -``` - - -
- -
- - - - - -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - - -- RegistryConfig.auth - - -``` yaml -username: username # Optional registry authentication. -password: password # Optional registry authentication. -``` - -
- -
- -username string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -password string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -auth string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- -
- -identityToken string - -
-
- -Optional registry authentication. -The meaning of each field is the same with the corresponding field in .docker/config.json. - -
- -
- - - - - -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - - -- RegistryConfig.tls - - -``` yaml -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` -``` yaml -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - -
- -
- -clientIdentity PEMEncodedCertificateAndKey - -
-
- -Enable mutual TLS authentication with the registry. -Client certificate and key should be base64-encoded. - - - -Examples: - - -``` yaml -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -``` - - -
- -
- -
- -ca Base64Bytes - -
-
- -CA registry certificate to add the list of trusted certificates. -Certificate should be base64-encoded. - -
- -
- -
- -insecureSkipVerify bool - -
-
- -Skip TLS server certificate verification (not recommended). - -
- -
- - - - - -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - - -- MachineConfig.systemDiskEncryption - - -``` yaml -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for luks2 encryption. -``` - -
- -
- -state EncryptionConfig - -
-
- -State partition encryption. - -
- -
- -
- -ephemeral EncryptionConfig - -
-
- -Ephemeral partition encryption. - -
- -
- - - - - -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - - -- APIServerConfig.extraVolumes - -- ControllerManagerConfig.extraVolumes - -- SchedulerConfig.extraVolumes - - - -
- -
- -hostPath string - -
-
- -Path on the host. - - - -Examples: - - -``` yaml -hostPath: /var/lib/auth -``` - - -
- -
- -
- -mountPath string - -
-
- -Path in the container. - - - -Examples: - - -``` yaml -mountPath: /etc/kubernetes/auth -``` - - -
- -
- -
- -readonly bool - -
-
- -Mount the volume read only. - - - -Examples: - - -``` yaml -readonly: true -``` - - -
- -
- - - - diff --git a/website/content/v0.9/reference/kernel.md b/website/content/v0.9/reference/kernel.md deleted file mode 100644 index de2285852..000000000 --- a/website/content/v0.9/reference/kernel.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Kernel -desription: Linux kernel reference. ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.config`: the HTTP(S) URL at which the machine configuration data can be found -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `packet`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automtic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `packet` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.interface` - - The network interface to use for pre-configuration booting. - - If the node has multiple network interfaces, you may specify which interface - to use by setting this option. - - Keep in mind that Talos uses indexed interface names (eth0, eth1, etc) and not - "predictable" interface names (enp2s0) or BIOS-enumerated (eno1) names. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. - - diff --git a/website/content/v0.9/reference/platform.md b/website/content/v0.9/reference/platform.md deleted file mode 100644 index ade1369b0..000000000 --- a/website/content/v0.9/reference/platform.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -title: Platform ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v0.9/single-board-computers/_index.md b/website/content/v0.9/single-board-computers/_index.md deleted file mode 100644 index 31b2227f4..000000000 --- a/website/content/v0.9/single-board-computers/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Single Board Computers" -weight: 55 ---- diff --git a/website/content/v0.9/single-board-computers/bananapi_m64.md b/website/content/v0.9/single-board-computers/bananapi_m64.md deleted file mode 100644 index 19dd717cd..000000000 --- a/website/content/v0.9/single-board-computers/bananapi_m64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Banana Pi M64" -description: "Installing Talos on Banana Pi M64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-bananapi_m64-arm64.img.xz -xz -d metal-bananapi_m64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-bananapi_m64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.9/single-board-computers/libretech_all_h3_cc_h5.md b/website/content/v0.9/single-board-computers/libretech_all_h3_cc_h5.md deleted file mode 100644 index e67559272..000000000 --- a/website/content/v0.9/single-board-computers/libretech_all_h3_cc_h5.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Libre Computer Board ALL-H3-CC" -description: "Installing Talos on Libre Computer Board ALL-H3-CC SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-libretech_all_h3_cc_h5-arm64.img.xz -xz -d metal-libretech_all_h3_cc_h5-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-libretech_all_h3_cc_h5-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.9/single-board-computers/rock64.md b/website/content/v0.9/single-board-computers/rock64.md deleted file mode 100644 index 0f5de635f..000000000 --- a/website/content/v0.9/single-board-computers/rock64.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Pine64 Rock64" -description: "Installing Talos on Pine64 Rock64 SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rock64-arm64.img.xz -xz -d metal-rock64-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rock64-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.9/single-board-computers/rockpi_4.md b/website/content/v0.9/single-board-computers/rockpi_4.md deleted file mode 100644 index 6c164e7fa..000000000 --- a/website/content/v0.9/single-board-computers/rockpi_4.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: "Radxa ROCK PI 4c" -description: "Installing Talos on Radxa ROCK PI 4c SBC using raw disk image." ---- - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rockpi_4-arm64.img.xz -xz -d metal-rockpi_4-arm64.img.xz -``` - -## Writing the Image - -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rockpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` diff --git a/website/content/v0.9/single-board-computers/rpi_4.md b/website/content/v0.9/single-board-computers/rpi_4.md deleted file mode 100644 index ef2c61671..000000000 --- a/website/content/v0.9/single-board-computers/rpi_4.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: "Raspberry Pi 4 Model B" -description: "Installing Talos on Rpi4 SBC using raw disk image." ---- - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - -## Prerequisites - -You will need - -- `talosctl` -- an SD card - -Download the latest alpha `talosctl`. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Updating the EEPROM - -At least version `v2020.09.03-138a1` of the bootloader (`rpi-eeprom`) is required. -To update the bootloader we will need an SD card. -Insert the SD card into your computer and run the following: -The path to your SD card can be found using `fdisk` on Linux or `diskutil` on Mac OS. -In this example we will assume `/dev/mmcblk0`. - -```bash -curl -LO https://github.com/raspberrypi/rpi-eeprom/releases/download/v2020.09.03-138a1/rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -sudo mkfs.fat -I /dev/mmcblk0 -sudo mount /dev/mmcblk0 /mnt -sudo bsdtar rpi-boot-eeprom-recovery-2020-09-03-vl805-000138a1.zip -C /mnt -``` - -Remove the SD card from your local machine and insert it into the Raspberry Pi. -Power the Raspberry Pi on, and wait at least 10 seconds. -If successful, the green LED light will blink rapidly (forever), otherwise an error pattern will be displayed. -If an HDMI display is attached then the screen will display green for success or red if a failure occurs. -Power off the Raspberry Pi and remove the SD card from it. - -> Note: Updating the bootloader only needs to be done once. - -## Download the Image - -Download the image and decompress it: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/metal-rpi_4-arm64.img.xz -xz -d metal-rpi_4-arm64.img.xz -``` - -## Writing the Image - -Now `dd` the image to your SD card: - -```bash -sudo dd if=metal-rpi_4-arm64.img of=/dev/mmcblk0 conv=fsync bs=4M -``` - -## Bootstrapping the Node - -Insert the SD card to your board, turn it on and wait for the console to show you the instructions for bootstrapping the node. -Following the instructions in the console output to connect to the interactive installer: - -```bash -talosctl apply-config --insecure --interactive --nodes -``` - -Once the interactive installation is applied, the cluster will form and you can then use `kubectl`. - -## Retrieve the `kubeconfig` - -Retrieve the admin `kubeconfig` by running: - -```bash -talosctl kubeconfig -``` - -## Troubleshooting - -The following table can be used to troubleshoot booting issues: - -| Long Flashes | Short Flashes | Status | -| ------------ | :-----------: | ----------------------------------: | -| 0 | 3 | Generic failure to boot | -| 0 | 4 | start\*.elf not found | -| 0 | 7 | Kernel image not found | -| 0 | 8 | SDRAM failure | -| 0 | 9 | Insufficient SDRAM | -| 0 | 10 | In HALT state | -| 2 | 1 | Partition not FAT | -| 2 | 2 | Failed to read from partition | -| 2 | 3 | Extended partition not FAT | -| 2 | 4 | File signature/hash mismatch - Pi 4 | -| 4 | 4 | Unsupported board type | -| 4 | 5 | Fatal firmware error | -| 4 | 6 | Power failure type A | -| 4 | 7 | Power failure type B | diff --git a/website/content/v0.9/virtualized-platforms/_index.md b/website/content/v0.9/virtualized-platforms/_index.md deleted file mode 100644 index 66f845511..000000000 --- a/website/content/v0.9/virtualized-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Virtualized Platforms" -weight: 30 ---- diff --git a/website/content/v0.9/virtualized-platforms/hyper-v.md b/website/content/v0.9/virtualized-platforms/hyper-v.md deleted file mode 100644 index 8093a2c5c..000000000 --- a/website/content/v0.9/virtualized-platforms/hyper-v.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Hyper-V" ---- - -Talos is known to work on Hyper-V; however, it is currently undocumented. diff --git a/website/content/v0.9/virtualized-platforms/kvm.md b/website/content/v0.9/virtualized-platforms/kvm.md deleted file mode 100644 index 012fa7375..000000000 --- a/website/content/v0.9/virtualized-platforms/kvm.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "KVM" ---- - -Talos is known to work on KVM; however, it is currently undocumented. diff --git a/website/content/v0.9/virtualized-platforms/proxmox.md b/website/content/v0.9/virtualized-platforms/proxmox.md deleted file mode 100644 index 862f1ec8e..000000000 --- a/website/content/v0.9/virtualized-platforms/proxmox.md +++ /dev/null @@ -1,182 +0,0 @@ ---- -title: Proxmox -description: "Creating Talos Kubernetes cluster using Proxmox." ---- - -In this guide we will create a Kubernetes cluster using Proxmox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get Proxmox - -It is assumed that you have already installed Proxmox onto the server you wish to create Talos VMs on. -Visit the [Proxmox](https://www.proxmox.com/en/downloads) downloads page if necessary. - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in Proxmox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.9.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Upload ISO - -From the Proxmox UI, select the "local" storage and enter the "Content" section. -Click the "Upload" button: - - - -Select the ISO you downloaded previously, then hit "Upload" - - - -## Create VMs - -Start by creating a new VM by clicking the "Create VM" button in the Proxmox UI: - - - -Fill out a name for the new VM: - - - -In the OS tab, select the ISO we uploaded earlier: - - - -Keep the defaults set in the "System" tab. - -Keep the defaults in the "Hard Disk" tab as well, only changing the size if desired. - -In the "CPU" section, give at least 2 cores to the VM: - - - -Verify that the RAM is set to at least 2GB: - - - -Keep the default values for networking, verifying that the VM is set to come up on the bridge interface: - - - -Finish creating the VM by clicking through the "Confirm" tab and then "Finish". - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the \_out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the Proxmox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the Proxmox UI. diff --git a/website/content/v0.9/virtualized-platforms/vmware.md b/website/content/v0.9/virtualized-platforms/vmware.md deleted file mode 100644 index 70f391d21..000000000 --- a/website/content/v0.9/virtualized-platforms/vmware.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: "VMware" -description: "Creating Talos Kubernetes cluster using VMware." ---- - -## Creating a Cluster via the `govc` CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We will use the `govc` cli which can be downloaded [here](https://github.com/vmware/govmomi/tree/master/govc#installation). - -### Prerequisites - -Prior to starting, it is important to have the following infrastructure in place and available: - -- DHCP server -- Load Balancer or DNS address for cluster endpoint - - If using a load balancer, the most common setup is to balance `tcp/443` across the control plane nodes `tcp/6443` - - If using a DNS address, the A record should return back the addresses of the control plane nodes - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name or name of the loadbalancer used in the prereq steps, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -```bash -$ talosctl gen config talos-k8s-vmware-tutorial https://:6443 -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Set Environment Variables - -`govc` makes use of the following environment variables - -```bash -export GOVC_URL= -export GOVC_USERNAME= -export GOVC_PASSWORD= -``` - -> Note: If your vCenter installation makes use of self signed certificates, you'll want to export `GOVC_INSECURE=true`. - -There are some additional variables that you may need to set: - -```bash -export GOVC_DATACENTER= -export GOVC_RESOURCE_POOL= -export GOVC_DATASTORE= -export GOVC_NETWORK= -``` - -### Download the OVA - -A `talos.ova` asset is published with each [release](https://github.com/talos-systems/talos/releases). -We will refer to the version of the release as `$TALOS_VERSION` below. -It can be easily exported with `export TALOS_VERSION="v0.3.0-alpha.10"` or similar. - -```bash -curl -LO https://github.com/siderolabs/talos/releases/download/$TALOS_VERSION/talos.ova -``` - -### Import the OVA into vCenter - -We'll need to repeat this step for each Talos node we want to create. -In a typical HA setup, we'll have 3 control plane nodes and N workers. -In the following example, we'll setup a HA control plane with two worker nodes. - -```bash -govc import.ova -name talos-$TALOS_VERSION /path/to/downloaded/talos.ova -``` - -#### Create the Bootstrap Node - -We'll clone the OVA to create the bootstrap node (our first control plane node). - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-1 -``` - -Talos makes use of the `guestinfo` facility of VMware to provide the machine/cluster configuration. -This can be set using the `govc vm.change` command. -To facilitate persistent storage using the vSphere cloud provider integration with Kubernetes, `disk.enableUUID=1` is used. - -```bash -govc vm.change \ - -e "guestinfo.talos.config=$(cat init.yaml | base64)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -#### Update Hardware Resources for the Bootstrap Node - -- `-c` is used to configure the number of cpus -- `-m` is used to configure the amount of memory (in MB) - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-1 -``` - -The following can be used to adjust the ephemeral disk size. - -```bash -govc vm.disk.change -vm control-plane-1 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-1 -``` - -#### Create the Remaining Control Plane Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.clone -on=false -vm talos-$TALOS_VERSION control-plane-3 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 controlplane.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-2 -govc vm.change \ - -c 2 \ - -m 4096 \ - -vm /ha-datacenter/vm/control-plane-3 -``` - -```bash -govc vm.disk.change -vm control-plane-2 -disk.name disk-1000-0 -size 10G -govc vm.disk.change -vm control-plane-3 -disk.name disk-1000-0 -size 10G -``` - -```bash -govc vm.power -on control-plane-2 -govc vm.power -on control-plane-3 -``` - -#### Update Settings for the Worker Nodes - -```bash -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-1 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-1 -govc vm.clone -on=false -vm talos-$TALOS_VERSION worker-2 -govc vm.change \ - -e "guestinfo.talos.config=$(base64 join.yaml)" \ - -e "disk.enableUUID=1" \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-1 -govc vm.change \ - -c 4 \ - -m 8192 \ - -vm /ha-datacenter/vm/worker-2 -``` - -```bash -govc vm.disk.change -vm worker-1 -disk.name disk-1000-0 -size 50G -govc vm.disk.change -vm worker-2 -disk.name disk-1000-0 -size 50G -``` - -```bash -govc vm.power -on worker-1 -govc vm.power -on worker-2 -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.9/virtualized-platforms/xen.md b/website/content/v0.9/virtualized-platforms/xen.md deleted file mode 100644 index 5a058501d..000000000 --- a/website/content/v0.9/virtualized-platforms/xen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Xen" ---- - -Talos is known to work on Xen; however, it is currently undocumented. diff --git a/website/content/v1.0/_index.md b/website/content/v1.0/_index.md deleted file mode 100644 index d200224bd..000000000 --- a/website/content/v1.0/_index.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Welcome -no_list: true -linkTitle: "Documentation" -cascade: - type: docs -preRelease: false -lastRelease: v1.0.6 -kubernetesRelease: "1.23.5" -prevKubernetesRelease: "1.23.1" -theilaRelease: "v0.2.1" ---- - -## Welcome - -Welcome to the Talos documentation. -If you are just getting familiar with Talos, we recommend starting here: - -- [What is Talos]({{< relref "introduction/what-is-talos" >}}): a quick description of Talos -- [Quickstart]({{< relref "introduction/quickstart" >}}): the fastest way to get a Talos cluster up and running -- [Getting Started]({{< relref "introduction/getting-started" >}}): a long-form, guided tour of getting a full Talos cluster deployed - -## Open Source - -### Community - -- GitHub: [repo](https://github.com/siderolabs/talos) -- Slack: Join our [slack channel](https://slack.dev.talos-systems.io) -- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/siderolabs/talos/discussions) -- Forum: [community](https://groups.google.com/a/siderolabs.com/forum/#!forum/community) -- Twitter: [@SideroLabs](https://twitter.com/talossystems) -- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com) - -If you're interested in this project and would like to help in engineering efforts, or have general usage questions, we are happy to have you! -We hold a weekly meeting that all audiences are welcome to attend. - -We would appreciate your feedback so that we can make Talos even better! -To do so, you can take our [survey](https://docs.google.com/forms/d/1TUna5YTYGCKot68Y9YN_CLobY6z9JzLVCq1G7DoyNjA/edit). - -### Office Hours - -- When: Second Monday of every month at 16:30 UTC. -- Where: [Google Meet](https://meet.google.com/ivb-kjfm-jfc). - -You can subscribe to this meeting by joining the community forum above. - -> Note: You can convert the meeting hours to your [local time](https://everytimezone.com/s/599e61d6). - -## Enterprise - -If you are using Talos in a production setting, and need consulting services to get started or to integrate Talos into your existing environment, we can help. -Sidero Labs, Inc. offers support contracts with SLA (Service Level Agreement)-bound terms for mission-critical environments. - -[Learn More](https://www.siderolabs.com/support/) diff --git a/website/content/v1.0/advanced/_index.md b/website/content/v1.0/advanced/_index.md deleted file mode 100644 index 3b85c2391..000000000 --- a/website/content/v1.0/advanced/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Advanced Guides" -weight: 60 ---- diff --git a/website/content/v1.0/advanced/advanced-networking.md b/website/content/v1.0/advanced/advanced-networking.md deleted file mode 100644 index 11090497d..000000000 --- a/website/content/v1.0/advanced/advanced-networking.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: "Advanced Networking" -description: "How to configure advanced networking options on Talos Linux." -aliases: - - ../guides/advanced-networking ---- - -## Static Addressing - -Static addressing is comprised of specifying `addresses`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - addresses: - - 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo - addresses: - - 192.168.0.21/24 - - 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - addresses: - - "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v1.0/advanced/air-gapped.md b/website/content/v1.0/advanced/air-gapped.md deleted file mode 100644 index 6cf02af8e..000000000 --- a/website/content/v1.0/advanced/air-gapped.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: "Air-gapped Environments" -description: "Setting up Talos Linux to work in environments with no internet access." -aliases: - - ../guides/air-gapped ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU]({{< relref "../talos-guides/install/local-platforms/qemu" >}}) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-airgapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.15.1: Pulling from coreos/flannel -Digest: sha256:9a296fbb67790659adc3701e287adde3c59803b7fcefe354f1fc482840cdb3d9 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -REPOSITORY TAG IMAGE ID CREATED SIZE -gcr.io/etcd-development/etcd v3.5.3 604d4f022632 6 days ago 181MB -ghcr.io/siderolabs/install-cni v1.0.0-2-gc5d3ab0 4729e54f794d 6 days ago 76MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["coredns/coredns","coreos/flannel","etcd-development/etcd","kube-apiserver","kube-controller-manager","kube-proxy","kube-scheduler","pause","siderolabs/install-cni","siderolabs/installer","siderolabs/kubelet"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -Identify all registry prefixes from `talosctl images`, for example: - -- `docker.io` -- `gcr.io` -- `ghcr.io` -- `k8s.gcr.io` -- `quay.io` - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror =http://10.5.0.1:6000` which redirects every pull request to the internal registry, this flag -needs to be repeated for each of the identified registry prefixes above. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo --preserve-env=HOME talosctl cluster create --provisioner=qemu --install-image=ghcr.io/siderolabs/installer:{{< release >}} \ - --registry-mirror docker.io=http://10.5.0.1:6000 \ - --registry-mirror gcr.io=http://10.5.0.1:6000 \ - --registry-mirror ghcr.io=http://10.5.0.1:6000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:6000 \ - --registry-mirror quay.io=http://10.5.0.1:6000 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/user/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - docker.io: - endpoints: - - http://10.5.0.1:6000/ - gcr.io: - endpoints: - - http://10.5.0.1:6000/ - ghcr.io: - endpoints: - - http://10.5.0.1:6000/ - k8s.gcr.io: - endpoints: - - http://10.5.0.1:6000/ - quay.io: - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v1.0/advanced/customizing-the-kernel.md b/website/content/v1.0/advanced/customizing-the-kernel.md deleted file mode 100644 index bdb83d4e8..000000000 --- a/website/content/v1.0/advanced/customizing-the-kernel.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "Guide on how to customize the kernel used by Talos Linux." -aliases: - - ../guides/customizing-the-kernel ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -Build and push your own kernel: - - ```sh - git clone https://github.com/talos-systems/pkgs.git - cd pkgs - make kernel-menuconfig USERNAME=_your_github_user_name_ - - docker login ghcr.io --username _your_github_user_name_ - make kernel USERNAME=_your_github_user_name_ PUSH=true - ``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM ghcr.io/siderolabs/installer:latest -COPY --from= /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -To build the image, run: - -```bash -DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t installer:kernel . -``` - -> Note: buildkit has a bug [#816](https://github.com/moby/buildkit/issues/816), to disable it use `DOCKER_BUILDKIT=0` - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v1.0/advanced/customizing-the-root-filesystem.md b/website/content/v1.0/advanced/customizing-the-root-filesystem.md deleted file mode 100644 index 2e7eaabbe..000000000 --- a/website/content/v1.0/advanced/customizing-the-root-filesystem.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "How to add your own content to the immutable root file system of Talos Linux." -aliases: - - ../guides/customizing-the-root-filesystem ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/siderolabs/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v1.0/advanced/developing-talos.md b/website/content/v1.0/advanced/developing-talos.md deleted file mode 100644 index 527903e07..000000000 --- a/website/content/v1.0/advanced/developing-talos.md +++ /dev/null @@ -1,235 +0,0 @@ ---- -title: "Developing Talos" -description: "Learn how to set up a development environment for local testing and hacking on Talos itself!" -aliases: - - ../learn-more/developing-talos ---- - -This guide outlines steps and tricks to develop Talos operating systems and related components. -The guide assumes Linux operating system on the development host. -Some steps might work under Mac OS X, but using Linux is highly advised. - -## Prepare - -Check out the [Talos repository](https://github.com/siderolabs/talos). - -Try running `make help` to see available `make` commands. -You would need Docker and `buildx` installed on the host. - -> Note: Usually it is better to install up to date Docker from Docker apt repositories, e.g. [Ubuntu instructions](https://docs.docker.com/engine/install/ubuntu/). -> -> If `buildx` plugin is not available with OS docker packages, it can be installed [as a plugin from GitHub releases](https://docs.docker.com/buildx/working-with-buildx/#install). - -Set up a builder with access to the host network: - -```bash - docker buildx create --driver docker-container --driver-opt network=host --name local1 --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use -``` - -> Note: `network=host` allows buildx builder to access host network, so that it can push to a local container registry (see below). - -Make sure the following steps work: - -- `make talosctl` -- `make initramfs kernel` - -Set up a local docker registry: - -```bash -docker run -d -p 5005:5000 \ - --restart always \ - --name local registry:2 -``` - -Try to build and push to local registry an installer image: - -```bash -make installer IMAGE_REGISTRY=127.0.0.1:5005 PUSH=true -``` - -Record the image name output in the step above. - -> Note: it is also possible to force a stable image tag by using `TAG` variable: `make installer IMAGE_REGISTRY=127.0.0.1:5005 TAG=v1.0.0-alpha.1 PUSH=true`. - -## Running Talos cluster - -Set up local caching docker registries (this speeds up Talos cluster boot a lot), script is in the Talos repo: - -```bash -bash hack/start-registry-proxies.sh -``` - -Start your local cluster with: - -```bash -sudo --preserve-env=HOME _out/talosctl-linux-amd64 cluster create \ - --provisioner=qemu \ - --cidr=172.20.0.0/24 \ - --registry-mirror docker.io=http://172.20.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.20.0.1:5001 \ - --registry-mirror quay.io=http://172.20.0.1:5002 \ - --registry-mirror gcr.io=http://172.20.0.1:5003 \ - --registry-mirror ghcr.io=http://172.20.0.1:5004 \ - --registry-mirror 127.0.0.1:5005=http://172.20.0.1:5005 \ - --install-image=127.0.0.1:5005/siderolabs/installer: \ - --masters 3 \ - --workers 2 \ - --with-bootloader=false -``` - -- `--provisioner` selects QEMU vs. default Docker -- custom `--cidr` to make QEMU cluster use different network than default Docker setup (optional) -- `--registry-mirror` uses the caching proxies set up above to speed up boot time a lot, last one adds your local registry (installer image was pushed to it) -- `--install-image` is the image you built with `make installer` above -- `--masters` & `--workers` configure cluster size, choose to match your resources; 3 masters give you HA control plane; 1 master is enough, never do 2 masters -- `--with-bootloader=false` disables boot from disk (Talos will always boot from `_out/vmlinuz-amd64` and `_out/initramfs-amd64.xz`). - This speeds up development cycle a lot - no need to rebuild installer and perform install, rebooting is enough to get new code. - -> Note: as boot loader is not used, it's not necessary to rebuild `installer` each time (old image is fine), but sometimes it's needed (when configuration changes are done and old installer doesn't validate the config). -> -> `talosctl cluster create` derives Talos machine configuration version from the install image tag, so sometimes early in the development cycle (when new minor tag is not released yet), machine config version can be overridden with `--talos-version={{< version >}}`. - -If the `--with-bootloader=false` flag is not enabled, for Talos cluster to pick up new changes to the code (in `initramfs`), it will require a Talos upgrade (so new `installer` should be built). -With `--with-bootloader=false` flag, Talos always boots from `initramfs` in `_out/` directory, so simple reboot is enough to pick up new code changes. - -If the installation flow needs to be tested, `--with-bootloader=false` shouldn't be used. - -## Console Logs - -Watching console logs is easy with `tail`: - -```bash -tail -F ~/.talos/clusters/talos-default/talos-default-*.log -``` - -## Interacting with Talos - -Once `talosctl cluster create` finishes successfully, `talosconfig` and `kubeconfig` will be set up automatically to point to your cluster. - -Start playing with `talosctl`: - -```bash -talosctl -n 172.20.0.2 version -talosctl -n 172.20.0.3,172.20.0.4 dashboard -talosctl -n 172.20.0.4 get members -``` - -Same with `kubectl`: - -```bash -kubectl get nodes -o wide -``` - -You can deploy some Kubernetes workloads to the cluster. - -You can edit machine config on the fly with `talosctl edit mc --immediate`, config patches can be applied via `--config-patch` flags, also many features have specific flags in `talosctl cluster create`. - -## Quick Reboot - -To reboot whole cluster quickly (e.g. to pick up a change made in the code): - -```bash -for socket in ~/.talos/clusters/talos-default/talos-default-*.monitor; do echo "q" | sudo socat - unix-connect:$socket; done -``` - -Sending `q` to a single socket allows to reboot a single node. - -> Note: This command performs immediate reboot (as if the machine was powered down and immediately powered back up), for normal Talos reboot use `talosctl reboot`. - -## Development Cycle - -Fast development cycle: - -- bring up a cluster -- make code changes -- rebuild `initramfs` with `make initramfs` -- reboot a node to pick new `initramfs` -- verify code changes -- more code changes... - -Some aspects of Talos development require to enable bootloader (when working on `installer` itself), in that case quick development cycle is no longer possible, and cluster should be destroyed and recreated each time. - -## Running Integration Tests - -If integration tests were changed (or when running them for the first time), first rebuild the integration test binary: - -```bash -rm -f _out/integration-test-linux-amd64; make _out/integration-test-linux-amd64 -``` - -Running short tests against QEMU provisioned cluster: - -```bash -_out/integration-test-linux-amd64 \ - -talos.provisioner=qemu \ - -test.v \ - -talos.crashdump=false \ - -test.short \ - -talos.talosctlpath=$PWD/_out/talosctl-linux-amd64 -``` - -Whole test suite can be run removing `-test.short` flag. - -Specfic tests can be run with `-test.run=TestIntegration/api.ResetSuite`. - -## Build Flavors - -`make WITH_RACE=1` enables Go race detector, Talos runs slower and uses more memory, but memory races are detected. - -`make WITH_DEBUG=1` enables Go profiling and other debug features, useful for local development. - -## Destroying Cluster - -```bash -sudo --preserve-env=HOME ../talos/_out/talosctl-linux-amd64 cluster destroy --provisioner=qemu -``` - -This command stops QEMU and helper processes, tears down bridged network on the host, and cleans up -cluster state in `~/.talos/clusters`. - -> Note: if the host machine is rebooted, QEMU instances and helpers processes won't be started back. -> In that case it's required to clean up files in `~/.talos/clusters/` directory manually. - -## Optional - -Set up cross-build environment with: - -```bash -docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -``` - -> Note: the static qemu binaries which come with Ubuntu 21.10 seem to be broken. - -## Unit tests - -Unit tests can be run in buildx with `make unit-tests`, on Ubuntu systems some tests using `loop` devices will fail because Ubuntu uses low-index `loop` devices for snaps. - -Most of the unit-tests can be run standalone as well, with regular `go test`, or using IDE integration: - -```bash -go test -v ./internal/pkg/circular/ -``` - -This provides much faster feedback loop, but some tests require either elevated privileges (running as `root`) or additional binaries available only in Talos `rootfs` (containerd tests). - -Running tests as root can be done with `-exec` flag to `go test`, but this is risky, as test code has root access and can potentially make undesired changes: - -```bash -go test -exec sudo -v ./internal/app/machined/pkg/controllers/network/... -``` - -## Go Profiling - -Build `initramfs` with debug enabled: `make initramfs WITH_DEBUG=1`. - -Launch Talos cluster with bootloader disabled, and use `go tool pprof` to capture the profile and show the output in your browser: - -```bash -go tool pprof http://172.20.0.2:9982/debug/pprof/heap -``` - -The IP address `172.20.0.2` is the address of the Talos node, and port `:9982` depends on the Go application to profile: - -- 9981: `apid` -- 9982: `machined` -- 9983: `trustd` diff --git a/website/content/v1.0/advanced/disaster-recovery.md b/website/content/v1.0/advanced/disaster-recovery.md deleted file mode 100644 index feaefd1ed..000000000 --- a/website/content/v1.0/advanced/disaster-recovery.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." -aliases: - - ../guides/disaster-recovery ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --mode=staged` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's [EPHEMERAL]({{< relref "../learn-more/architecture/#file-system-partitions" >}}) partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v1.0/advanced/extension-services.md b/website/content/v1.0/advanced/extension-services.md deleted file mode 100644 index 63e54f795..000000000 --- a/website/content/v1.0/advanced/extension-services.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: "Extension Services" -description: "Use extension services in Talos Linux." -aliases: - - ../learn-more/extension-services ---- - -Talos provides a way to run additional system services early in the Talos boot process. -Extension services should be included into the Talos root filesystem (e.g. using [system extensions]({{< relref "../talos-guides/configuration/system-extensions" >}})). -Extension services run as privileged containers with ephemeral root filesystem located in the Talos root filesystem. - -Extension services can be used to use extend core features of Talos in a way that is not possible via [static pods]({{< relref "../advanced/static-pods" >}}) or -Kubernetes DaemonSets. - -Potential extension services use-cases: - -* storage: Open iSCSI, software RAID, etc. -* networking: BGP FRR, etc. -* platform integration: VMWare open VM tools, etc. - -## Configuration - -Talos on boot scans directory `/usr/local/etc/containers` for `*.yaml` files describing the extension services to run. -Format of the extension service config: - -```yaml -name: hello-world -container: - entrypoint: ./hello-world - args: - - -f - mounts: - - # OCI Mount Spec -depends: - - service: cri - - path: /run/machined/machined.sock - - network: - - addresses - - connectivity - - hostname - - etcfiles - - time: true -restart: never|always|untilSuccess -``` - -### `name` - -Field `name` sets the service name, valid names are `[a-z0-9-_]+`. -The service container root filesystem path is derived from the `name`: `/usr/local/lib/containers/`. -The extension service will be registered as a Talos service under an `ext-` identifier. - -### `container` - -* `entrypoint` defines the container entrypoint relative to the container root filesystem (`/usr/local/lib/containers/`) -* `args` defines the additional arguments to pass to the entrypoint -* `mounts` defines the volumes to be mounted into the container root - -#### `container.mounts` - -The section `mounts` uses the standard OCI spec: - -```yaml -- source: /var/log/audit - destination: /var/log/audit - type: bind - options: - - rshared - - bind - - ro -``` - -All requested directories will be mounted into the extension service container mount namespace. -If the `source` directory doesn't exist in the host filesystem, it will be created (only for writable paths in the Talos root filesystem). - -### `depends` - -The `depends` section describes extension service start dependencies: the service will not be started until all dependencies are met. - -Available dependencies: - -* `service: `: wait for the service `` to be running and healthy -* `path: `: wait for the `` to exist -* `network: [addresses, connectivity, hostname, etcfiles]`: wait for the specified network readiness checks to succeed -* `time: true`: wait for the NTP time sync - -### `restart` - -Field `restart` defines the service restart policy, it allows to either configure an always running service or a one-shot service: - -* `always`: restart service always -* `never`: start service only once and never restart -* `untilSuccess`: restart failing service, stop restarting on successful run - -## Example - -Example layout of the Talos root filesystem contents for the extension service: - -```text -/ -└── usr -    └── local -       ├── etc -      │   └── containers -       │     └── hello-world.yaml -       └── lib -           └── containers -          └── hello-world -          ├── hello - └── config.ini -``` - -Talos discovers the extension service configuration in `/usr/local/etc/containers/hello-world.yaml`: - -```yaml -name: hello-world -container: - entrypoint: ./hello - args: - - --config - - config.ini -depends: - - network: - - addresses -restart: always -``` - -Talos starts the container for the extension service with container root filesystem at `/usr/local/lib/containers/hello-world`: - -```text -/ -├── hello -└── config.ini -``` - -Extension service is registered as `ext-hello-world` in `talosctl services`: - -```shell -$ talosctl service ext-hello-world -NODE 172.20.0.5 -ID ext-hello-world -STATE Running -HEALTH ? -EVENTS [Running]: Started task ext-hello-world (PID 1100) for container ext-hello-world (2m47s ago) - [Preparing]: Creating service runner (2m47s ago) - [Preparing]: Running pre state (2m47s ago) - [Waiting]: Waiting for service "containerd" to be "up" (2m48s ago) - [Waiting]: Waiting for service "containerd" to be "up", network (2m49s ago) -``` - -An extension service can be started, restarted and stopped using `talosctl service ext-hello-world start|restart|stop`. -Use `talosctl logs ext-hello-world` to get the logs of the service. - -Complete example of the extension service can be found in the [extensions repository](https://github.com/talos-systems/extensions/tree/main/examples/hello-world-service). diff --git a/website/content/v1.0/advanced/proprietary-kernel-modules.md b/website/content/v1.0/advanced/proprietary-kernel-modules.md deleted file mode 100644 index 21e3dc308..000000000 --- a/website/content/v1.0/advanced/proprietary-kernel-modules.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "Proprietary Kernel Modules" -description: "Adding a proprietary kernel module to Talos Linux" -aliases: - - ../guides/adding-a-proprietary-kernel-module ---- - -1. Patching and building the kernel image - 1. Clone the `pkgs` repository from Github and check out the revision corresponding to your version of Talos Linux - - ```bash - git clone https://github.com/talos-systems/pkgs pkgs && cd pkgs - git checkout v0.8.0 - ``` - - 2. Clone the Linux kernel and check out the revision that pkgs uses (this can be found in `kernel/kernel-prepare/pkg.yaml` and it will be something like the following: `https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-x.xx.x.tar.xz`) - - ```bash - git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git && cd linux - git checkout v5.15 - ``` - - 3. Your module will need to be converted to be in-tree. - The steps for this are different depending on the complexity of the module to port, but generally it would involve moving the module source code into the `drivers` tree and creating a new Makefile and Kconfig. - 4. Stage your changes in Git with `git add -A`. - 5. Run `git diff --cached --no-prefix > foobar.patch` to generate a patch from your changes. - 6. Copy this patch to `kernel/kernel/patches` in the `pkgs` repo. - 7. Add a `patch` line in the `prepare` segment of `kernel/kernel/pkg.yaml`: - - ```bash - patch -p0 < /pkg/patches/foobar.patch - ``` - - 8. Build the kernel image. - Make sure you are logged in to `ghcr.io` before running this command, and you can change or omit `PLATFORM` depending on what you want to target. - - ```bash - make kernel PLATFORM=linux/amd64 USERNAME=your-username PUSH=true - ``` - - 9. Make a note of the image name the `make` command outputs. -2. Building the installer image - 1. Copy the following into a new `Dockerfile`: - - ```dockerfile - FROM scratch AS customization - COPY --from=ghcr.io/your-username/kernel: /lib/modules /lib/modules - - FROM ghcr.io/siderolabs/installer: - COPY --from=ghcr.io/your-username/kernel: /boot/vmlinuz /usr/install/${TARGETARCH}/vmlinuz - ``` - - 2. Run to build and push the installer: - - ```bash - INSTALLER_VERSION= - IMAGE_NAME="ghcr.io/your-username/talos-installer:$INSTALLER_VERSION" - DOCKER_BUILDKIT=0 docker build --build-arg RM="/lib/modules" -t "$IMAGE_NAME" . && docker push "$IMAGE_NAME" - ``` - -3. Deploying to your cluster - - ```bash - talosctl upgrade --image ghcr.io/your-username/talos-installer: --preserve=true - ``` diff --git a/website/content/v1.0/advanced/static-pods.md b/website/content/v1.0/advanced/static-pods.md deleted file mode 100644 index da2eaae22..000000000 --- a/website/content/v1.0/advanced/static-pods.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "Static Pods" -description: "Using Talos Linux to set up static pods in Kubernetes." -aliases: - - ../guides/static-pods ---- - -## Static Pods - -Static pods are run directly by the `kubelet` bypassing the Kubernetes API server checks and validations. -Most of the time `DaemonSet` is a better alternative to static pods, but some workloads need to run -before the Kubernetes API server is available or might need to bypass security restrictions imposed by the API server. - -See [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/) for more information on static pods. - -## Configuration - -Static pod definitions are specified in the Talos machine configuration: - -```yaml -machine: - pods: - - apiVersion: v1 - kind: Pod - metadata: - name: nginx - spec: - containers: - - name: nginx - image: nginx -``` - -Talos renders static pod definitions to the `kubelet` manifest directory (`/etc/kubernetes/manifests`), `kubelet` picks up the definition and launches the pod. - -Talos accepts changes to the static pod configuration without a reboot. - -## Usage - -Kubelet mirrors pod definition to the API server state, so static pods can be inspected with `kubectl get pods`, logs can be retrieved with `kubectl logs`, etc. - -```bash -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -nginx-talos-default-master-2 1/1 Running 0 17s -``` - -If the API server is not available, status of the static pod can also be inspected with `talosctl containers --kubernetes`: - -```bash -$ talosctl containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.3 k8s.io default/nginx-talos-default-master-2 k8s.gcr.io/pause:3.6 4886 SANDBOX_READY -172.20.0.3 k8s.io └─ default/nginx-talos-default-master-2:nginx docker.io/library/nginx:latest -... -``` - -Logs of static pods can be retrieved with `talosctl logs --kubernetes`: - -```bash -$ talosctl logs --kubernetes default/nginx-talos-default-master-2:nginx -172.20.0.3: 2022-02-10T15:26:01.289208227Z stderr F 2022/02/10 15:26:01 [notice] 1#1: using the "epoll" event method -172.20.0.3: 2022-02-10T15:26:01.2892466Z stderr F 2022/02/10 15:26:01 [notice] 1#1: nginx/1.21.6 -172.20.0.3: 2022-02-10T15:26:01.28925723Z stderr F 2022/02/10 15:26:01 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6) -``` - -## Troubleshooting - -Talos doesn't perform any validation on the static pod definitions. -If the pod isn't running, use `kubelet` logs (`talosctl logs kubelet`) to find the problem: - -```bash -$ talosctl logs kubelet -172.20.0.2: {"ts":1644505520281.427,"caller":"config/file.go:187","msg":"Could not process manifest file","path":"/etc/kubernetes/manifests/talos-default-nginx-gvisor.yaml","err":"invalid pod: [spec.containers: Required value]"} -``` - -## Resource Definitions - -Static pod definitions are available as `StaticPod` resources combined with Talos-generated control plane static pods: - -```bash -$ talosctl get staticpods -NODE NAMESPACE TYPE ID VERSION -172.20.0.3 k8s StaticPod default-nginx 1 -172.20.0.3 k8s StaticPod kube-apiserver 1 -172.20.0.3 k8s StaticPod kube-controller-manager 1 -172.20.0.3 k8s StaticPod kube-scheduler 1 -``` - -Talos assigns ID `-` to the static pods specified in the machine configuration. - -On control plane nodes status of the running static pods is available in the `StaticPodStatus` resource: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.3 k8s StaticPodStatus default/nginx-talos-default-master-2 2 True -172.20.0.3 k8s StaticPodStatus kube-system/kube-apiserver-talos-default-master-2 2 True -172.20.0.3 k8s StaticPodStatus kube-system/kube-controller-manager-talos-default-master-2 3 True -172.20.0.3 k8s StaticPodStatus kube-system/kube-scheduler-talos-default-master-2 3 True -``` diff --git a/website/content/v1.0/advanced/troubleshooting-control-plane.md b/website/content/v1.0/advanced/troubleshooting-control-plane.md deleted file mode 100644 index defc2875e..000000000 --- a/website/content/v1.0/advanced/troubleshooting-control-plane.md +++ /dev/null @@ -1,487 +0,0 @@ ---- -title: "Troubleshooting Control Plane" -description: "Troubleshoot control plane failures for running cluster and bootstrap process." -aliases: - - ../guides/troubleshooting-control-plane ---- - - - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -A control plane node is a node which: - -- runs etcd, the Kubernetes database -- runs the Kubernetes control plane - - kube-apiserver - - kube-controller-manager - - kube-scheduler -- serves as an administrative proxy to the worker nodes - -These nodes are critical to the operation of your cluster. -Without control plane nodes, Kubernetes will not respond to changes in the -system, and certain central services may not be available. - -Talos nodes which have `.machine.type` of `controlplane` are control plane nodes. - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -Because control plane nodes are so important, it is important that they be -deployed with redundancy to ensure consistent, reliable operation of the cluster -during upgrades, reboots, hardware failures, and other such events. -This is also known as high-availability or just HA. -Non-HA clusters are sometimes used as test clusters, CI clusters, or in specific scenarios -which warrant the loss of redundancy, but they should almost never be used in production. - -Maintaining the proper count of control plane nodes is also critical. -The etcd database operates on the principles of membership and quorum, so -membership should always be an odd number, and there is exponentially-increasing -overhead for each additional member. -Therefore, the number of control plane nodes should almost always be 3. -In some particularly large or distributed clusters, the count may be 5, but this -is very rare. - -See [this document]({{< relref "../learn-more/concepts#control-planes-are-not-linear-replicas" >}}) on the topic for more information. - -### What is the control plane endpoint? - -The Kubernetes control plane endpoint is the single canonical URL by which the -Kubernetes API is accessed. -Especially with high-availability (HA) control planes, it is common that this endpoint may not point to the Kubernetes API server -directly, but may be instead point to a load balancer or a DNS name which may -have multiple `A` and `AAAA` records. - -Like Talos' own API, the Kubernetes API is constructed with mutual TLS, client -certs, and a common Certificate Authority (CA). -Unlike general-purpose websites, there is no need for an upstream CA, so tools -such as cert-manager, services such as Let's Encrypt, or purchased products such -as validated TLS certificates are not required. -Encryption, however, _is_, and hence the URL scheme will always be `https://`. - -By default, the Kubernetes API server in Talos runs on port 6443. -As such, the control plane endpoint URLs for Talos will almost always be of the form -`https://endpoint:6443`, noting that the port, since it is not the `https` -default of `443` is _required_. -The `endpoint` above may be a DNS name or IP address, but it should be -ultimately be directed to the _set_ of all controlplane nodes, as opposed to a -single one. - -As mentioned above, this can be achieved by a number of strategies, including: - -- an external load balancer -- DNS records -- Talos-builtin shared IP ([VIP]({{< relref "../talos-guides/network/vip" >}})) -- BGP peering of a shared IP (such as with [kube-vip](https://kube-vip.io)) - -Using a DNS name here is usually a good idea, it being the most flexible -option, since it allows the combination with any _other_ option, while offering -a layer of abstraction. -It allows the underlying IP addresses to change over time without impacting the -canonical URL. - -Unlike most services in Kubernetes, the API server runs with host networking, -meaning that it shares the network namespace with the host. -This means you can use the IP address(es) of the host to refer to the Kubernetes -API server. - -For availability of the API, it is important that any load balancer be aware of -the health of the backend API servers. -This makes a load balancer-based system valuable to minimize disruptions during -common node lifecycle operations like reboots and upgrades. - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -The `kubelet` service should be running on control plane nodes as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If the `kubelet` is not running, it may be due to invalid configuration. -Check `kubelet` logs with the `talosctl logs` command: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running - -By far the most likely cause of `etcd` not running is because the cluster has -not yet been bootstrapped or because bootstrapping is currently in progress. -The `talosctl bootstrap` command must be run manually and only _once_ per -cluster, and this step is commonly missed. -Once a node is bootstrapped, it will start `etcd` and, over the course of a -minute or two (depending on the download speed of the control plane nodes), the -other control plane nodes should discover it and join themselves to the cluster. - -Also, `etcd` will only run on control plane nodes. -If a node is designated as a worker node, you should not expect `etcd` to be -running on it. - -When node boots for the first time, the `etcd` data directory (`/var/lib/etcd`) is empty, and it will only be populated when `etcd` is launched. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls the `etcd` image from the container registry. - -If the `etcd` service is crashing and restarting, check its logs with `talosctl -n logs etcd`. -The most common reasons for crashes are: - -- wrong arguments passed via `extraArgs` in the configuration; -- booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -The `etcd` service on control plane nodes which were not the target of the cluster bootstrap will wait until the bootstrapped control plane node has completed. -The bootstrap and discovery processes may take a few minutes to complete. -As soon as the bootstrapped node starts its Kubernetes control plane components, `kubectl get endpoints` will return the IP of bootstrapped control plane node. -At this point, the other control plane nodes will start their `etcd` services, join the cluster, and then start their own Kubernetes control plane components. - -### Kubernetes static pod definitions are not generated - -Talos should write the static pod definitions for the Kubernetes control plane -in `/etc/kubernetes/manifests`: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If the static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above) -and the controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once the control plane endpoint is up, Talos should continue with its boot -process. - -If Talos doesn't proceed, it may be due to a configuration issue. - -In any case, the status of the control plane components on each control plane nodes can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v{{< k8s_release >}} 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up and the control plane endpoint is healthy, but the `kubelet` hasn't received -its client certificate yet, and it wasn't able to register itself to Kubernetes. -The Kubernetes controller manager (`kube-controller-manager`)is responsible for monitoring the certificate -signing requests (CSRs) and issuing certificates for each of them. -The kubelet is responsible for generating and submitting the CSRs for its -associated node. - -For the `kubelet` to get its client certificate, then, the Kubernetes control plane -must be healthy: - -- the API server is running and available at the Kubernetes control plane - endpoint URL -- the controller manager is running and a leader has been elected - -The states of any CSRs can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -A Node in Kubernetes is marked as `Ready` only once its CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`. -Usually, CNI-related resources are created in `kube-system` namespace. - -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -The full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Usually, this occurs because the control plane endpoint points to a different -cluster than the client certificate was generated for. -If a node was recycled between clusters, make sure it was properly wiped between -uses. -If a client has multiple client configurations, make sure you are matching the correct `talosconfig` with the -correct cluster. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If the control plane endpoint is up, the status of the pods can be ascertained with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If the control plane endpoint is not yet up, the container status of the control plane components can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v{{< k8s_release >}} 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v{{< k8s_release >}} 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise the process might crashing. -The logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which operate on resources to build and support the Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers continuously run a reconcile loop, so at any time, they may be starting, failing, or restarting. -This is expected behavior. - -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in the `controller-runtime` log, it means that the controllers have successfully finished reconciling, and that the current system state is the desired system state. - -### Checking static pod definitions - -Talos generates static pod definitions for the `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on its machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -The status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -The most important status field is `READY`, which is the last column printed. -The complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of the bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of these manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifest can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for their `kubelet` to join the cluster. -Then the Talos `apid` queries the Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints. -They then use `trustd` to request and receive their certificate. - -So if `apid` health checks are failing on worker node: - -- make sure control plane endpoint is healthy -- check that worker node `kubelet` joined the cluster diff --git a/website/content/v1.0/introduction/_index.md b/website/content/v1.0/introduction/_index.md deleted file mode 100644 index a12a4a13c..000000000 --- a/website/content/v1.0/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 10 ---- diff --git a/website/content/v1.0/introduction/getting-started.md b/website/content/v1.0/introduction/getting-started.md deleted file mode 100644 index 328f22da1..000000000 --- a/website/content/v1.0/introduction/getting-started.md +++ /dev/null @@ -1,463 +0,0 @@ ---- -title: Getting Started -weight: 30 -description: "A guide to setting up a Talos Linux cluster on multiple machines." ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to try the [Quickstart]({{< relref "quickstart" >}}) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, there is a pattern to deploying it. -In general you need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - - `talosctl` is a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful options for creating and managing clusters. - -You should install `talosctl` before continuing: - -#### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -#### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/siderolabs/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/{{< release >}}/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/{{< release >}}/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/{{< release >}}/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/{{< release >}}/talos-arm64.iso) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -For network booting and self-built media, you can use the published kernel and initramfs images: - -- X86: [vmlinuz-amd64](https://github.com/siderolabs/talos/releases/download/{{< release >}}/vmlinuz-amd64) [initramfs-amd64.xz](https://github.com/siderolabs/talos/releases/download/{{< release >}}/initramfs-amd64.xz) -- ARM64: [vmlinuz-arm64](https://github.com/siderolabs/talos/releases/download/{{< release >}}/vmlinuz-arm64) [initramfs-arm64.xz](https://github.com/siderolabs/talos/releases/download/{{< release >}}/initramfs-arm64.xz) - -Note that to use alternate booting, there are a number of required kernel parameters. -Please see the [kernel]({{< relref "../reference/kernel" >}}) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be highly -available, we must also choose how to bind the API server endpoint to the servers -themselves. -There are three common ways to do this: - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -you could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are free to set a DNS record to this IP address to identify the Kubernetes API endpoint, but you will need to use the IP address itself, not the DNS name, to configure the shared IP (`machine.network.interfaces[].vip.ip`) in the Talos configuration. - -For more information about using a shared IP, see the related -[Guide]({{< relref "../talos-guides/network/vip" >}}) - -### DNS records - -If neither of the other methods work for you, you can use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records (one for each controlpane node) to a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, Talos comes with a number of mechanisms to make accessing the API easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance requests and fail over -between all of your controlplane nodes, so long as it is informed of the -controlplane node IPs. - -This means you need to tell your client (`talosctl`) how to communicate with the controlplane nodes, which is done by defining the `endpoints`. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer, similarly to accessing the Kubernetes API. -The difference is that the Talos API listens on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -**NOTE**: The [Virtual IP]({{< relref "../talos-guides/network/vip.md" >}}) method is not recommended when accessing the Talos API as it requires etcd to be bootstrapped and functional. -This can make debugging any issues via the Talos API more difficult as issues with Talos configuration may result in etcd not achieving quorum, and therefore the Virtual IP not being available. -In this case setting the endpoints to the IP or hostnames of the control plane nodes themselves is preferred. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters]({{< relref "../reference/kernel" >}}) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port. -(The default port is `6443`.) - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `worker.yaml` -- `talosconfig` - -The `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers, and they provide their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane and Worker - -The two types of Machine Configs correspond to the two roles of Talos nodes. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Worker Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Worker Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `worker.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp worker.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the machines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --mode=interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes, their IPs and/or hostnames are _as seen by the endpoint servers_, not as from the client. -This is because all connections are proxied through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. - -The author of this document generally sets a single controlplane node to be the -default node, which provides the most flexible default operation while limiting -the scope of the disaster should a command be entered erroneously: - -```sh - talosctl --talosconfig=./talosconfig \ - config node 192.168.0.2 -``` - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl]({{< relref "../learn-more/talosctl" >}}). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -**IMPORTANT**: the bootstrap operation should only be called **ONCE** and only on a **SINGLE** -controlplane node! - -The IP can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v1.0/introduction/quickstart.md b/website/content/v1.0/introduction/quickstart.md deleted file mode 100644 index 484b24c7a..000000000 --- a/website/content/v1.0/introduction/quickstart.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Quickstart -weight: 20 -description: "A short guide on setting up a simple Talos Linux cluster locally with Docker." ---- - -## Local Docker Cluster - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -### Prerequisites - -#### `talosctl` - -Download `talosctl`: - -##### `amd64` - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -##### `arm64` - -For `linux` and `darwin` operating systems `talosctl` is also available for the `arm64` processor architecture. - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/{{< release >}}/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-arm64 -chmod +x /usr/local/bin/talosctl -``` - -#### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -### Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v{{< k8s_release >}} 10.5.0.2 Talos ({{< release >}}) containerd://1.5.5 -talos-default-worker-1 Ready 115s v{{< k8s_release >}} 10.5.0.3 Talos ({{< release >}}) containerd://1.5.5 -``` - -### Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v1.0/introduction/support-matrix.md b/website/content/v1.0/introduction/support-matrix.md deleted file mode 100644 index e73551ad2..000000000 --- a/website/content/v1.0/introduction/support-matrix.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Support Matrix -weight: 60 -description: "Table of supported Talos Linux versions and respective platforms." ---- - -| Talos Version | 1.0 | 0.14 | -|----------------------------------------------------------------------------------------------------------------|------------------------------------|------------------------------------| -| Release Date | 2022-03-29 | 2021-12-21 (0.14.0) | -| End of Community Support | 1.1.0 release (2022-06-22) | 1.0.0 release (2022-03-29) | -| Enterprise Support | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | [offered by Sidero Labs Inc.](https://www.siderolabs.com/support/) | -| Kubernetes | 1.23, 1.22, 1.21 | 1.23, 1.22, 1.21 | -| Architecture | amd64, arm64 | amd64, arm64 | -| **Platforms** | | | -| - cloud | AWS, GCP, Azure, Digital Ocean, Hetzner, OpenStack, Oracle Cloud, Scaleway, Vultr, Upcloud | AWS, GCP, Azure, Digital Ocean, Hetzner, OpenStack, Scaleway, Vultr, Upcloud | -| - bare metal | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | x86: BIOS, UEFI; arm64: UEFI; boot: ISO, PXE, disk image | -| - virtualized | VMware, Hyper-V, KVM, Proxmox, Xen | VMware, Hyper-V, KVM, Proxmox, Xen | -| - SBCs | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Pine64, Pine64 Rock64, Radxa ROCK Pi 4c, Raspberry Pi 4B | Raspberry Pi4, Banana Pi M64, Pine64, and other | -| - local | Docker, QEMU | Docker, QEMU | -| **Cluster API** | | | -| [CAPI Bootstrap Provider Talos](https://github.com/siderolabs/cluster-api-bootstrap-provider-talos) | >= 0.5.3 | >= 0.4.3 | -| [CAPI Control Plane Provider Talos](https://github.com/siderolabs/cluster-api-control-plane-provider-talos) | >= 0.4.5 | >= 0.4.1 | -| [Sidero](https://www.sidero.dev/) | >= 0.5.0 | >= 0.4.1 | -| **UI** | | | -| [Theila](https://github.com/siderolabs/theila) | ✓ | ✓ | - -## Platform Tiers - -Tier 1: Automated tests, high-priority fixes. -Tier 2: Tested from time to time, medium-priority bugfixes. -Tier 3: Not tested by core Talos team, community tested. - -### Tier 1 - -* Metal -* AWS -* GCP - -### Tier 2 - -* Azure -* Digital Ocean -* OpenStack -* VMWare - -### Tier 3 - -* Hetzner -* nocloud -* Oracle Cloud -* Scaleway -* Vultr -* Upcloud diff --git a/website/content/v1.0/introduction/system-requirements.md b/website/content/v1.0/introduction/system-requirements.md deleted file mode 100644 index 734c84da2..000000000 --- a/website/content/v1.0/introduction/system-requirements.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: System Requirements -weight: 40 -description: "Hardware requirements for running Talos Linux." ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v1.0/introduction/theila.md b/website/content/v1.0/introduction/theila.md deleted file mode 100644 index ef2623f75..000000000 --- a/website/content/v1.0/introduction/theila.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Theila UI for Talos -weight: 35 -description: "An intro to Theila - a UI for Talos clusters." ---- - -Once you have a Talos cluster running, you may find it easier to get insights on your cluster(s) using a visual user interface rather than the `talosctl` CLI. -For this, Sidero Labs provides [Theila](https://github.com/siderolabs/theila), a simple, single-binary web-based visual user interface for Talos clusters. - -## Prerequisites - -You should have a Talos cluster up & running, and the `talosconfig` file for Theila to access it. - -## Installation - -Theila is published as a single static binary compiled for various platforms and architectures, as well as a container image. - -### Binary - -You can download the correct binary for your system from the [releases](https://github.com/siderolabs/theila/releases) page, or use the following commands in your terminal. - -```bash -curl -Lo /usr/local/bin/theila https://github.com/siderolabs/theila/releases/download/{{< theila_release >}}/theila-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/theila -``` - -## Use - -Once installed, you can run Theila by simply running it. - - - - - -{{< tabpane lang="bash" right=true >}} -{{< tab header="Binary" >}} -# address and port are not required and default to the values shown -theila --address 127.0.0.1 --port 8080 -{{< /tab >}} -{{< tab header="Docker" >}} -docker run --rm --volume ${HOME}/.talos/config:/opt/talosconfig:ro --env TALOSCONFIG=/opt/talosconfig --publish 8080:8080 ghcr.io/siderolabs/theila --address 0.0.0.0 -{{< /tab >}} -{{< /tabpane >}} - -Once it is running you should be able to point a browser at [http://localhost:8080](http://localhost:8080) to open the Theila UI. - -### Clusters - -You can navigate around various Talos clusters using the menu at the upper-left corner (see 1.1), then selecting the specific cluster from the list (see 1.2). -![Fig 1 Talos cluster selection with Theila](/images/theila-cluster-selection.png) - -### Cluster Overview - -Clicking on the "Overview" option in the menu (see 2.1) will display an overview of resource use & health of the cluster. -![Fig 2 Talos cluster overview](/images/theila-cluster-overview.png) - -### Nodes - -Entering the "Nodes" section on the menu (see 3.1) will give a list of nodes in the cluster (see 3.2), along with information such as IP address, status, and any roles assigned to the node. -Opening the node menu (see 3.3) show the actions that can be taken on a specific node. -![Fig 3 Node list](/images/theila-nodes.png) - -Clicking on a specific node name in the node list will open the node detail page for more information on each specific node (see 4.1), including running services and their logs (see 4.2). -![Fig 4 Node detail](/images/theila-node-detail.png) - -Clicking on the "Monitor" tab (see 5.1) allows you to watch resource use over time, with CPU and memory consumption graphs updated in real time, and a detailed list of running process each with their individual resource use (see 5.2). -![Fig 5 Node monitoring](/images/theila-node-monitor.png) - -Lastly, the "Dmesg" tab shows all kernel messages of the node since boot. - -### Pods - -Using the "Pods" section on the menu (see 6.1) will list all pods in the cluster, across all namespaces. -Clicking on the drop-down arrow (see 6.2) will open up more detailed information of the specified pod. -![Fig 6 Pods](/images/theila-pods.png) diff --git a/website/content/v1.0/introduction/what-is-new.md b/website/content/v1.0/introduction/what-is-new.md deleted file mode 100644 index d59c1dff9..000000000 --- a/website/content/v1.0/introduction/what-is-new.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: What's New in Talos 1.0 -weight: 50 -description: "List of new and shiny features in Talos Linux." ---- - -## Announcements - -### GitHub Organization Change - -Talos Linux and other repositories were migrated from the `talos-systems` GitHub organization -to the `siderolabs` organization (github.com/talos-systems -> github.com/siderolabs). - -Existing Talos Linux container images (`installer`, `talos`, etc.) are mirrored across both organizations, -but all new images will only be available from `ghcr.io/siderolabs` going forward. - -For example, when upgrading Talos use `ghcr.io/siderolabs` instead of `ghcr.io/talos-systems`: - -```bash -talosctl upgrade --image ghcr.io/siderolabs/installer:v1.0.0 -``` - -## Extending Talos - -### System Extensions - -System extensions allow changes to the Talos root filesystem, and can be used to enable different features, including custom -container runtimes, additional firmware, among others. - -System extensions are only activated during Talos installation (or upgrade). -Even with system extensions installed, the Talos root filesystem is still immutable and read-only. - -Please see [extensions repository](https://github.com/talos-systems/extensions) and [documentation]({{< relref "../talos-guides/configuration/system-extensions/" >}}) for more information. - -### Extension Services - -Talos now provides a way to extend the system services that Talos runs with [extension services]({{< relref "../advanced/extension-services" >}}). -Extension services should be included in the Talos root filesystem (i.e. via system extensions). - -### Static Pods in the Machine Configuration - -Talos now accepts [static pod definitions]({{< relref "../advanced/static-pods" >}}) in the `.machine.pods` key of the machine configuration. -Please note that static pod definitions are not validated by Talos, and can be updated without a node reboot. - -## Kubernetes - -### Kubelet - -Kubelet configuration can now be overridden with the `.machine.kubelet.extraConfig` machine configuration field. -As most of the kubelet command line arguments are being deprecated, it is recommended to migrate to `extraConfig` -in place of using `extraArgs`. - -A number of conformance tweaks have been made to the `kubelet` to allow it to run without -`protectKernelDefaults`. -This includes both kubelet configuration options and sysctls. -Of particular note is that Talos now sets the `kernel.panic` reboot interval to 10s instead of 1s. -If your kubelet fails to start after the upgrade, please check the `kubelet` logs to determine the problem. - -Talos now performing a graceful kubelet shutdown by default on both node shutdown and reboot. -Default shutdown timeouts are 20s for regular priority pods and 10s for critical priority pods. -Timeouts can be overridden with the `.machine.kubelet.extraConfig` machine configuration keys: -`shutdownGracePeriod` and `shutdownGracePeriodCriticalPods`. - -### Admission Plugin Configuration - -Talos now supports the Kubernetes API server admission plugin configuration via the `.cluster.apiServer.admissionControl` machine configuration field. - -This configuration can be used to enable [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) plugin and -define cluster-wide default [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/). - -### Pod Security Policy - -The Pod Security Policy Kubernetes feature is deprecated and is going to be removed in Kubernetes 1.25. -Talos by default skips setting up PSP with this release (see machine configuration `.cluster.apiServer.disablePodSecurityPolicy`). - -### Pinned Kubernetes Version - -Command `talosctl gen config` now defaults to Kubernetes version pinning when generating machine configuration. -Previously the default was to omit an explicit Kubernetes version, so Talos picked up the default version it was built against. -Old behavior can be achieved by specifying empty flag value: `--kubernetes-version=`. - -### API Server Audit Logs - -`kube-apiserver` is now configured to store its audit logs separately from the `kube-apiserver` standard logs and log directly to file. -The `kube-apiserver` will maintain the rotation and retirement of these logs, which are stored in `/var/log/audit/`. -Previously, the audit logs were sent to the `kube-apiserver` `stdout` (along with the rest of its logs) to be collected in the usual manner by Kubernetes. - -## Machine Configuration - -Talos now preserves machine configuration byte-for-byte as it was submitted to the node. -This means that custom comments and overall machine configuration structure is now preserved. -This allows automation of machine configuration updates via an external mechanism without loss of information. - -### Patching Enhancements - -`talosctl` commands which accept JSON patches (i.e. `gen config`, `cluster create`, `patch machineconfig`) now support multiple patches, loading patches -from files with `@file.json` syntax, as well as support loading patches with a YAML format. - -### Apply Config Enhancements - -`talosctl apply/patch/edit` cli commands got revamped. -Separate flags `--on-reboot`, `--immediate`, `--interactive` were replaced -with a single `--mode` flag that can take the following values: - -- `auto` new mode that automatically applies the configuration in no-reboot/reboot mode based on the change. -- `no-reboot` force apply immediately, if that is not possible then it fails. -- `reboot` force reboot with applied config. -- `staged` write new machine configuration to [STATE]({{< relref "../learn-more/architecture/#file-system-partitions" >}}), but don't apply it (it will be applied after a reboot). -- `interactive` starts interactive installer, only for `apply`. - -## Networking - -### Early Boot `bond` Configuration - -Talos now supports setting a bond interface from the kernel cmdline using the [`bond=` option](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html) - -## Platforms - -### Equinix Metal - -`talos.platform` for [Equinix Metal]({{< relref "../talos-guides/install/bare-metal-platforms/equinix-metal" >}}) is renamed from `packet` to `equinixMetal`, the older name is still supported for backwards compatibility. - -### Oracle Cloud - -Talos now supports [Oracle Cloud]({{< relref "../talos-guides/install/cloud-platforms/oracle" >}}). - -### Network Configuration - -Platform network configuration was rewritten to avoid modifying Talos machine configuration. -Network configuration is performed independently of the machine configuration presence, so it works -even if Talos is booted into maintenance mode, and without machine configuration in the platform userdata. - -### SBCs - -Talos now supports [Jetson Nano SBC]({{< relref "../talos-guides/install/single-board-computers/jetson_nano" >}}). - -## Component Updates - -- Linux: 5.15.32 -- Kubernetes: 1.23.5 -- CoreDNS: 1.9.1 -- etcd: 3.5.2 -- containerd: 1.6.2 -- runc: 1.1.0 - -Talos is built with Go 1.17.8 - -## Hardware - -### NVIDIA GPU alpha Support - -Talos now has alpha support for NVIDIA GPU based workloads. -Check the [NVIDA GPU support guide]({{< relref "../talos-guides/configuration/nvidia-gpu" >}}) for details. - -## Miscellaneous - -### Sysfs Kernel Parameters - -Talos now supports setting `sysfs` kernel parameters (`/sys/...`). -Use machine configuration field `.machine.sysfs` to set `sysfs` kernel parameters. - -### Wipe System Kernel Parameter - -Talos added a new kernel parameter `talos.experimental.wipe=system` which can help resetting the system disk of the machine -and start over with a fresh installation. -See [Resetting a Machine]({{< relref "../talos-guides/resetting-a-machine#kernel-parameter" >}}) on how to use it. diff --git a/website/content/v1.0/introduction/what-is-talos.md b/website/content/v1.0/introduction/what-is-talos.md deleted file mode 100644 index d0b047d99..000000000 --- a/website/content/v1.0/introduction/what-is-talos.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: What is Talos? -weight: 10 -description: "A quick introduction in to what Talos is and why it should be used." ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v1.0/kubernetes-guides/_index.md b/website/content/v1.0/kubernetes-guides/_index.md deleted file mode 100644 index 1c9c43e36..000000000 --- a/website/content/v1.0/kubernetes-guides/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Kubernetes Guides" -weight: 30 -description: "Management of a Kubernetes Cluster hosted by Talos Linux" ---- diff --git a/website/content/v1.0/kubernetes-guides/configuration/_index.md b/website/content/v1.0/kubernetes-guides/configuration/_index.md deleted file mode 100644 index d44941272..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Configuration" -weight: 10 -description: "How to configure components of the Kubernetes cluster itself." ---- diff --git a/website/content/v1.0/kubernetes-guides/configuration/ceph-with-rook.md b/website/content/v1.0/kubernetes-guides/configuration/ceph-with-rook.md deleted file mode 100644 index 2e27232f5..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/ceph-with-rook.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: "Ceph Storage cluster with Rook" -description: "Guide on how to create a simple Ceph storage cluster with Rook for Kubernetes" -aliases: - - ../../guides/configuring-ceph-with-rook ---- - -## Preparation - -Talos Linux reserves an entire disk for the OS installation, so machines with multiple available disks are needed for a reliable Ceph cluster with Rook and Talos Linux. -Rook requires that the block devices or partitions used by Ceph have no partitions or formatted filesystems before use. -Rook also requires a minimum Kubernetes version of `v1.16` and Helm `v3.0` for installation of charts. -It is highly recommended that the [Rook Ceph overview](https://rook.io/docs/rook/v1.8/ceph-storage.html) is read and understood before deploying a Ceph cluster with Rook. - -## Installation - -Creating a Ceph cluster with Rook requires two steps; first the Rook Operator needs to be installed which can be done with a Helm Chart. -The example below installs the Rook Operator into the `rook-ceph` namespace, which is the default for a Ceph cluster with Rook. - -```shell -$ helm repo add rook-release https://charts.rook.io/release -"rook-release" has been added to your repositories - -$ helm install --create-namespace --namespace rook-ceph rook-ceph rook-release/rook-ceph -W0327 17:52:44.277830 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -W0327 17:52:44.612243 54987 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -NAME: rook-ceph -LAST DEPLOYED: Sun Mar 27 17:52:42 2022 -NAMESPACE: rook-ceph -STATUS: deployed -REVISION: 1 -TEST SUITE: None -NOTES: -The Rook Operator has been installed. Check its status by running: - kubectl --namespace rook-ceph get pods -l "app=rook-ceph-operator" - -Visit https://rook.io/docs/rook/latest for instructions on how to create and configure Rook clusters - -Important Notes: -- You must customize the 'CephCluster' resource in the sample manifests for your cluster. -- Each CephCluster must be deployed to its own namespace, the samples use `rook-ceph` for the namespace. -- The sample manifests assume you also installed the rook-ceph operator in the `rook-ceph` namespace. -- The helm chart includes all the RBAC required to create a CephCluster CRD in the same namespace. -- Any disk devices you add to the cluster in the 'CephCluster' must be empty (no filesystem and no partitions). -``` - -Once that is complete, the Ceph cluster can be installed with the official Helm Chart. -The Chart can be installed with default values, which will attempt to use all nodes in the Kubernetes cluster, and all unused disks on each node for Ceph storage, and make available block storage, object storage, as well as a shared filesystem. -Generally more specific node/device/cluster configuration is used, and the [Rook documentation](https://rook.io/docs/rook/v1.8/ceph-cluster-crd.html) explains all the available options in detail. -For this example the defaults will be adequate. - -```shell -$ helm install --create-namespace --namespace rook-ceph rook-ceph-cluster --set operatorNamespace=rook-ceph rook-release/rook-ceph-cluster -NAME: rook-ceph-cluster -LAST DEPLOYED: Sun Mar 27 18:12:46 2022 -NAMESPACE: rook-ceph -STATUS: deployed -REVISION: 1 -TEST SUITE: None -NOTES: -The Ceph Cluster has been installed. Check its status by running: - kubectl --namespace rook-ceph get cephcluster - -Visit https://rook.github.io/docs/rook/latest/ceph-cluster-crd.html for more information about the Ceph CRD. - -Important Notes: -- You can only deploy a single cluster per namespace -- If you wish to delete this cluster and start fresh, you will also have to wipe the OSD disks using `sfdisk` -``` - -Now the Ceph cluster configuration has been created, the Rook operator needs time to install the Ceph cluster and bring all the components online. -The progression of the Ceph cluster state can be followed with the following command. - -```shell -$ watch kubectl --namespace rook-ceph get cephcluster rook-ceph -Every 2.0s: kubectl --namespace rook-ceph get cephcluster rook-ceph - -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 57s Progressing Configuring Ceph Mons -``` - -Depending on the size of the Ceph cluster and the availability of resources the Ceph cluster should become available, and with it the storage classes that can be used with Kubernetes Physical Volumes. - -```shell -$ kubectl --namespace rook-ceph get cephcluster rook-ceph -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 40m Ready Cluster created successfully HEALTH_OK - -$ kubectl get storageclass -NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE -ceph-block (default) rook-ceph.rbd.csi.ceph.com Delete Immediate true 77m -ceph-bucket rook-ceph.ceph.rook.io/bucket Delete Immediate false 77m -ceph-filesystem rook-ceph.cephfs.csi.ceph.com Delete Immediate true 77m -``` - -## Talos Linux Considerations - -It is important to note that a Rook Ceph cluster saves cluster information directly onto the node (by default `dataDirHostPath` is set to `/var/lib/rook`). -If running only a single `mon` instance, cluster management is little bit more involved, as any time a Talos Linux node is reconfigured or upgraded, the partition that stores the `/var` [file system]({{< relref "../../learn-more/architecture#the-file-system" >}}) is wiped, but the `--preserve` option of [`talosctl upgrade`]({{< relref "../../reference/cli#talosctl-upgrade" >}}) will ensure that doesn't happen. - -By default, Rook configues Ceph to have 3 `mon` instances, in which case the data stored in `dataDirHostPath` can be regenerated from the other `mon` instances. -So when performing maintenance on a Talos Linux node with a Rook Ceph cluster (e.g. upgrading the Talos Linux version), it is imperative that care be taken to maintain the health of the Ceph cluster. -Before upgrading, you should always check the health status of the Ceph cluster to ensure that it is healthy. - -```shell -$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io rook-ceph -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 98m Ready Cluster created successfully HEALTH_OK -``` - -If it is, you can begin the upgrade process for the Talos Linux node, during which time the Ceph cluster will become unhealthy as the node is reconfigured. -Before performing any other action on the Talos Linux nodes, the Ceph cluster must return to a healthy status. - -```shell -$ talosctl upgrade --nodes 172.20.15.5 --image ghcr.io/talos-systems/installer:v0.14.3 -NODE ACK STARTED -172.20.15.5 Upgrade request received 2022-03-27 20:29:55.292432887 +0200 CEST m=+10.050399758 - -$ kubectl --namespace rook-ceph get cephclusters.ceph.rook.io -NAME DATADIRHOSTPATH MONCOUNT AGE PHASE MESSAGE HEALTH EXTERNAL -rook-ceph /var/lib/rook 3 99m Progressing Configuring Ceph Mgr(s) HEALTH_WARN - -$ kubectl --namespace rook-ceph wait --timeout=1800s --for=jsonpath='{.status.ceph.health}=HEALTH_OK' rook-ceph -cephcluster.ceph.rook.io/rook-ceph condition met -``` - -The above steps need to be performed for each Talos Linux node undergoing maintenance, one at a time. - -## Cleaning Up - -### Rook Ceph Cluster Removal - -Removing a Rook Ceph cluster requires a few steps, starting with signalling to Rook that the Ceph cluster is really being destroyed. -Then all Persistent Volumes (and Claims) backed by the Ceph cluster must be deleted, followed by the Storage Classes and the Ceph storage types. - -```shell -$ kubectl --namespace rook-ceph patch cephcluster rook-ceph --type merge -p '{"spec":{"cleanupPolicy":{"confirmation":"yes-really-destroy-data"}}}' -cephcluster.ceph.rook.io/rook-ceph patched - -$ kubectl delete storageclasses ceph-block ceph-bucket ceph-filesystem -storageclass.storage.k8s.io "ceph-block" deleted -storageclass.storage.k8s.io "ceph-bucket" deleted -storageclass.storage.k8s.io "ceph-filesystem" deleted - -$ kubectl --namespace rook-ceph delete cephblockpools ceph-blockpool -cephblockpool.ceph.rook.io "ceph-blockpool" deleted - -$ kubectl --namespace rook-ceph delete cephobjectstore ceph-objectstore -cephobjectstore.ceph.rook.io "ceph-objectstore" deleted - -$ kubectl --namespace rook-ceph delete cephfilesystem ceph-filesystem -cephfilesystem.ceph.rook.io "ceph-filesystem" deleted -``` - -Once that is complete, the Ceph cluster itself can be removed, along with the Rook Ceph cluster Helm chart installation. - -```shell -$ kubectl --namespace rook-ceph delete cephcluster rook-ceph -cephcluster.ceph.rook.io "rook-ceph" deleted - -$ helm --namespace rook-ceph uninstall rook-ceph-cluster -release "rook-ceph-cluster" uninstalled -``` - -If needed, the Rook Operator can also be removed along with all the Custom Resource Definitions that it created. - -```shell -$ helm --namespace rook-ceph uninstall rook-ceph -W0328 12:41:14.998307 147203 warnings.go:70] policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ -These resources were kept due to the resource policy: -[CustomResourceDefinition] cephblockpools.ceph.rook.io -[CustomResourceDefinition] cephbucketnotifications.ceph.rook.io -[CustomResourceDefinition] cephbuckettopics.ceph.rook.io -[CustomResourceDefinition] cephclients.ceph.rook.io -[CustomResourceDefinition] cephclusters.ceph.rook.io -[CustomResourceDefinition] cephfilesystemmirrors.ceph.rook.io -[CustomResourceDefinition] cephfilesystems.ceph.rook.io -[CustomResourceDefinition] cephfilesystemsubvolumegroups.ceph.rook.io -[CustomResourceDefinition] cephnfses.ceph.rook.io -[CustomResourceDefinition] cephobjectrealms.ceph.rook.io -[CustomResourceDefinition] cephobjectstores.ceph.rook.io -[CustomResourceDefinition] cephobjectstoreusers.ceph.rook.io -[CustomResourceDefinition] cephobjectzonegroups.ceph.rook.io -[CustomResourceDefinition] cephobjectzones.ceph.rook.io -[CustomResourceDefinition] cephrbdmirrors.ceph.rook.io -[CustomResourceDefinition] objectbucketclaims.objectbucket.io -[CustomResourceDefinition] objectbuckets.objectbucket.io - -release "rook-ceph" uninstalled - -$ kubectl delete crds cephblockpools.ceph.rook.io cephbucketnotifications.ceph.rook.io cephbuckettopics.ceph.rook.io \ - cephclients.ceph.rook.io cephclusters.ceph.rook.io cephfilesystemmirrors.ceph.rook.io \ - cephfilesystems.ceph.rook.io cephfilesystemsubvolumegroups.ceph.rook.io \ - cephnfses.ceph.rook.io cephobjectrealms.ceph.rook.io cephobjectstores.ceph.rook.io \ - cephobjectstoreusers.ceph.rook.io cephobjectzonegroups.ceph.rook.io cephobjectzones.ceph.rook.io \ - cephrbdmirrors.ceph.rook.io objectbucketclaims.objectbucket.io objectbuckets.objectbucket.io -customresourcedefinition.apiextensions.k8s.io "cephblockpools.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephbucketnotifications.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephbuckettopics.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephclients.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephclusters.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystemmirrors.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystems.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephfilesystemsubvolumegroups.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephnfses.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectrealms.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectstores.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectstoreusers.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectzonegroups.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephobjectzones.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "cephrbdmirrors.ceph.rook.io" deleted -customresourcedefinition.apiextensions.k8s.io "objectbucketclaims.objectbucket.io" deleted -customresourcedefinition.apiextensions.k8s.io "objectbuckets.objectbucket.io" deleted -``` - -### Talos Linux Rook Metadata Removal - -If the Rook Operator is cleanly removed following the above process, the node metadata and disks should be clean and ready to be re-used. -In the case of an unclean cluster removal, there may be still a few instances of metadata stored on the system disk, as well as the partition information on the storage disks. -First the node metadata needs to be removed, make sure to update the `nodeName` with the actual name of a storage node that needs cleaning, and `path` with the Rook configuration `dataDirHostPath` set when installing the chart. -The following will need to be repeated for each node used in the Rook Ceph cluster. - -```shell -$ cat < - volumes: - - name: rook-data-dir - hostPath: - path: - containers: - - name: disk-clean - image: busybox - securityContext: - privileged: true - volumeMounts: - - name: rook-data-dir - mountPath: /node/rook-data - command: ["/bin/sh", "-c", "rm -rf /node/rook-data/*"] -EOF -pod/disk-clean created - -$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-clean -pod/disk-clean condition met - -$ kubectl delete pod disk-clean -pod "disk-clean" deleted -``` - -Lastly, the disks themselves need the partition and filesystem data wiped before they can be reused. -Again, the following as to be repeated for each node **and** disk used in the Rook Ceph cluster, updating `nodeName` and `of=` in the `command` as needed. - -```shell -$ cat < - containers: - - name: disk-wipe - image: busybox - securityContext: - privileged: true - command: ["/bin/sh", "-c", "dd if=/dev/zero bs=1M count=100 oflag=direct of="] -EOF -pod/disk-wipe created - -$ kubectl wait --timeout=900s --for=jsonpath='{.status.phase}=Succeeded' pod disk-wipe -pod/disk-wipe condition met - -$ kubectl delete pod disk-clean -pod "disk-wipe" deleted -``` diff --git a/website/content/v1.0/kubernetes-guides/configuration/cluster-endpoint.md b/website/content/v1.0/kubernetes-guides/configuration/cluster-endpoint.md deleted file mode 100644 index 55e9a631d..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/cluster-endpoint.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: "Cluster Endpoint" -description: "How to explicitly set up an endpoint for the cluster API" -alises: - - ../../guides/configuring-the-cluster-endpoint ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip address to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. controlplane.yaml and worker.yaml. -> for more details, please see: [v1alpha1 endpoint configuration]({{< relref "../../reference/configuration#controlplaneconfig" >}}) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v1.0/kubernetes-guides/configuration/deploy-metrics-server.md b/website/content/v1.0/kubernetes-guides/configuration/deploy-metrics-server.md deleted file mode 100644 index 59986d423..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/deploy-metrics-server.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." -aliases: - - ../../guides/deploy-metrics-server ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v1.0/kubernetes-guides/configuration/discovery.md b/website/content/v1.0/kubernetes-guides/configuration/discovery.md deleted file mode 100644 index ff822c8b9..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/discovery.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: "Discovery" -description: "How to use Talos Linux cluster discovery" -aliases: - - ../../guides/discovery ---- - -## Video Walkthrough - -To see a live demo of Cluster Discovery, see the video below: - - - -## Registries - -Peers are aggregated from a number of optional registries. -By default, Talos will use the `kubernetes` and `service` registries. -Either one can be disabled. -To disable a registry, set `disabled` to `true` (this option is the same for all registries): -For example, to disable the `service` registry: - -```yaml -cluster: - discovery: - enabled: true - registries: - service: - disabled: true -``` - -Disabling all registries effectively disables member discovery altogether. - -> Talos supports the `kubernetes` and `service` registries. - -`Kubernetes` registry uses Kubernetes `Node` resource data and additional Talos annotations: - -```sh -$ kubectl describe node -Annotations: cluster.talos.dev/node-id: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd - networking.talos.dev/assigned-prefixes: 10.244.0.0/32,10.244.0.1/24 - networking.talos.dev/self-ips: 172.20.0.2,fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94 -... -``` - -`Service` registry uses external [Discovery Service]({{< relref "../../learn-more/discovery/" >}}) to exchange encrypted information about cluster members. - -## Resource Definitions - -Talos provides seven resources that can be used to introspect the new discovery and KubeSpan features. - -### Discovery - -#### Identities - -The node's unique identity (base62 encoded random 32 bytes) can be obtained with: - -> Note: Using base62 allows the ID to be URL encoded without having to use the ambiguous URL-encoding version of base64. - -```sh -$ talosctl get identities -o yaml -... -spec: - nodeId: Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd -``` - -Node identity is used as the unique `Affiliate` identifier. - -Node identity resource is preserved in the [STATE]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) partition in `node-identity.yaml` file. -Node identity is preserved across reboots and upgrades, but it is regenerated if the node is reset (wiped). - -#### Affiliates - -An affiliate is a proposed member attributed to the fact that the node has the same cluster ID and secret. - -```sh -$ talosctl get affiliates -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 2 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -Utoh3O0ZneV0kT2IUBrh7TgdouRcUW2yzaaMl4VXnCd 4 talos-default-master-1 controlplane ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 2 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -One of the `Affiliates` with the `ID` matching node identity is populated from the node data, other `Affiliates` are pulled from the registries. -Enabled discovery registries run in parallel and discovered data is merged to build the list presented above. - -Details about data coming from each registry can be queried from the `cluster-raw` namespace: - -```sh -$ talosctl get affiliates --namespace=cluster-raw -ID VERSION HOSTNAME MACHINE TYPE ADDRESSES -k8s/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 3 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -k8s/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 2 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -k8s/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 2 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -k8s/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 3 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -service/2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF 23 talos-default-master-2 controlplane ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -service/6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA 26 talos-default-worker-1 worker ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -service/NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB 20 talos-default-worker-2 worker ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -service/b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C 14 talos-default-master-3 controlplane ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -``` - -Each `Affiliate` ID is prefixed with `k8s/` for data coming from the Kubernetes registry and with `service/` for data coming from the discovery service. - -#### Members - -A member is an affiliate that has been approved to join the cluster. -The members of the cluster can be obtained with: - -```sh -$ talosctl get members -ID VERSION HOSTNAME MACHINE TYPE OS ADDRESSES -talos-default-master-1 2 talos-default-master-1 controlplane Talos ({{< release >}}) ["172.20.0.2","fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94"] -talos-default-master-2 1 talos-default-master-2 controlplane Talos ({{< release >}}) ["172.20.0.3","fd83:b1f7:fcb5:2802:986b:7eff:fec5:889d"] -talos-default-master-3 1 talos-default-master-3 controlplane Talos ({{< release >}}) ["172.20.0.4","fd83:b1f7:fcb5:2802:248f:1fff:fe5c:c3f"] -talos-default-worker-1 1 talos-default-worker-1 worker Talos ({{< release >}}) ["172.20.0.5","fd83:b1f7:fcb5:2802:cc80:3dff:fece:d89d"] -talos-default-worker-2 1 talos-default-worker-2 worker Talos ({{< release >}}) ["172.20.0.6","fd83:b1f7:fcb5:2802:2805:fbff:fe80:5ed2"] -``` diff --git a/website/content/v1.0/kubernetes-guides/configuration/pod-security.md b/website/content/v1.0/kubernetes-guides/configuration/pod-security.md deleted file mode 100644 index f102e1460..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/pod-security.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: "Pod Security" -description: "Enabling Pod Security Admission plugin to configure Pod Security Standards." -aliases: - - ../../guides/pod-security ---- - -Kubernetes deprecated [Pod Security Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) as of v1.21, and it is -going to be removed in v1.25. -Pod Security Policy was replaced with [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/). -Pod Security Admission is alpha in v1.22 (requires a feature gate) and beta in v1.23 (enabled by default). - -In this guide we are going to enable and configure Pod Security Admission in Talos. - -## Configuration - -Prepare the following machine configuration patch and store it in the `pod-security-patch.yaml`: - -```yaml -- op: add - path: /cluster/apiServer/admissionControl - value: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - kind: PodSecurityConfiguration - defaults: - enforce: "baseline" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" - exemptions: - usernames: [] - runtimeClasses: [] - namespaces: [kube-system] -``` - -This is a cluster-wide configuration for the Pod Security Admission plugin: - -* by default `baseline` [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/) profile is enforced -* more strict `restricted` profile is not enforced, but API server warns about found issues - -Generate Talos machine configuration applying the patch above: - -```shell -talosctl gen config cluster1 https://:6443/ --config-patch-control-plane @../pod-security-patch.yaml -``` - -Deploy Talos using the generated machine configuration. - -Verify current admission plugin configuration with: - -```shell -$ talosctl get kubernetescontrolplaneconfigs apiserver-admission-control -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: apiserver-admission-control - version: 1 - owner: config.K8sControlPlaneController - phase: running - created: 2022-02-22T20:28:21Z - updated: 2022-02-22T20:28:21Z -spec: - config: - - name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration -``` - -## Usage - -Create a deployment that satisfies the `baseline` policy but gives warnings on `restricted` policy: - -```shell -$ kubectl create deployment nginx --image=nginx -Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") -deployment.apps/nginx created -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -nginx-85b98978db-j68l8 1/1 Running 0 2m3s -``` - -Create a daemonset which fails to meet requirements of the `baseline` policy: - -```yaml -apiVersion: apps/v1 -kind: DaemonSet -metadata: - labels: - app: debug-container - name: debug-container - namespace: default -spec: - revisionHistoryLimit: 10 - selector: - matchLabels: - app: debug-container - template: - metadata: - creationTimestamp: null - labels: - app: debug-container - spec: - containers: - - args: - - "360000" - command: - - /bin/sleep - image: ubuntu:latest - imagePullPolicy: IfNotPresent - name: debug-container - resources: {} - securityContext: - privileged: true - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirstWithHostNet - hostIPC: true - hostPID: true - hostNetwork: true - restartPolicy: Always - schedulerName: default-scheduler - securityContext: {} - terminationGracePeriodSeconds: 30 - updateStrategy: - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - type: RollingUpdate -``` - -```shell -$ kubectl apply -f debug.yaml -Warning: would violate PodSecurity "restricted:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "debug-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "debug-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "debug-container" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "debug-container" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") -daemonset.apps/debug-container created -``` - -Daemonset `debug-container` gets created, but no pods are scheduled: - -```shell -$ kubectl get ds -NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE -debug-container 0 0 0 0 0 34s -``` - -Pod Security Admission plugin errors are in the daemonset events: - -```shell -$ kubectl describe ds debug-container -... - Warning FailedCreate 92s daemonset-controller Error creating: pods "debug-container-kwzdj" is forbidden: violates PodSecurity "baseline:latest": host namespaces (hostNetwork=true, hostPID=true, hostIPC=true), privileged (container "debug-container" must not set securityContext.privileged=true) -``` - -Pod Security Admission configuration can also be overridden on a namespace level: - -```shell -$ kubectl label ns default pod-security.kubernetes.io/enforce=privileged -namespace/default labeled -$ kubectl get ds -NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE -debug-container 2 2 0 2 0 4s -``` - -As enforce policy was updated to the `privileged` for the `default` namespace, `debug-container` is now successfully running. diff --git a/website/content/v1.0/kubernetes-guides/configuration/storage.md b/website/content/v1.0/kubernetes-guides/configuration/storage.md deleted file mode 100644 index 30f143a1b..000000000 --- a/website/content/v1.0/kubernetes-guides/configuration/storage.md +++ /dev/null @@ -1,141 +0,0 @@ ---- -title: "Storage" -description: "Setting up storage for a Kubernetes cluster" -aliases: - - ../../guides/storage ---- - -In Kubernetes, using storage in the right way is well-facilitated by the API. -However, unless you are running in a major public cloud, that API may not be hooked up to anything. -This frequently sends users down a rabbit hole of researching all the various options for storage backends for their platform, for Kubernetes, and for their workloads. -There are a _lot_ of options out there, and it can be fairly bewildering. - -For Talos, we try to limit the options somewhat to make the decision-making easier. - -## Public Cloud - -If you are running on a major public cloud, use their block storage. -It is easy and automatic. - -## Storage Clusters - -> **Sidero Labs** recommends having separate disks (apart from the Talos install disk) to be used for storage. - -Redundancy, scaling capabilities, reliability, speed, maintenance load, and ease of use are all factors you must consider when managing your own storage. - -Running a storage cluster can be a very good choice when managing your own storage, and there are two projects we recommend, depending on your situation. - -If you need vast amounts of storage composed of more than a dozen or so disks, we recommend you use Rook to manage Ceph. -Also, if you need _both_ mount-once _and_ mount-many capabilities, Ceph is your answer. -Ceph also bundles in an S3-compatible object store. -The down side of Ceph is that there are a lot of moving parts. - -> Please note that _most_ people should _never_ use mount-many semantics. -> NFS is pervasive because it is old and easy, _not_ because it is a good idea. -> While it may seem like a convenience at first, there are all manner of locking, performance, change control, and reliability concerns inherent in _any_ mount-many situation, so we **strongly** recommend you avoid this method. - -If your storage needs are small enough to not need Ceph, use Mayastor. - -### Rook/Ceph - -[Ceph](https://ceph.io) is the grandfather of open source storage clusters. -It is big, has a lot of pieces, and will do just about anything. -It scales better than almost any other system out there, open source or proprietary, being able to easily add and remove storage over time with no downtime, safely and easily. -It comes bundled with RadosGW, an S3-compatible object store; CephFS, a NFS-like clustered filesystem; and RBD, a block storage system. - -With the help of [Rook](https://rook.io), the vast majority of the complexity of Ceph is hidden away by a very robust operator, allowing you to control almost everything about your Ceph cluster from fairly simple Kubernetes CRDs. - -So if Ceph is so great, why not use it for everything? - -Ceph can be rather slow for small clusters. -It relies heavily on CPUs and massive parallelisation to provide good cluster performance, so if you don't have much of those dedicated to Ceph, it is not going to be well-optimised for you. -Also, if your cluster is small, just running Ceph may eat up a significant amount of the resources you have available. - -Troubleshooting Ceph can be difficult if you do not understand its architecture. -There are lots of acronyms and the documentation assumes a fair level of knowledge. -There are very good tools for inspection and debugging, but this is still frequently seen as a concern. - -### Mayastor - -[Mayastor](https://github.com/openebs/Mayastor) is an OpenEBS project built in Rust utilising the modern NVMEoF system. -(Despite the name, Mayastor does _not_ require you to have NVME drives.) -It is fast and lean but still cluster-oriented and cloud native. -Unlike most of the other OpenEBS project, it is _not_ built on the ancient iSCSI system. - -Unlike Ceph, Mayastor is _just_ a block store. -It focuses on block storage and does it well. -It is much less complicated to set up than Ceph, but you probably wouldn't want to use it for more than a few dozen disks. - -Mayastor is new, maybe _too_ new. -If you're looking for something well-tested and battle-hardened, this is not it. -However, if you're looking for something lean, future-oriented, and simpler than Ceph, it might be a great choice. - -#### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -#### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -(This information is gathered from the Mayastor [documentation](https://mayastor.gitbook.io/introduction/quickstart/preparing-the-cluster).) -We need to set the `vm.nr_hugepages` sysctl and add `openebs.io/engine=mayastor` labels to the nodes which are meant to be storage nodes. -This can be done with `talosctl patch machineconfig` or via config patches during `talosctl gen config`. - -Some examples are shown below: modify as needed. - -Using gen config - -```bash -talosctl gen config my-cluster https://mycluster.local:6443 --config-patch '[{"op": "add", "path": "/machine/sysctls", "value": {"vm.nr_hugepages": "1024"}}, {"op": "add", "path": "/machine/kubelet/extraArgs", "value": {"node-labels": "openebs.io/engine=mayastor"}}]' -``` - -Patching an existing node - -```bash -talosctl patch --mode=no-reboot machineconfig -n --patch '[{"op": "add", "path": "/machine/sysctls", "value": {"vm.nr_hugepages": "1024"}}, {"op": "add", "path": "/machine/kubelet/extraArgs", "value": {"node-labels": "openebs.io/engine=mayastor"}}]' -``` - -> Note: If you are adding/updating the `vm.nr_hugepages` on a node which already had the `openebs.io/engine=mayastor` label set, you'd need to restart kubelet so that it picks up the new value, by issuing the following command - -```bash -talosctl -n service kubelet restart -``` - -#### Deploy Mayastor - -Continue setting up [Mayastor](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) using the official documentation. - -## NFS - -NFS is an old pack animal long past its prime. -NFS is slow, has all kinds of bottlenecks involving contention, distributed locking, single points of service, and more. -However, it is supported by a wide variety of systems. -You don't want to use it unless you have to, but unfortunately, that "have to" is too frequent. - -The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. -This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. -You can reduce some of the contention problems by parceling Persistent Volumes from separate underlying directories. - -## Object storage - -Ceph comes with an S3-compatible object store, but there are other options, as -well. -These can often be built on top of other storage backends. -For instance, you may have your block storage running with Mayastor but assign a -Pod a large Persistent Volume to serve your object store. - -One of the most popular open source add-on object stores is [MinIO](https://min.io/). - -## Others (iSCSI) - -The most common remaining systems involve iSCSI in one form or another. -These include the original OpenEBS, Rancher's Longhorn, and many proprietary systems. -Unfortunately, Talos does _not_ support iSCSI-based systems. -iSCSI in Linux is facilitated by [open-iscsi](https://github.com/open-iscsi/open-iscsi). -This system was designed long before containers caught on, and it is not well -suited to the task, especially when coupled with a read-only host operating -system. - -One day, we hope to work out a solution for facilitating iSCSI-based systems, but this is not yet available. diff --git a/website/content/v1.0/kubernetes-guides/network/_index.md b/website/content/v1.0/kubernetes-guides/network/_index.md deleted file mode 100644 index 420161673..000000000 --- a/website/content/v1.0/kubernetes-guides/network/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Network" -weight: 20 -description: "Managing the Kubernetes cluster networking" ---- diff --git a/website/content/v1.0/kubernetes-guides/network/deploying-cilium.md b/website/content/v1.0/kubernetes-guides/network/deploying-cilium.md deleted file mode 100644 index 7579ea996..000000000 --- a/website/content/v1.0/kubernetes-guides/network/deploying-cilium.md +++ /dev/null @@ -1,209 +0,0 @@ ---- -title: "Deploying Cilium CNI" -description: "In this guide you will learn how to set up Cilium CNI on Talos." -aliases: - - ../../guides/deploying-cilium ---- - -From v1.9 onwards Cilium does no longer provide a one-liner install manifest that can be used to install Cilium on a node via `kubectl apply -f` or passing it in as an extra url in the `urls` part in the Talos machine configuration. - -> Installing Cilium the new way via the `cilium` cli is broken, so we'll be using `helm` to install Cilium. -For more information: [Install with CLI fails, works with Helm](https://github.com/cilium/cilium-cli/issues/505) - -Refer to [Installing with Helm](https://docs.cilium.io/en/v1.11/gettingstarted/k8s-install-helm/) for more information. - -First we'll need to add the helm repo for Cilium. - -```bash -helm repo add cilium https://helm.cilium.io/ -helm repo update -``` - -This documentation will outline installing Cilium CNI v1.11.2 on Talos in four different ways. -Adhering to Talos principles we'll deploy Cilium with IPAM mode set to Kubernetes. -Each method can either install Cilium using kube proxy (default) or without: [Kubernetes Without kube-proxy](https://docs.cilium.io/en/v1.11/gettingstarted/kubeproxy-free/) - -## Machine config preparation - -When generating the machine config for a node set the CNI to none. -For example using a config patch: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -Or if you want to deploy Cilium in strict mode without kube-proxy, you also need to disable kube proxy: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op": "add", "path": "/cluster/proxy", "value": {"disabled": true}}, {"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -## Method 1: Helm install - -After applying the machine config and bootstrapping Talos will appear to hang on phase 18/19 with the message: retrying error: node not ready. -This happens because nodes in Kubernetes are only marked as ready once the CNI is up. -As there is no CNI defined, the boot process is pending and will reboot the node to retry after 10 minutes, this is expected behavior. - -During this window you can install Cilium manually by running the following: - -```bash -helm install cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes -``` - -Or if you want to deploy Cilium in strict mode without kube-proxy, also set some extra paramaters: - -```bash -export KUBERNETES_API_SERVER_ADDRESS=<> -export KUBERNETES_API_SERVER_PORT=6443 - -helm install cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes \ - --set kubeProxyReplacement=strict \ - --set k8sServiceHost="${KUBERNETES_API_SERVER_ADDRESS}" \ - --set k8sServicePort="${KUBERNETES_API_SERVER_PORT}" -``` - -After Cilium is installed the boot process should continue and complete successfully. - -## Method 2: Helm manifests install - -Instead of directly installing Cilium you can instead first generate the manifest and then apply it: - -```bash -helm template cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes > cilium.yaml - -kubectl apply -f cilium.yaml -``` - -Without kube-proxy: - -```bash -export KUBERNETES_API_SERVER_ADDRESS=<> -export KUBERNETES_API_SERVER_PORT=6443 - -helm template cilium cilium/cilium \ - --version 1.11.2 \ - --namespace kube-system \ - --set ipam.mode=kubernetes \ - --set kubeProxyReplacement=strict \ - --set k8sServiceHost="${KUBERNETES_API_SERVER_ADDRESS}" \ - --set k8sServicePort="${KUBERNETES_API_SERVER_PORT}" > cilium.yaml - -kubectl apply -f cilium.yaml -``` - -## Method 3: Helm manifests hosted install - -After generating `cilium.yaml` using `helm template`, instead of applying this manifest directly during the Talos boot window (before the reboot timeout). -You can also host this file somewhere and patch the machine config to apply this manifest automatically during bootstrap. -To do this patch your machine configuration to include this config instead of the above: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "custom", "urls": ["https://server.yourdomain.tld/some/path/cilium.yaml"]}}]' -``` - -Resulting in a config that look like this: - -``` yaml -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://server.yourdomain.tld/some/path/cilium.yaml -``` - -However, beware of the fact that the helm generated Cilium manifest contains sensitive key material. -As such you should definitely not host this somewhere publicly accessible. - -## Method 4: Helm manifests inline install - -A more secure option would be to include the `helm template` output manifest inside the machine configuration. -The machine config should be generated with CNI set to `none` - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -if deploying Cilium with `kube-proxy` disabled, you can also include the following: - -```bash -talosctl gen config \ - my-cluster https://mycluster.local:6443 \ - --config-patch '[{"op": "add", "path": "/cluster/proxy", "value": {"disabled": true}}, {"op":"add", "path": "/cluster/network/cni", "value": {"name": "none"}}]' -``` - -To do so patch this into your machine configuration: - -``` yaml -cluster: - inlineManifests: - - name: cilium - contents: | - -- - # Source: cilium/templates/cilium-agent/serviceaccount.yaml - apiVersion: v1 - kind: ServiceAccount - metadata: - name: "cilium" - namespace: kube-system - --- - # Source: cilium/templates/cilium-operator/serviceaccount.yaml - apiVersion: v1 - kind: ServiceAccount - -> Your cilium.yaml file will be pretty long.... -``` - -This will install the Cilium manifests at just the right time during bootstrap. - -Beware though: - -- Changing the namespace when templating with Helm does not generate a manifest containing the yaml to create that namespace. -As the inline manifest is processed from top to bottom make sure to manually put the namespace yaml at the start of the inline manifest. -- Only add the Cilium inline manifest to the control plane nodes machine configuration. -- Make sure all control plane nodes have an identical configuration. -- If you delete any of the generated resources they will be restored whenever a control plane node reboots. -- As a safety measure, Talos only creates missing resources from inline manifests, it never deletes or updates anything. -- If you need to update a manifest make sure to first edit all control plane machine configurations and then run `talosctl upgrade-k8s` as it will take care of updating inline manifests. - -## Known issues - -- Currently there is an interaction between a Kubespan enabled Talos cluster and Cilium that results in the cluster going down during bootstrap after applying the Cilium manifests. -For more details: [Kubespan and Cilium compatiblity: etcd is failing](https://github.com/siderolabs/talos/issues/4836) - -- There are some gotchas when using Talos and Cilium on the Google cloud platform when using internal load balancers. -For more details: [GCP ILB support / support scope local routes to be configured](https://github.com/siderolabs/talos/issues/4109) - -- Some kernel values changed by kube-proxy are not set to good defaults when running the cilium kernel-proxy alternative. -For more details: [Kernel default values (sysctl)](https://github.com/siderolabs/talos/issues/4654) - -## Other things to know - -- Talos has full kernel module support for eBPF, See: - - [Cilium System Requirements](https://docs.cilium.io/en/v1.11/operations/system_requirements/) - - [Talos Kernel Config AMD64](https://github.com/talos-systems/pkgs/blob/master/kernel/build/config-amd64) - - [Talos Kernel Config ARM64](https://github.com/talos-systems/pkgs/blob/master/kernel/build/config-arm64) - -- Talos also includes the modules: - - - `CONFIG_NETFILTER_XT_TARGET_TPROXY=m` - - `CONFIG_NETFILTER_XT_TARGET_CT=m` - - `CONFIG_NETFILTER_XT_MATCH_MARK=m` - - `CONFIG_NETFILTER_XT_MATCH_SOCKET=m` - - This allows you to set `--set enableXTSocketFallback=false` on the helm install/template command preventing Cilium from disabling the `ip_early_demux` kernel feature. -This will win back some performance. diff --git a/website/content/v1.0/kubernetes-guides/network/kubespan.md b/website/content/v1.0/kubernetes-guides/network/kubespan.md deleted file mode 100644 index 0412e72e8..000000000 --- a/website/content/v1.0/kubernetes-guides/network/kubespan.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: "KubeSpan" -description: "Learn to use KubeSpan to connect Talos Linux machines securely across networks." -aliases: - - ../../guides/kubespan ---- - -KubeSpan is a feature of Talos that automates the setup and maintenance of a full mesh [WireGuard](https://www.wireguard.com) network for your cluster, giving you the ability to operate hybrid Kubernetes clusters that can span the edge, datacenter, and cloud. -Management of keys and discovery of peers can be completely automated for a zero-touch experience that makes it simple and easy to create hybrid clusters. - -KubeSpan consists of client code in Talos Linux, as well as a discovery service that enables clients to securely find each other. -Sidero Labs operates a free Discovery Service, but the discovery service may be operated by your organization and can be [downloaded here](https://github.com/siderolabs/discovery-service). - -## Video Walkthrough - -To learn more about KubeSpan, see the video below: - - - -To see a live demo of KubeSpan, see one the videos below: - - - - - -## Enabling - -### Creating a New Cluster - -To generate configuration files for a new cluster, we can use the `--with-kubespan` flag in `talosctl gen config`. -This will enable peer discovery and KubeSpan. - -```yaml -... - # Provides machine specific network configuration options. - network: - # Configures KubeSpan feature. - kubespan: - enabled: true # Enable the KubeSpan feature. -... - # Configures cluster member discovery. - discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: {} -... -# Provides cluster specific configuration options. -cluster: - id: yui150Ogam0pdQoNZS2lZR-ihi8EWxNM17bZPktJKKE= # Globally unique identifier for this cluster. - secret: dAmFcyNmDXusqnTSkPJrsgLJ38W8oEEXGZKM0x6Orpc= # Shared secret of cluster. -``` - -> The default discovery service is an external service hosted for free by Sidero Labs. -> The default value is `https://discovery.talos.dev/`. -> Contact Sidero Labs if you need to run this service privately. - -### Upgrading an Existing Cluster - -In order to enable KubeSpan for an existing cluster, upgrade to the latest version of Talos ({{< release >}}). -Once your cluster is upgraded, the configuration of each node must contain the globally unique identifier, the shared secret for the cluster, and have KubeSpan and discovery enabled. - -> Note: Discovery can be used without KubeSpan, but KubeSpan requires at least one discovery registry. - -#### Talos v0.11 or Less - -If you are migrating from Talos v0.11 or less, we need to generate a cluster ID and secret. - -To generate an `id`: - -```sh -$ openssl rand -base64 32 -EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= -``` - -To generate a `secret`: - -```sh -$ openssl rand -base64 32 -AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -Now, update the configuration of each node with the cluster with the generated `id` and `secret`. -You should end up with the addition of something like this (your `id` and `secret` should be different): - -```yaml -cluster: - id: EUsCYz+oHNuBppS51P9aKSIOyYvIPmbZK944PWgiyMQ= - secret: AbdsWjY9i797kGglghKvtGdxCsdllX9CemLq+WGVeaw= -``` - -> Note: This can be applied in immediate mode (no reboot required). - -#### Talos v0.12 or More - -Enable `kubespan` and `discovery`. - -```yaml -machine: - network: - kubespan: - enabled: true -cluster: - discovery: - enabled: true -``` - -## Resource Definitions - -### KubeSpanIdentities - -A node's WireGuard identities can be obtained with: - -```sh -$ talosctl get kubespanidentities -o yaml -... -spec: - address: fd83:b1f7:fcb5:2802:8c13:71ff:feaf:7c94/128 - subnet: fd83:b1f7:fcb5:2802::/64 - privateKey: gNoasoKOJzl+/B+uXhvsBVxv81OcVLrlcmQ5jQwZO08= - publicKey: NzW8oeIH5rJyY5lefD9WRoHWWRr/Q6DwsDjMX+xKjT4= -``` - -Talos automatically configures unique IPv6 address for each node in the cluster-specific IPv6 ULA prefix. - -Wireguard private key is generated for the node, private key never leaves the node while public key is published through the cluster discovery. - -`KubeSpanIdentity` is persisted across reboots and upgrades in [STATE]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) partition in the file `kubespan-identity.yaml`. - -### KubeSpanPeerSpecs - -A node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerspecs -ID VERSION LABEL ENDPOINTS -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 2 talos-default-master-2 ["172.20.0.3:51820"] -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 2 talos-default-master-3 ["172.20.0.4:51820"] -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 2 talos-default-worker-2 ["172.20.0.6:51820"] -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 2 talos-default-worker-1 ["172.20.0.5:51820"] -``` - -The peer ID is the Wireguard public key. -`KubeSpanPeerSpecs` are built from the cluster discovery data. - -### KubeSpanPeerStatuses - -The status of a node's WireGuard peers can be obtained with: - -```sh -$ talosctl get kubespanpeerstatuses -ID VERSION LABEL ENDPOINT STATE RX TX -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 63 talos-default-master-2 172.20.0.3:51820 up 15043220 17869488 -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 62 talos-default-master-3 172.20.0.4:51820 up 14573208 18157680 -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 60 talos-default-worker-2 172.20.0.6:51820 up 130072 46888 -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 60 talos-default-worker-1 172.20.0.5:51820 up 130044 46556 -``` - -KubeSpan peer status includes following information: - -* the actual endpoint used for peer communication -* link state: - * `unknown`: the endpoint was just changed, link state is not known yet - * `up`: there is a recent handshake from the peer - * `down`: there is no handshake from the peer -* number of bytes sent/received over the Wireguard link with the peer - -If the connection state goes `down`, Talos will be cycling through the available endpoints until it finds the one which works. - -Peer status information is updated every 30 seconds. - -### KubeSpanEndpoints - -A node's WireGuard endpoints (peer addresses) can be obtained with: - -```sh -$ talosctl get kubespanendpoints -ID VERSION ENDPOINT AFFILIATE ID -06D9QQOydzKrOL7oeLiqHy9OWE8KtmJzZII2A5/FLFI= 1 172.20.0.3:51820 2VfX3nu67ZtZPl57IdJrU87BMjVWkSBJiL9ulP9TCnF -THtfKtfNnzJs1nMQKs5IXqK0DFXmM//0WMY+NnaZrhU= 1 172.20.0.4:51820 b3DebkPaCRLTLLWaeRF1ejGaR0lK3m79jRJcPn0mfA6C -nVHu7l13uZyk0AaI1WuzL2/48iG8af4WRv+LWmAax1M= 1 172.20.0.6:51820 NVtfu1bT1QjhNq5xJFUZl8f8I8LOCnnpGrZfPpdN9WlB -zXP0QeqRo+CBgDH1uOBiQ8tA+AKEQP9hWkqmkE/oDlc= 1 172.20.0.5:51820 6EVq8RHIne03LeZiJ60WsJcoQOtttw1ejvTS6SOBzhUA -``` - -The endpoint ID is the base64 encoded WireGuard public key. - -The observed endpoints are submitted back to the discovery service (if enabled) so that other peers can try additional endpoints to establish the connection. diff --git a/website/content/v1.0/kubernetes-guides/upgrading-kubernetes.md b/website/content/v1.0/kubernetes-guides/upgrading-kubernetes.md deleted file mode 100644 index dcefadb50..000000000 --- a/website/content/v1.0/kubernetes-guides/upgrading-kubernetes.md +++ /dev/null @@ -1,349 +0,0 @@ ---- -title: "Upgrading Kubernetes" -description: "Guide on how to upgrade the Kubernetes cluster from Talos Linux." -aliases: - - guides/upgrading-kubernetes ---- - -This guide covers upgrading Kubernetes on Talos Linux clusters. -For upgrading the Talos Linux operating system, see [Upgrading Talos]({{< relref "../talos-guides/upgrading-talos" >}}) - -## Video Walkthrough - -To see a demo of this process, watch this video: - - - -## Automated Kubernetes Upgrade - -The recommended method to upgrade Kubernetes is to use the `talosctl upgrade-k8s` command. -This will automatically update the components needed to upgrade Kubernetes safely. -Upgrading Kubernetes is non-disruptive to the cluster workloads. - -To trigger a Kubernetes upgrade, issue a command specifiying the version of Kubernetes to ugprade to, such as: - -`talosctl --nodes upgrade-k8s --to {{< k8s_release >}}` - -Note that the `--nodes` parameter specifies the control plane node to send the API call to, but all members of the cluster will be upgraded. - -To check what will be upgraded you can run `talosctl upgrade-k8s` with the `--dry-run` flag: - -```bash -$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} --dry-run -WARNING: found resources which are going to be deprecated/migrated in the version {{< k8s_release >}} -RESOURCE COUNT -validatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 4 -mutatingwebhookconfigurations.v1beta1.admissionregistration.k8s.io 3 -customresourcedefinitions.v1beta1.apiextensions.k8s.io 25 -apiservices.v1beta1.apiregistration.k8s.io 54 -leases.v1beta1.coordination.k8s.io 4 -automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} -checking for resource APIs to be deprecated in version {{< k8s_release >}} -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -discovered worker nodes ["172.20.0.5" "172.20.0.6"] -updating "kube-apiserver" to version "{{< k8s_release >}}" - > "172.20.0.2": starting update - > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - > skipped in dry-run - > "172.20.0.3": starting update - > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - > skipped in dry-run - > "172.20.0.4": starting update - > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - > skipped in dry-run -updating "kube-controller-manager" to version "{{< k8s_release >}}" - > "172.20.0.2": starting update - > update kube-controller-manager: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - > skipped in dry-run - > "172.20.0.3": starting update - - - -updating manifests - > apply manifest Secret bootstrap-token-3lb63t - > apply skipped in dry run - > apply manifest ClusterRoleBinding system-bootstrap-approve-node-client-csr - > apply skipped in dry run - -``` - -To upgrade Kubernetes from v{{< k8s_prev_release >}} to v{{< k8s_release >}} run: - -```bash -$ talosctl --nodes upgrade-k8s --to {{< k8s_release >}} -automatically detected the lowest Kubernetes version {{< k8s_prev_release >}} -checking for resource APIs to be deprecated in version {{< k8s_release >}} -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -discovered worker nodes ["172.20.0.5" "172.20.0.6"] -updating "kube-apiserver" to version "{{< k8s_release >}}" - > "172.20.0.2": starting update - > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - > "172.20.0.2": machine configuration patched - > "172.20.0.2": waiting for API server state pod update - < "172.20.0.2": successfully updated - > "172.20.0.3": starting update - > update kube-apiserver: v{{< k8s_prev_release >}} -> {{< k8s_release >}} - -``` - -This command runs in several phases: - -1. Every control plane node machine configuration is patched with the new image version for each control plane component. - Talos renders new static pod definitions on the configuration update which is picked up by the kubelet. - The command waits for the change to propagate to the API server state. -2. The command updates the `kube-proxy` daemonset with the new image version. -3. On every node in the cluster, the `kubelet` version is updated. - The command then waits for the `kubelet` service to be restarted and become healthy. - The update is verified by checking the `Node` resource state. -4. Kubernetes bootstrap manifests are re-applied to the cluster. - Updated bootstrap manifests might come with a new Talos version (e.g. CoreDNS version update), or might be the result of machine configuration change. - Note: The `upgrade-k8s` command never deletes any resources from the cluster: they should be deleted manually. - -If the command fails for any reason, it can be safely restarted to continue the upgrade process from the moment of the failure. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, you need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v{{< k8s_release >}}"}]' -patched mc at the node 172.20.0.2 -``` - -The JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also the machine configuration can be edited manually with `talosctl -n edit mc --mode=no-reboot`. - -Capture the new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v{{< k8s_release >}} - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, the new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v{{< k8s_release >}}"}]' -patched mc at the node 172.20.0.2 -``` - -The JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v{{< k8s_release >}} - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v{{< k8s_release >}}"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v{{< k8s_release >}} - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v{{< k8s_release >}} - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v{{< k8s_release >}} - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -### Bootstrap Manifests - -Bootstrap manifests can be retrieved in a format which works for `kubectl` with the following command: - -```bash -talosctl -n get manifests -o yaml | yq eval-all '.spec | .[] | splitDoc' - > manifests.yaml -``` - -Diff the manifests with the cluster: - -```bash -kubectl diff -f manifests.yaml -``` - -Apply the manifests: - -```bash -kubectl apply -f manifests.yaml -``` - -> Note: if some boostrap resources were removed, they have to be removed from the cluster manually. - -### kubelet - -For every node, patch machine configuration with new kubelet version, wait for the kubelet to restart with new version: - -```bash -$ talosctl -n patch mc --mode=no-reboot -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' -patched mc at the node 172.20.0.2 -``` - -Once `kubelet` restarts with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v{{< k8s_release >}} -``` diff --git a/website/content/v1.0/learn-more/_index.md b/website/content/v1.0/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v1.0/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v1.0/learn-more/architecture.md b/website/content/v1.0/learn-more/architecture.md deleted file mode 100644 index e1523b496..000000000 --- a/website/content/v1.0/learn-more/architecture.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Architecture" -weight: 20 -description: "Learn the system architecture of Talos Linux itself." ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## File system partitions - -Talos uses these partitions with the following labels: - -1. **EFI** - stores EFI boot data. -1. **BIOS** - used for GRUB's second stage boot. -1. **BOOT** - used for the boot loader, stores initramfs and kernel data. -1. **META** - stores metadata about the talos node, such as node id's. -1. **STATE** - stores machine configuration, node identity data for cluster discovery and KubeSpan info -1. **EPHEMERAL** - stores ephemeral state information, mounted at `/var` - -## The File System - -One of the unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and then bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely recreated on each boot. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v1.0/learn-more/components.md b/website/content/v1.0/learn-more/components.md deleted file mode 100644 index 9b680ccc5..000000000 --- a/website/content/v1.0/learn-more/components.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -title: "Components" -weight: 40 -description: "Understand the system components that make up Talos Linux." ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v1.0/learn-more/concepts.md b/website/content/v1.0/learn-more/concepts.md deleted file mode 100644 index dc292f986..000000000 --- a/website/content/v1.0/learn-more/concepts.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: "Concepts" -weight: 30 -description: "Summary of Talos Linux." ---- - -When people come across Talos, they frequently want a nice, bite-sized summary -of it. -This is surprisingly difficult when Talos represents such a -fundamentally-rethought operating system. - -## Not based on X distro - -A useful way to summarize an operating system is to say that it is based on X, but focused on Y. -For instance, Mint was originally based on Ubuntu, but focused on Gnome 2 (instead of, at the time, Unity). -Or maybe something like Raspbian is based on Debian, but it is focused on the Raspberry Pi. -CentOS is RHEL, but made license-free. - -Talos Linux _isn't_ based on any other distribution. -We often think of ourselves as being the second-generation of -container-optimised operating systems, where things like CoreOS, Flatcar, and Rancher represent the first generation, but that implies heredity where there is none. - -Talos Linux is actually a ground-up rewrite of the userspace, from PID 1. -We run the Linux kernel, but everything downstream of that is our own custom -code, written in Go, rigorously-tested, and published as an immutable, -integrated, cohesive image. -The Linux kernel launches what we call `machined`, for instance, not `systemd`. -There is no `systemd` on our system. -There are no GNU utilities, no shell, no SSH, no packages, nothing you could associate with -any other distribution. -We don't even have a build toolchain in the normal sense of the word. - -## Not for individual use - -Technically, Talos Linux installs to a computer much as other operating systems. -_Unlike_ other operating systems, Talos is not meant to run alone, on a -single machine. -Talos Linux comes with tooling from the very foundation to form clusters, even -before Kubernetes comes into play. -A design goal of Talos Linux is eliminating the management -of individual nodes as much as possible. -In order to do that, Talos Linux operates as a cluster of machines, with lots of -checking and coordination between them, at all levels. - -Break from your mind the idea of running an application on a computer. -There are no individual computers. -There is only a cluster. -Talos is meant to do one thing: maintain a Kubernetes cluster, and it does this -very, very well. - -The entirety of the configuration of any machine is specified by a single, -simple configuration file, which can often be the _same_ configuration file used -across _many_ machines. -Much like a biological system, if some component misbehaves, just cut it out and -let a replacement grow. -Rebuilds of Talos are remarkably fast, whether they be new machines, upgrades, -or reinstalls. -Never get hung up on an individual machine. - -## Control Planes are not linear replicas - -People familiar with traditional relational database replication often -overlook a critical design concept of the Kubernetes (and Talos) database: -`etcd`. -Unlike linear replicas, which have dedicated masters and slaves/replicas, `etcd` -is highly dynamic. -The `master` in an `etcd` cluster is entirely temporal. -This means fail-overs are handled easily, and usually without any notice -of operators. -This _also_ means that the operational architecture is fundamentally different. - -Properly managed (which Talos Linux does), `etcd` should never have split brain -and should never encounter noticeable down time. -In order to do this, though, `etcd` maintains the concept of "membership" and of -"quorum". -In order to perform _any_ operation, read _or_ write, the database requires -quorum to be sustained. -That is, a _strict_ majority must agree on the current leader, and absenteeism -counts as a negative. -In other words, if there are three registered members (voters), at least two out -of the three must be actively asserting that the current master _is_ the master. -If any two disagree or even fail to answer, the `etcd` database will lock itself -until quorum is again achieved in order to protect itself and the integrity of -the data. -This is fantastically important for handling distributed systems and the various -types of contention which may arise. - -This design means, however, that having an incorrect number of members can be -devastating. -Having only two controlplane nodes, for instance, is mostly _worse_ than having -only one, because if _either_ goes down, your entire database will lock. -You would be better off just making periodic snapshots of the data and restoring -it when necessary. - -Another common situation occurs when replacing controlplane nodes. -If you have three controlplane nodes and replace one, you will not have three -members, you will have four, and one of those will never be available again. -Thus, if _any_ of your three remaining nodes goes down, your database will lock, -because only two out of the four members will be available: four nodes is -_worse_ than three nodes! -So it is critical that controlplane members which are replaced be removed. -Luckily, the Talos API makes this easy. - -## Bootstrap once - -In the old days, Talos Linux had the idea of an `init` node. -The `init` node was a "special" controlplane node which was designated as the -founder of the cluster. -It was the first, was guaranteed to be the elector, and was authorised to create -a cluster... -even if one already existed. -This made the formation of a cluster cluster really easy, but it had a lot of -down sides. -Mostly, these related to rebuilding or replacing that `init` node: -you could easily end up with a split-brain scenario in which you had two different clusters: -a single node one and a two-node one. -Needless to say, this was an unhappy arrangement. - -Fortunately, `init` nodes are gone, but that means that the critical operation -of forming a cluster is a manual process. -It's an _easy_ process, consisting of a single API call, but it can be a -confusing one, until you understand what it does. - -Every new cluster must be bootstrapped exactly and only once. -This means you do NOT bootstrap each node in a cluster, not even each -controlplane node. -You bootstrap only a _single_ controlplane node, because you are bootstrapping the -_cluster_, not the node. - -It doesn't matter _which_ controlplane node is told to bootstrap, but it must be -a controlplane node, and it must be only one. - -Bootstrapping is _fast_ and sure. -Even if your Kubernetes cluster fails to form for other reasons (say, a bad -configuration option or unavailable container repository), if the bootstrap API -call returns successfully, you do NOT need to bootstrap again: -just fix the config or let Kubernetes retry. - -Bootstrapping itself does not do anything with Kubernetes. -Bootstrapping only tells `etcd` to form a cluster, so don't judge the success of -a bootstrap by the failure of Kubernetes to start. -Kubernetes relies on `etcd`, so bootstrapping is _required_, but it is not -_sufficient_ for Kubernetes to start. diff --git a/website/content/v1.0/learn-more/control-plane.md b/website/content/v1.0/learn-more/control-plane.md deleted file mode 100644 index 35bb526bf..000000000 --- a/website/content/v1.0/learn-more/control-plane.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: "Control Plane" -weight: 50 -description: "Understand the Kubernetes Control Plane." ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v1.0/learn-more/controllers-resources.md b/website/content/v1.0/learn-more/controllers-resources.md deleted file mode 100644 index bf15801f0..000000000 --- a/website/content/v1.0/learn-more/controllers-resources.md +++ /dev/null @@ -1,230 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 60 -description: "Discover how Talos Linux uses the concepts on Controllers and Resources." ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, -listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default -namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v1.0/learn-more/discovery.md b/website/content/v1.0/learn-more/discovery.md deleted file mode 100644 index 44461f8dc..000000000 --- a/website/content/v1.0/learn-more/discovery.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Discovery" -weight: 90 -description: "Discover how Sidero Labs impliments Talos node discovery." ---- - -We maintain a public discovery service whereby members of your cluster can use a common and unique key to coordinate the most basic connection information (i.e. the set of possible "endpoints", or IP:port pairs). -We call this data "affiliate data." - -> Note: If KubeSpan is enabled the data has the addition of the WireGuard public key. - -Before sending data to the discovery service, Talos will encrypt the affiliate data with AES-GCM encryption and separately encrypt endpoints with AES in ECB mode so that endpoints coming from different sources can be deduplicated server-side. -Each node submits it's data encrypted plus it submits the endpoints it sees from other peers to the discovery service -The discovery service aggregates the data, deduplicates the endpoints, and sends updates to each connected peer. -Each peer receives information back about other affiliates from the discovery service, decrypts it and uses it to drive KubeSpan and cluster discovery. -Moreover, the discovery service has no persistence. -Data is stored in memory only with a TTL set by the clients (i.e. Talos). -The cluster ID is used as a key to select the affiliates (so that different clusters see different affiliates). - -To summarize, the discovery service knows the client version, cluster ID, the number of affiliates, some encrypted data for each affiliate, and a list of encrypted endpoints. diff --git a/website/content/v1.0/learn-more/faqs.md b/website/content/v1.0/learn-more/faqs.md deleted file mode 100644 index 7898d7ff9..000000000 --- a/website/content/v1.0/learn-more/faqs.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: "FAQs" -weight: 999 -description: "Frequently Asked Questions about Talos Linux." ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remediation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. - -## Why does Talos rely on a separate configuration from Kubernetes? - -The `talosconfig` file contains client credentials to access the Talos Linux API. -Sometimes Kubernetes might be down for a number of reasons (etcd issues, misconfiguration, etc.), while Talos API access will always be available. -The Talos API is a way to access the operating system and fix issues, e.g. fixing access to Kubernetes. -When Talos Linux is running fine, using the Kubernetes APIs (via `kubeconfig`) is all you should need to deploy and manage Kubernetes workloads. diff --git a/website/content/v1.0/learn-more/knowledge-base.md b/website/content/v1.0/learn-more/knowledge-base.md deleted file mode 100644 index 5ed4cdfc9..000000000 --- a/website/content/v1.0/learn-more/knowledge-base.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: "Knowledge Base" -weight: 1999 -description: "Recipes for common configuration tasks with Talos Linux." ---- - -## Disabling `GracefulNodeShutdown` on a node - -Talos Linux enables [Graceful Node Shutdown](https://kubernetes.io/docs/concepts/architecture/nodes/#graceful-node-shutdown) Kubernetes feature by default. - -If this feature should be disabled, modify the `kubelet` part of the machine configuration with: - -```yaml -machine: - kubelet: - extraArgs: - feature-gates: GracefulNodeShutdown=false - extraConfig: - shutdownGracePeriod: 0s - shutdownGracePeriodCriticalPods: 0s -``` - -## Logging Kubernetes audit logs with loki - -If using loki-stack helm chart to gather logs from the Kubernetes cluster, you can use the helm values to configure loki-stack to log Kubernetes API server audit logs: - -```yaml -promtail: - extraArgs: - - -config.expand-env - # // this is required so that the promtail process can read the kube-apiserver audit logs written as `nobody` user - containerSecurityContext: - capabilities: - add: - - DAC_READ_SEARCH - extraVolumes: - - name: audit-logs - hostPath: - path: /var/log/audit/kube - extraVolumeMounts: - - name: audit-logs - mountPath: /var/log/audit/kube - readOnly: true - config: - snippets: - extraScrapeConfigs: | - - job_name: auditlogs - static_configs: - - targets: - - localhost - labels: - job: auditlogs - host: ${HOSTNAME} - __path__: /var/log/audit/kube/*.log -``` diff --git a/website/content/v1.0/learn-more/kubespan.md b/website/content/v1.0/learn-more/kubespan.md deleted file mode 100644 index f0f53647c..000000000 --- a/website/content/v1.0/learn-more/kubespan.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "KubeSpan" -weight: 100 -description: "Understand more about KubeSpan for Talos Linux." ---- - -## WireGuard Peer Discovery - -The key pieces of information needed for WireGuard generally are: - -- the public key of the host you wish to connect to -- an IP address and port of the host you wish to connect to - -The latter is really only required of _one_ side of the pair. -Once traffic is received, that information is known and updated by WireGuard automatically and internally. - -For Kubernetes, though, this is not quite sufficient. -Kubernetes also needs to know which traffic goes to which WireGuard peer. -Because this information may be dynamic, we need a way to be able to constantly keep this information up to date. - -If we have a functional connection to Kubernetes otherwise, it's fairly easy: we can just keep that information in Kubernetes. -Otherwise, we have to have some way to discover it. - -In our solution, we have a multi-tiered approach to gathering this information. -Each tier can operate independently, but the amalgamation of the tiers produces a more robust set of connection criteria. - -For this discussion, we will point out two of these tiers: - -- an external service -- a Kubernetes-based system - -See [discovery service]({{< relref "discovery" >}}) to learn more about the external service. - -The Kubernetes-based system utilises annotations on Kubernetes Nodes which describe each node's public key and local addresses. - -On top of this, we also route Pod subnets. -This is often (maybe even usually) taken care of by the CNI, but there are many situations where the CNI fails to be able to do this itself, across networks. -So we also scrape the Kubernetes Node resource to discover its `podCIDRs`. - -## NAT, Multiple Routes, Multiple IPs - -One of the difficulties in communicating across networks is that there is often not a single address and port which can identify a connection for each node on the system. -For instance, a node sitting on the same network might see its peer as `192.168.2.10`, but a node across the internet may see it as `2001:db8:1ef1::10`. - -We need to be able to handle any number of addresses and ports, and we also need to have a mechanism to _try_ them. -WireGuard only allows us to select one at a time. - -For our implementation, then, we have built a controller which continuously discovers and rotates these IP:port pairs until a connection is established. -It then starts trying again if that connection ever fails. - -## Packet Routing - -After we have established a WireGuard connection, our work is not done. -We still have to make sure that the right packets get sent to the WireGuard interface. - -WireGuard supplies a convenient facility for tagging packets which come from _it_, which is great. -But in our case, we need to be able to allow traffic which both does _not_ come from WireGuard and _also_ is not destined for another Kubernetes node to flow through the normal mechanisms. - -Unlike many corporate or privacy-oriented VPNs, we need to allow general internet traffic to flow normally. - -Also, as our cluster grows, this set of IP addresses can become quite large and quite dynamic. -This would be very cumbersome and slow in `iptables`. -Luckily, the kernel supplies a convenient mechanism by which to define this arbitrarily large set of IP addresses: IP sets. - -Talos collects all of the IPs and subnets which are considered "in-cluster" and maintains these in the kernel as an IP set. - -Now that we have the IP set defined, we need to tell the kernel how to use it. - -The traditional way of doing this would be to use `iptables`. -However, there is a big problem with IPTables. -It is a common namespace in which any number of other pieces of software may dump things. -We have no surety that what we add will not be wiped out by something else (from Kubernetes itself, to the CNI, to some workload application), be rendered unusable by higher-priority rules, or just generally cause trouble and conflicts. - -Instead, we use a three-pronged system which is both more foundational and less centralised. - -NFTables offers a separately namespaced, decentralised way of marking packets for later processing based on IP sets. -Instead of a common set of well-known tables, NFTables uses hooks into the kernel's netfilter system, which are less vulnerable to being usurped, bypassed, or a source of interference than IPTables, but which are rendered down by the kernel to the same underlying XTables system. - -Our NFTables system is where we store the IP sets. -Any packet which enters the system, either by forward from inside Kubernetes or by generation from the host itself, is compared against a hash table of this IP set. -If it is matched, it is marked for later processing by our next stage. -This is a high-performance system which exists fully in the kernel and which ultimately becomes an eBPF program, so it scales well to hundreds of nodes. - -The next stage is the kernel router's route rules. -These are defined as a common ordered list of operations for the whole operating system, but they are intended to be tightly constrained and are rarely used by applications in any case. -The rules we add are very simple: if a packet is marked by our NFTables system, send it to an alternate routing table. - -This leads us to our third and final stage of packet routing. -We have a custom routing table with two rules: - -- send all IPv4 traffic to the WireGuard interface -- send all IPv6 traffic to the WireGuard interface - -So in summary, we: - -- mark packets destined for Kubernetes applications or Kubernetes nodes -- send marked packets to a special routing table -- send anything which is sent to that routing table through the WireGuard interface - -This gives us an isolated, resilient, tolerant, and non-invasive way to route Kubernetes traffic safely, automatically, and transparently through WireGuard across almost any set of network topologies. diff --git a/website/content/v1.0/learn-more/networking-resources.md b/website/content/v1.0/learn-more/networking-resources.md deleted file mode 100644 index 5f664ae4e..000000000 --- a/website/content/v1.0/learn-more/networking-resources.md +++ /dev/null @@ -1,395 +0,0 @@ ---- -title: "Networking Resources" -weight: 70 -description: "Delve deeper into networking of Talos Linux." ---- - -Starting with version 0.11, a new implementation of the network configuration subsystem is powered by [COSI]({{< relref "controllers-resources" >}}). -The new implementation is still using the same machine configuration file format and external sources to configure a node's network, so there should be no difference -in the way Talos works in 0.11. - -The most notable change in Talos 0.11 is that all changes to machine configuration `.machine.network` can be applied now in immediate mode (without a reboot) via -`talosctl edit mc --mode=no-reboot` or `talosctl apply-config --mode=no-reboot`. - -## Resources - -There are six basic network configuration items in Talos: - -* `Address` (IP address assigned to the interface/link); -* `Route` (route to a destination); -* `Link` (network interface/link configuration); -* `Resolver` (list of DNS servers); -* `Hostname` (node hostname and domainname); -* `TimeServer` (list of NTP servers). - -Each network configuration item has two counterparts: - -* `*Status` (e.g. `LinkStatus`) describes the current state of the system (Linux kernel state); -* `*Spec` (e.g. `LinkSpec`) defines the desired configuration. - -| Resource | Status | Spec | -|--------------------|------------------------|----------------------| -| `Address` | `AddressStatus` | `AddressSpec` | -| `Route` | `RouteStatus` | `RouteSpec` | -| `Link` | `LinkStatus` | `LinkSpec` | -| `Resolver` | `ResolverStatus` | `ResolverSpec` | -| `Hostname` | `HostnameStatus` | `HostnameSpec` | -| `TimeServer` | `TimeServerStatus` | `TimeServerSpec` | - -Status resources have aliases with the `Status` suffix removed, so for example -`AddressStatus` is also available as `Address`. - -Talos networking controllers reconcile the state so that `*Status` equals the desired `*Spec`. - -## Observing State - -The current network configuration state can be observed by querying `*Status` resources via -`talosctl`: - -```sh -$ talosctl get addresses -NODE NAMESPACE TYPE ID VERSION ADDRESS LINK -172.20.0.2 network AddressStatus eth0/172.20.0.2/24 1 172.20.0.2/24 eth0 -172.20.0.2 network AddressStatus eth0/fe80::9804:17ff:fe9d:3058/64 2 fe80::9804:17ff:fe9d:3058/64 eth0 -172.20.0.2 network AddressStatus flannel.1/10.244.4.0/32 1 10.244.4.0/32 flannel.1 -172.20.0.2 network AddressStatus flannel.1/fe80::10b5:44ff:fe62:6fb8/64 2 fe80::10b5:44ff:fe62:6fb8/64 flannel.1 -172.20.0.2 network AddressStatus lo/127.0.0.1/8 1 127.0.0.1/8 lo -172.20.0.2 network AddressStatus lo/::1/128 1 ::1/128 lo -``` - -In the output there are addresses set up by Talos (e.g. `eth0/172.20.0.2/24`) and -addresses set up by other facilities (e.g. `flannel.1/10.244.4.0/32` set up by CNI). - -Talos networking controllers watch the kernel state and update resources -accordingly. - -Additional details about the address can be accessed via the YAML output: - -```sh -$ talosctl get address eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressStatuses.net.talos.dev - id: eth0/172.20.0.2/24 - version: 1 - owner: network.AddressStatusController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - address: 172.20.0.2/24 - local: 172.20.0.2 - broadcast: 172.20.0.255 - linkIndex: 4 - linkName: eth0 - family: inet4 - scope: global - flags: permanent -``` - -Resources can be watched for changes with the `--watch` flag to see how configuration changes over time. - -Other networking status resources can be inspected with `talosctl get routes`, `talosctl get links`, etc. -For example: - -```sh -$ talosctl get resolvers -NODE NAMESPACE TYPE ID VERSION RESOLVERS -172.20.0.2 network ResolverStatus resolvers 2 ["8.8.8.8","1.1.1.1"] -``` - -## Inspecting Configuration - -The desired networking configuration is combined from multiple sources and presented -as `*Spec` resources: - -```sh -$ talosctl get addressspecs -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network AddressSpec eth0/172.20.0.2/24 2 -172.20.0.2 network AddressSpec lo/127.0.0.1/8 2 -172.20.0.2 network AddressSpec lo/::1/128 2 -``` - -These `AddressSpecs` are applied to the Linux kernel to reach the desired state. -If, for example, an `AddressSpec` is removed, the address is removed from the Linux network interface as well. - -`*Spec` resources can't be manipulated directly, they are generated automatically by Talos -from multiple configuration sources (see a section below for details). - -If a `*Spec` resource is queried in YAML format, some additional information is available: - -```sh -$ talosctl get addressspecs eth0/172.20.0.2/24 -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: AddressSpecs.net.talos.dev - id: eth0/172.20.0.2/24 - version: 2 - owner: network.AddressMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.AddressSpecController -spec: - address: 172.20.0.2/24 - linkName: eth0 - family: inet4 - scope: global - flags: permanent - layer: operator -``` - -An important field is the `layer` field, which describes a configuration layer this spec is coming from: in this case, it's generated by a network operator (see below) and is set by the DHCPv4 operator. - -## Configuration Merging - -Spec resources described in the previous section show the final merged configuration state, -while initial specs are put to a different unmerged namespace `network-config`. -Spec resources in the `network-config` namespace are merged with conflict resolution to produce the final merged representation in the `network` namespace. - -Let's take `HostnameSpec` as an example. -The final merged representation is: - -```sh -$ talosctl get hostnamespec -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: HostnameSpecs.net.talos.dev - id: hostname - version: 2 - owner: network.HostnameMergeController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z - finalizers: - - network.HostnameSpecController -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that the final configuration for the hostname is `talos-default-master-1`. -And this is the hostname that was actually applied. -This can be verified by querying a `HostnameStatus` resource: - -```sh -$ talosctl get hostnamestatus -NODE NAMESPACE TYPE ID VERSION HOSTNAME DOMAINNAME -172.20.0.2 network HostnameStatus hostname 1 talos-default-master-1 -``` - -Initial configuration for the hostname in the `network-config` namespace is: - -```sh -$ talosctl get hostnamespec -o yaml --namespace network-config -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: default/hostname - version: 2 - owner: network.HostnameConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-172-20-0-2 - domainname: "" - layer: default ---- -node: 172.20.0.2 -metadata: - namespace: network-config - type: HostnameSpecs.net.talos.dev - id: dhcp4/eth0/hostname - version: 1 - owner: network.OperatorSpecController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - hostname: talos-default-master-1 - domainname: "" - layer: operator -``` - -We can see that there are two specs for the hostname: - -* one from the `default` configuration layer which defines the hostname as `talos-172-20-0-2` (default driven by the default node address); -* another one from the layer `operator` that defines the hostname as `talos-default-master-1` (DHCP). - -Talos merges these two specs into a final `HostnameSpec` based on the configuration layer and merge rules. -Here is the order of precedence from low to high: - -* `default` (defaults provided by Talos); -* `cmdline` (from the kernel command line); -* `platform` (driven by the cloud provider); -* `operator` (various dynamic configuration options: DHCP, Virtual IP, etc); -* `configuration` (derived from the machine configuration). - -So in our example the `operator` layer `HostnameSpec` overwrites the `default` layer producing the final hostname `talos-default-master-1`. - -The merge process applies to all six core networking specs. -For each spec, the `layer` controls the merge behavior -If multiple configuration specs -appear at the same layer, they can be merged together if possible, otherwise merge result -is stable but not defined (e.g. if DHCP on multiple interfaces provides two different hostnames for the node). - -`LinkSpecs` are merged across layers, so for example, machine configuration for the interface MTU overrides an MTU set by the DHCP server. - -## Network Operators - -Network operators provide dynamic network configuration which can change over time as the node is running: - -* DHCPv4 -* DHCPv6 -* Virtual IP - -Network operators produce specs for addresses, routes, links, etc., which are then merged and applied according to the rules described above. - -Operators are configured with `OperatorSpec` resources which describe when operators -should run and additional configuration for the operator: - -```sh -$ talosctl get operatorspecs -o yaml -node: 172.20.0.2 -metadata: - namespace: network - type: OperatorSpecs.net.talos.dev - id: dhcp4/eth0 - version: 1 - owner: network.OperatorConfigController - phase: running - created: 2021-06-29T20:23:18Z - updated: 2021-06-29T20:23:18Z -spec: - operator: dhcp4 - linkName: eth0 - requireUp: true - dhcp4: - routeMetric: 1024 -``` - -`OperatorSpec` resources are generated by Talos based on machine configuration mostly. -DHCP4 operator is created automatically for all physical network links which are not configured explicitly via the kernel command line or the machine configuration. -This also means that on the first boot, without a machine configuration, a DHCP request is made on all physical network interfaces by default. - -Specs generated by operators are prefixed with the operator ID (`dhcp4/eth0` in the example above) in the unmerged `network-config` namespace: - -```sh -$ talosctl -n 172.20.0.2 get addressspecs --namespace network-config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 network-config AddressSpec dhcp4/eth0/eth0/172.20.0.2/24 1 -``` - -## Other Network Resources - -There are some additional resources describing the network subsystem state. - -The `NodeAddress` resource presents node addresses excluding link-local and loopback addresses: - -```sh -$ talosctl get nodeaddresses -NODE NAMESPACE TYPE ID VERSION ADDRESSES -10.100.2.23 network NodeAddress accumulative 6 ["10.100.2.23","147.75.98.173","147.75.195.143","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress current 5 ["10.100.2.23","147.75.98.173","192.168.95.64","2604:1380:1:ca00::17"] -10.100.2.23 network NodeAddress default 1 ["10.100.2.23"] -``` - -* `default` is the node default address; -* `current` is the set of addresses a node currently has; -* `accumulative` is the set of addresses a node had over time (it might include virtual IPs which are not owned by the node at the moment). - -`NodeAddress` resources are used to pick up the default address for `etcd` peer URL, to populate SANs field in the generated certificates, etc. - -Another important resource is `Nodename` which provides `Node` name in Kubernetes: - -```sh -$ talosctl get nodename -NODE NAMESPACE TYPE ID VERSION NODENAME -10.100.2.23 controlplane Nodename nodename 1 infra-green-cp-mmf7v -``` - -Depending on the machine configuration `nodename` might be just a hostname or the FQDN of the node. - -`NetworkStatus` aggregates the current state of the network configuration: - -```sh -$ talosctl get networkstatus -o yaml -node: 10.100.2.23 -metadata: - namespace: network - type: NetworkStatuses.net.talos.dev - id: status - version: 5 - owner: network.StatusController - phase: running - created: 2021-06-24T18:56:00Z - updated: 2021-06-24T18:56:02Z -spec: - addressReady: true - connectivityReady: true - hostnameReady: true - etcFilesReady: true -``` - -## Network Controllers - -For each of the six basic resource types, there are several controllers: - -* `*StatusController` populates `*Status` resources observing the Linux kernel state. -* `*ConfigController` produces the initial unmerged `*Spec` resources in the `network-config` namespace based on defaults, kernel command line, and machine configuration. -* `*MergeController` merges `*Spec` resources into the final representation in the `network` namespace. -* `*SpecController` applies merged `*Spec` resources to the kernel state. - -For the network operators: - -* `OperatorConfigController` produces `OperatorSpec` resources based on machine configuration and deafauls. -* `OperatorSpecController` runs network operators watching `OperatorSpec` resources and producing various `*Spec` resources in the `network-config` namespace. - -## Configuration Sources - -There are several configuration sources for the network configuration, which are described in this section. - -### Defaults - -* `lo` interface is assigned addresses `127.0.0.1/8` and `::1/128`; -* hostname is set to the `talos-` where `IP` is the default node address; -* resolvers are set to `8.8.8.8`, `1.1.1.1`; -* time servers are set to `pool.ntp.org`; -* DHCP4 operator is run on any physical interface which is not configured explicitly. - -### Cmdline - -The kernel command line is parsed for the following options: - -* `ip=` option is parsed for node IP, default gateway, hostname, DNS servers, NTP servers; -* `talos.hostname=` option is used to set node hostname; -* `talos.network.interface.ignore=` can be used to make Talos skip network interface configuration completely. - -### Platform - -Platform configuration delivers cloud environment-specific options (e.g. the hostname). - -### Operator - -Network operators provide configuration for all basic resource types. - -### Machine Configuration - -The machine configuration is parsed for link configuration, addresses, routes, hostname, -resolvers and time servers. -Any changes to `.machine.network` configuration can be applied in immediate mode. - -## Network Configuration Debugging - -Most of the network controller operations and failures are logged to the kernel console, -additional logs with `debug` level are available with `talosctl logs controller-runtime` command. -If the network configuration can't be established and the API is not available, `debug` level -logs can be sent to the console with `debug: true` option in the machine configuration. diff --git a/website/content/v1.0/learn-more/philosophy.md b/website/content/v1.0/learn-more/philosophy.md deleted file mode 100644 index a81c3c9f5..000000000 --- a/website/content/v1.0/learn-more/philosophy.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Philosophy -weight: 10 -description: "Learn about the philosophy behind the need for Talos Linux." ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v1.0/learn-more/talos-network-connectivity.md b/website/content/v1.0/learn-more/talos-network-connectivity.md deleted file mode 100644 index 02256d747..000000000 --- a/website/content/v1.0/learn-more/talos-network-connectivity.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: "Network Connectivity" -weight: 80 -description: "Description of the Networking Connectivity needed by Talos Linux" -aliases: - - ../guides/configuring-network-connectivity ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/siderolabs/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/siderolabs/talos/issues/1836). diff --git a/website/content/v1.0/learn-more/talosctl.md b/website/content/v1.0/learn-more/talosctl.md deleted file mode 100644 index 2580dbeb0..000000000 --- a/website/content/v1.0/learn-more/talosctl.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: "talosctl" -weight: 110 -description: "The design and use of the Talos Linux control application." ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference]({{< relref "../reference/cli" >}}) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v1.0/reference/_index.md b/website/content/v1.0/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v1.0/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v1.0/reference/api.md b/website/content/v1.0/reference/api.md deleted file mode 100644 index 880839f2a..000000000 --- a/website/content/v1.0/reference/api.md +++ /dev/null @@ -1,3307 +0,0 @@ ---- -title: "API" -description: "Talos gRPC API reference." ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - - - [File-level Extensions](#common/common.proto-extensions) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [AddressEvent](#machine.AddressEvent) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [ConfigLoadErrorEvent](#machine.ConfigLoadErrorEvent) - - [ConfigValidationErrorEvent](#machine.ConfigValidationErrorEvent) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FeaturesInfo](#machine.FeaturesInfo) - - [FileInfo](#machine.FileInfo) - - [GenerateClientConfiguration](#machine.GenerateClientConfiguration) - - [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) - - [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootRequest](#machine.RebootRequest) - - [RebootResponse](#machine.RebootResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownRequest](#machine.ShutdownRequest) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RebootRequest.Mode](#machine.RebootRequest.Mode) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -

Top

- -## common/common.proto - - - - - -### Data - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | -| bytes | [bytes](#bytes) | | | - - - - - - - - -### DataResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Data](#common.Data) | repeated | | - - - - - - - - -### Empty - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#common.Metadata) | | | - - - - - - - - -### EmptyResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Empty](#common.Empty) | repeated | | - - - - - - - - -### Error - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| code | [Code](#common.Code) | | | -| message | [string](#string) | | | -| details | [google.protobuf.Any](#google.protobuf.Any) | repeated | | - - - - - - - - -### Metadata -Common metadata message nested in all reply message types - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | hostname of the server response comes from (injected by proxy) | -| error | [string](#string) | | error is set if request failed to the upstream (rest of response is undefined) | -| status | [google.rpc.Status](#google.rpc.Status) | | error as gRPC Status | - - - - - - - - - - -### Code - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| FATAL | 0 | | -| LOCKED | 1 | | - - - - - -### ContainerDriver - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CONTAINERD | 0 | | -| CRI | 1 | | - - - - - - - -### File-level Extensions -| Extension | Type | Base | Number | Description | -| --------- | ---- | ---- | ------ | ----------- | -| remove_deprecated_enum | string | .google.protobuf.EnumOptions | 93117 | Indicates the Talos version when this deprecated enum will be removed from API. | -| remove_deprecated_enum_value | string | .google.protobuf.EnumValueOptions | 93117 | Indicates the Talos version when this deprecated enum value will be removed from API. | -| remove_deprecated_field | string | .google.protobuf.FieldOptions | 93117 | Indicates the Talos version when this deprecated filed will be removed from API. | -| remove_deprecated_message | string | .google.protobuf.MessageOptions | 93117 | Indicates the Talos version when this deprecated message will be removed from API. | -| remove_deprecated_method | string | .google.protobuf.MethodOptions | 93117 | Indicates the Talos version when this deprecated method will be removed from API. | -| remove_deprecated_service | string | .google.protobuf.ServiceOptions | 93117 | Indicates the Talos version when this deprecated service will be removed from API. | - - - - - - - - -

Top

- -## inspect/inspect.proto - - - - - -### ControllerDependencyEdge - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| controller_name | [string](#string) | | | -| edge_type | [DependencyEdgeType](#inspect.DependencyEdgeType) | | | -| resource_namespace | [string](#string) | | | -| resource_type | [string](#string) | | | -| resource_id | [string](#string) | | | - - - - - - - - -### ControllerRuntimeDependenciesResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) | repeated | | - - - - - - - - -### ControllerRuntimeDependency -The ControllerRuntimeDependency message contains the graph of controller-resource dependencies. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| edges | [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) | repeated | | - - - - - - - - - - -### DependencyEdgeType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| OUTPUT_EXCLUSIVE | 0 | | -| OUTPUT_SHARED | 3 | | -| INPUT_STRONG | 1 | | -| INPUT_WEAK | 2 | | -| INPUT_DESTROY_READY | 4 | | - - - - - - - - - -### InspectService -The inspect service definition. - -InspectService provides auxiliary API to inspect OS internals. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ControllerRuntimeDependencies | [.google.protobuf.Empty](#google.protobuf.Empty) | [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) | | - - - - - - -

Top

- -## machine/machine.proto - - - - - -### AddressEvent -AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| addresses | [string](#string) | repeated | | - - - - - - - - -### ApplyConfiguration -ApplyConfigurationResponse describes the response to a configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| warnings | [string](#string) | repeated | Configuration validation warnings. | -| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | States which mode was actually chosen. | -| mode_details | [string](#string) | | Human-readable message explaining the result of the apply configuration call. | - - - - - - - - -### ApplyConfigurationRequest -rpc applyConfiguration -ApplyConfiguration describes a request to assert a new configuration upon a -node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| data | [bytes](#bytes) | | | -| on_reboot | [bool](#bool) | | **Deprecated.** replaced by mode | -| immediate | [bool](#bool) | | **Deprecated.** replaced by mode | -| mode | [ApplyConfigurationRequest.Mode](#machine.ApplyConfigurationRequest.Mode) | | | - - - - - - - - -### ApplyConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ApplyConfiguration](#machine.ApplyConfiguration) | repeated | | - - - - - - - - -### Bootstrap -The bootstrap message containing the bootstrap status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### BootstrapRequest -rpc Bootstrap - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recover_etcd | [bool](#bool) | | Enable etcd recovery from the snapshot. - -Snapshot should be uploaded before this call via EtcdRecover RPC. | -| recover_skip_hash_check | [bool](#bool) | | Skip hash check on the snapshot (etcd). - -Enable this when recovering from data directory copy to skip integrity check. | - - - - - - - - -### BootstrapResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Bootstrap](#machine.Bootstrap) | repeated | | - - - - - - - - -### CNIConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| urls | [string](#string) | repeated | | - - - - - - - - -### CPUInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| processor | [uint32](#uint32) | | | -| vendor_id | [string](#string) | | | -| cpu_family | [string](#string) | | | -| model | [string](#string) | | | -| model_name | [string](#string) | | | -| stepping | [string](#string) | | | -| microcode | [string](#string) | | | -| cpu_mhz | [double](#double) | | | -| cache_size | [string](#string) | | | -| physical_id | [string](#string) | | | -| siblings | [uint32](#uint32) | | | -| core_id | [string](#string) | | | -| cpu_cores | [uint32](#uint32) | | | -| apic_id | [string](#string) | | | -| initial_apic_id | [string](#string) | | | -| fpu | [string](#string) | | | -| fpu_exception | [string](#string) | | | -| cpu_id_level | [uint32](#uint32) | | | -| wp | [string](#string) | | | -| flags | [string](#string) | repeated | | -| bugs | [string](#string) | repeated | | -| bogo_mips | [double](#double) | | | -| cl_flush_size | [uint32](#uint32) | | | -| cache_alignment | [uint32](#uint32) | | | -| address_sizes | [string](#string) | | | -| power_management | [string](#string) | | | - - - - - - - - -### CPUInfoResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [CPUsInfo](#machine.CPUsInfo) | repeated | | - - - - - - - - -### CPUStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| user | [double](#double) | | | -| nice | [double](#double) | | | -| system | [double](#double) | | | -| idle | [double](#double) | | | -| iowait | [double](#double) | | | -| irq | [double](#double) | | | -| soft_irq | [double](#double) | | | -| steal | [double](#double) | | | -| guest | [double](#double) | | | -| guest_nice | [double](#double) | | | - - - - - - - - -### CPUsInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| cpu_info | [CPUInfo](#machine.CPUInfo) | repeated | | - - - - - - - - -### ClusterConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| control_plane | [ControlPlaneConfig](#machine.ControlPlaneConfig) | | | -| cluster_network | [ClusterNetworkConfig](#machine.ClusterNetworkConfig) | | | -| allow_scheduling_on_masters | [bool](#bool) | | | - - - - - - - - -### ClusterNetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| dns_domain | [string](#string) | | | -| cni_config | [CNIConfig](#machine.CNIConfig) | | | - - - - - - - - -### ConfigLoadErrorEvent -ConfigLoadErrorEvent is reported when the config loading has failed. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| error | [string](#string) | | | - - - - - - - - -### ConfigValidationErrorEvent -ConfigValidationErrorEvent is reported when config validation has failed. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| error | [string](#string) | | | - - - - - - - - -### Container -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| containers | [ContainerInfo](#machine.ContainerInfo) | repeated | | - - - - - - - - -### ContainerInfo -The messages message containing the requested containers. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| image | [string](#string) | | | -| pid | [uint32](#uint32) | | | -| status | [string](#string) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### ContainersRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### ContainersResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Container](#machine.Container) | repeated | | - - - - - - - - -### ControlPlaneConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| endpoint | [string](#string) | | | - - - - - - - - -### CopyRequest -CopyRequest describes a request to copy data out of Talos node - -Copy produces .tar.gz archive which is streamed back to the caller - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root_path | [string](#string) | | Root path to start copying data out, it might be either a file or directory | - - - - - - - - -### DHCPOptionsConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| route_metric | [uint32](#uint32) | | | - - - - - - - - -### DiskStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| read_completed | [uint64](#uint64) | | | -| read_merged | [uint64](#uint64) | | | -| read_sectors | [uint64](#uint64) | | | -| read_time_ms | [uint64](#uint64) | | | -| write_completed | [uint64](#uint64) | | | -| write_merged | [uint64](#uint64) | | | -| write_sectors | [uint64](#uint64) | | | -| write_time_ms | [uint64](#uint64) | | | -| io_in_progress | [uint64](#uint64) | | | -| io_time_ms | [uint64](#uint64) | | | -| io_time_weighted_ms | [uint64](#uint64) | | | -| discard_completed | [uint64](#uint64) | | | -| discard_merged | [uint64](#uint64) | | | -| discard_sectors | [uint64](#uint64) | | | -| discard_time_ms | [uint64](#uint64) | | | - - - - - - - - -### DiskStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [DiskStat](#machine.DiskStat) | | | -| devices | [DiskStat](#machine.DiskStat) | repeated | | - - - - - - - - -### DiskStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [DiskStats](#machine.DiskStats) | repeated | | - - - - - - - - -### DiskUsageInfo -DiskUsageInfo describes a file or directory's information for du command - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | - - - - - - - - -### DiskUsageRequest -DiskUsageRequest describes a request to list disk usage of directories and regular files - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| all | [bool](#bool) | | All write sizes for all files, not just directories. | -| threshold | [int64](#int64) | | Threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative. | -| paths | [string](#string) | repeated | DiskUsagePaths is the list of directories to calculate disk usage for. | - - - - - - - - -### DmesgRequest -dmesg - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| follow | [bool](#bool) | | | -| tail | [bool](#bool) | | | - - - - - - - - -### EtcdForfeitLeadership - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| member | [string](#string) | | | - - - - - - - - -### EtcdForfeitLeadershipRequest - - - - - - - - - -### EtcdForfeitLeadershipResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) | repeated | | - - - - - - - - -### EtcdLeaveCluster - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdLeaveClusterRequest - - - - - - - - - -### EtcdLeaveClusterResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdLeaveCluster](#machine.EtcdLeaveCluster) | repeated | | - - - - - - - - -### EtcdMember -EtcdMember describes a single etcd member. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [uint64](#uint64) | | member ID. | -| hostname | [string](#string) | | human-readable name of the member. | -| peer_urls | [string](#string) | repeated | the list of URLs the member exposes to clients for communication. | -| client_urls | [string](#string) | repeated | the list of URLs the member exposes to the cluster for communication. | -| is_learner | [bool](#bool) | | learner flag | - - - - - - - - -### EtcdMemberListRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| query_local | [bool](#bool) | | | - - - - - - - - -### EtcdMemberListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdMembers](#machine.EtcdMembers) | repeated | | - - - - - - - - -### EtcdMembers -EtcdMembers contains the list of members registered on the host. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| legacy_members | [string](#string) | repeated | list of member hostnames. | -| members | [EtcdMember](#machine.EtcdMember) | repeated | the list of etcd members registered on the node. | - - - - - - - - -### EtcdRecover - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRecoverResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRecover](#machine.EtcdRecover) | repeated | | - - - - - - - - -### EtcdRemoveMember - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### EtcdRemoveMemberRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| member | [string](#string) | | | - - - - - - - - -### EtcdRemoveMemberResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [EtcdRemoveMember](#machine.EtcdRemoveMember) | repeated | | - - - - - - - - -### EtcdSnapshotRequest - - - - - - - - - -### Event - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [google.protobuf.Any](#google.protobuf.Any) | | | -| id | [string](#string) | | | - - - - - - - - -### EventsRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tail_events | [int32](#int32) | | | -| tail_id | [string](#string) | | | -| tail_seconds | [int32](#int32) | | | - - - - - - - - -### FeaturesInfo -FeaturesInfo describes individual Talos features that can be switched on or off. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| rbac | [bool](#bool) | | RBAC is true if role-based access control is enabled. | - - - - - - - - -### FileInfo -FileInfo describes a file or directory's information - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| name | [string](#string) | | Name is the name (including prefixed path) of the file or directory | -| size | [int64](#int64) | | Size indicates the number of bytes contained within the file | -| mode | [uint32](#uint32) | | Mode is the bitmap of UNIX mode/permission flags of the file | -| modified | [int64](#int64) | | Modified indicates the UNIX timestamp at which the file was last modified | -| is_dir | [bool](#bool) | | IsDir indicates that the file is a directory | -| error | [string](#string) | | Error describes any error encountered while trying to read the file information. | -| link | [string](#string) | | Link is filled with symlink target | -| relative_name | [string](#string) | | RelativeName is the name of the file or directory relative to the RootPath | -| uid | [uint32](#uint32) | | Owner uid | -| gid | [uint32](#uint32) | | Owner gid | - - - - - - - - -### GenerateClientConfiguration - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ca | [bytes](#bytes) | | PEM-encoded CA certificate. | -| crt | [bytes](#bytes) | | PEM-encoded generated client certificate. | -| key | [bytes](#bytes) | | PEM-encoded generated client key. | -| talosconfig | [bytes](#bytes) | | Client configuration (talosconfig) file content. | - - - - - - - - -### GenerateClientConfigurationRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| roles | [string](#string) | repeated | Roles in the generated client certificate. | -| crt_ttl | [google.protobuf.Duration](#google.protobuf.Duration) | | Client certificate TTL. | - - - - - - - - -### GenerateClientConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateClientConfiguration](#machine.GenerateClientConfiguration) | repeated | | - - - - - - - - -### GenerateConfiguration -GenerateConfiguration describes the response to a generate configuration request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| data | [bytes](#bytes) | repeated | | -| talosconfig | [bytes](#bytes) | | | - - - - - - - - -### GenerateConfigurationRequest -GenerateConfigurationRequest describes a request to generate a new configuration -on a node. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| config_version | [string](#string) | | | -| cluster_config | [ClusterConfig](#machine.ClusterConfig) | | | -| machine_config | [MachineConfig](#machine.MachineConfig) | | | -| override_time | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### GenerateConfigurationResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [GenerateConfiguration](#machine.GenerateConfiguration) | repeated | | - - - - - - - - -### Hostname - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| hostname | [string](#string) | | | - - - - - - - - -### HostnameResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Hostname](#machine.Hostname) | repeated | | - - - - - - - - -### InstallConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| install_disk | [string](#string) | | | -| install_image | [string](#string) | | | - - - - - - - - -### ListRequest -ListRequest describes a request to list the contents of a directory. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| root | [string](#string) | | Root indicates the root directory for the list. If not indicated, '/' is presumed. | -| recurse | [bool](#bool) | | Recurse indicates that subdirectories should be recursed. | -| recursion_depth | [int32](#int32) | | RecursionDepth indicates how many levels of subdirectories should be recursed. The default (0) indicates that no limit should be enforced. | -| types | [ListRequest.Type](#machine.ListRequest.Type) | repeated | Types indicates what file type should be returned. If not indicated, all files will be returned. | - - - - - - - - -### LoadAvg - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| load1 | [double](#double) | | | -| load5 | [double](#double) | | | -| load15 | [double](#double) | | | - - - - - - - - -### LoadAvgResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [LoadAvg](#machine.LoadAvg) | repeated | | - - - - - - - - -### LogsRequest -rpc logs -The request message containing the process name. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | -| follow | [bool](#bool) | | | -| tail_lines | [int32](#int32) | | | - - - - - - - - -### MachineConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| type | [MachineConfig.MachineType](#machine.MachineConfig.MachineType) | | | -| install_config | [InstallConfig](#machine.InstallConfig) | | | -| network_config | [NetworkConfig](#machine.NetworkConfig) | | | -| kubernetes_version | [string](#string) | | | - - - - - - - - -### MemInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| memtotal | [uint64](#uint64) | | | -| memfree | [uint64](#uint64) | | | -| memavailable | [uint64](#uint64) | | | -| buffers | [uint64](#uint64) | | | -| cached | [uint64](#uint64) | | | -| swapcached | [uint64](#uint64) | | | -| active | [uint64](#uint64) | | | -| inactive | [uint64](#uint64) | | | -| activeanon | [uint64](#uint64) | | | -| inactiveanon | [uint64](#uint64) | | | -| activefile | [uint64](#uint64) | | | -| inactivefile | [uint64](#uint64) | | | -| unevictable | [uint64](#uint64) | | | -| mlocked | [uint64](#uint64) | | | -| swaptotal | [uint64](#uint64) | | | -| swapfree | [uint64](#uint64) | | | -| dirty | [uint64](#uint64) | | | -| writeback | [uint64](#uint64) | | | -| anonpages | [uint64](#uint64) | | | -| mapped | [uint64](#uint64) | | | -| shmem | [uint64](#uint64) | | | -| slab | [uint64](#uint64) | | | -| sreclaimable | [uint64](#uint64) | | | -| sunreclaim | [uint64](#uint64) | | | -| kernelstack | [uint64](#uint64) | | | -| pagetables | [uint64](#uint64) | | | -| nfsunstable | [uint64](#uint64) | | | -| bounce | [uint64](#uint64) | | | -| writebacktmp | [uint64](#uint64) | | | -| commitlimit | [uint64](#uint64) | | | -| committedas | [uint64](#uint64) | | | -| vmalloctotal | [uint64](#uint64) | | | -| vmallocused | [uint64](#uint64) | | | -| vmallocchunk | [uint64](#uint64) | | | -| hardwarecorrupted | [uint64](#uint64) | | | -| anonhugepages | [uint64](#uint64) | | | -| shmemhugepages | [uint64](#uint64) | | | -| shmempmdmapped | [uint64](#uint64) | | | -| cmatotal | [uint64](#uint64) | | | -| cmafree | [uint64](#uint64) | | | -| hugepagestotal | [uint64](#uint64) | | | -| hugepagesfree | [uint64](#uint64) | | | -| hugepagesrsvd | [uint64](#uint64) | | | -| hugepagessurp | [uint64](#uint64) | | | -| hugepagesize | [uint64](#uint64) | | | -| directmap4k | [uint64](#uint64) | | | -| directmap2m | [uint64](#uint64) | | | -| directmap1g | [uint64](#uint64) | | | - - - - - - - - -### Memory - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| meminfo | [MemInfo](#machine.MemInfo) | | | - - - - - - - - -### MemoryResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Memory](#machine.Memory) | repeated | | - - - - - - - - -### MountStat -The messages message containing the requested processes. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| filesystem | [string](#string) | | | -| size | [uint64](#uint64) | | | -| available | [uint64](#uint64) | | | -| mounted_on | [string](#string) | | | - - - - - - - - -### Mounts -The messages message containing the requested df stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [MountStat](#machine.MountStat) | repeated | | - - - - - - - - -### MountsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Mounts](#machine.Mounts) | repeated | | - - - - - - - - -### NetDev - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| rx_bytes | [uint64](#uint64) | | | -| rx_packets | [uint64](#uint64) | | | -| rx_errors | [uint64](#uint64) | | | -| rx_dropped | [uint64](#uint64) | | | -| rx_fifo | [uint64](#uint64) | | | -| rx_frame | [uint64](#uint64) | | | -| rx_compressed | [uint64](#uint64) | | | -| rx_multicast | [uint64](#uint64) | | | -| tx_bytes | [uint64](#uint64) | | | -| tx_packets | [uint64](#uint64) | | | -| tx_errors | [uint64](#uint64) | | | -| tx_dropped | [uint64](#uint64) | | | -| tx_fifo | [uint64](#uint64) | | | -| tx_collisions | [uint64](#uint64) | | | -| tx_carrier | [uint64](#uint64) | | | -| tx_compressed | [uint64](#uint64) | | | - - - - - - - - -### NetworkConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hostname | [string](#string) | | | -| interfaces | [NetworkDeviceConfig](#machine.NetworkDeviceConfig) | repeated | | - - - - - - - - -### NetworkDeviceConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| interface | [string](#string) | | | -| cidr | [string](#string) | | | -| mtu | [int32](#int32) | | | -| dhcp | [bool](#bool) | | | -| ignore | [bool](#bool) | | | -| dhcp_options | [DHCPOptionsConfig](#machine.DHCPOptionsConfig) | | | -| routes | [RouteConfig](#machine.RouteConfig) | repeated | | - - - - - - - - -### NetworkDeviceStats - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| total | [NetDev](#machine.NetDev) | | | -| devices | [NetDev](#machine.NetDev) | repeated | | - - - - - - - - -### NetworkDeviceStatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [NetworkDeviceStats](#machine.NetworkDeviceStats) | repeated | | - - - - - - - - -### PhaseEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| phase | [string](#string) | | | -| action | [PhaseEvent.Action](#machine.PhaseEvent.Action) | | | - - - - - - - - -### PlatformInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| name | [string](#string) | | | -| mode | [string](#string) | | | - - - - - - - - -### Process - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| processes | [ProcessInfo](#machine.ProcessInfo) | repeated | | - - - - - - - - -### ProcessInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| pid | [int32](#int32) | | | -| ppid | [int32](#int32) | | | -| state | [string](#string) | | | -| threads | [int32](#int32) | | | -| cpu_time | [double](#double) | | | -| virtual_memory | [uint64](#uint64) | | | -| resident_memory | [uint64](#uint64) | | | -| command | [string](#string) | | | -| executable | [string](#string) | | | -| args | [string](#string) | | | - - - - - - - - -### ProcessesResponse -rpc processes - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Process](#machine.Process) | repeated | | - - - - - - - - -### ReadRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| path | [string](#string) | | | - - - - - - - - -### Reboot -The reboot message containing the reboot status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RebootRequest -rpc reboot - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| mode | [RebootRequest.Mode](#machine.RebootRequest.Mode) | | | - - - - - - - - -### RebootResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reboot](#machine.Reboot) | repeated | | - - - - - - - - -### Reset -The reset message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ResetPartitionSpec -rpc reset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| label | [string](#string) | | | -| wipe | [bool](#bool) | | | - - - - - - - - -### ResetRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| graceful | [bool](#bool) | | Graceful indicates whether node should leave etcd before the upgrade, it also enforces etcd checks before leaving. | -| reboot | [bool](#bool) | | Reboot indicates whether node should reboot or halt after resetting. | -| system_partitions_to_wipe | [ResetPartitionSpec](#machine.ResetPartitionSpec) | repeated | System_partitions_to_wipe lists specific system disk partitions to be reset (wiped). If system_partitions_to_wipe is empty, all the partitions are erased. | - - - - - - - - -### ResetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Reset](#machine.Reset) | repeated | | - - - - - - - - -### Restart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RestartEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| cmd | [int64](#int64) | | | - - - - - - - - -### RestartRequest -rpc restart -The request message containing the process to restart. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### RestartResponse -The messages message containing the restart status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Restart](#machine.Restart) | repeated | | - - - - - - - - -### Rollback - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### RollbackRequest -rpc rollback - - - - - - - - -### RollbackResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Rollback](#machine.Rollback) | repeated | | - - - - - - - - -### RouteConfig - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| network | [string](#string) | | | -| gateway | [string](#string) | | | -| metric | [uint32](#uint32) | | | - - - - - - - - -### SequenceEvent -rpc events - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| sequence | [string](#string) | | | -| action | [SequenceEvent.Action](#machine.SequenceEvent.Action) | | | -| error | [common.Error](#common.Error) | | | - - - - - - - - -### ServiceEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| msg | [string](#string) | | | -| state | [string](#string) | | | -| ts | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceEvents - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| events | [ServiceEvent](#machine.ServiceEvent) | repeated | | - - - - - - - - -### ServiceHealth - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| unknown | [bool](#bool) | | | -| healthy | [bool](#bool) | | | -| last_message | [string](#string) | | | -| last_change | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### ServiceInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | -| state | [string](#string) | | | -| events | [ServiceEvents](#machine.ServiceEvents) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceList -rpc servicelist - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| services | [ServiceInfo](#machine.ServiceInfo) | repeated | | - - - - - - - - -### ServiceListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceList](#machine.ServiceList) | repeated | | - - - - - - - - -### ServiceRestart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceRestartRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceRestartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceRestart](#machine.ServiceRestart) | repeated | | - - - - - - - - -### ServiceStart - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStartRequest -rpc servicestart - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStartResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStart](#machine.ServiceStart) | repeated | | - - - - - - - - -### ServiceStateEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| service | [string](#string) | | | -| action | [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) | | | -| message | [string](#string) | | | -| health | [ServiceHealth](#machine.ServiceHealth) | | | - - - - - - - - -### ServiceStop - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| resp | [string](#string) | | | - - - - - - - - -### ServiceStopRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| id | [string](#string) | | | - - - - - - - - -### ServiceStopResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [ServiceStop](#machine.ServiceStop) | repeated | | - - - - - - - - -### Shutdown -rpc shutdown -The messages message containing the shutdown status. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | - - - - - - - - -### ShutdownRequest - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| force | [bool](#bool) | | Force indicates whether node should shutdown without first cordening and draining | - - - - - - - - -### ShutdownResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Shutdown](#machine.Shutdown) | repeated | | - - - - - - - - -### SoftIRQStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| hi | [uint64](#uint64) | | | -| timer | [uint64](#uint64) | | | -| net_tx | [uint64](#uint64) | | | -| net_rx | [uint64](#uint64) | | | -| block | [uint64](#uint64) | | | -| block_io_poll | [uint64](#uint64) | | | -| tasklet | [uint64](#uint64) | | | -| sched | [uint64](#uint64) | | | -| hrtimer | [uint64](#uint64) | | | -| rcu | [uint64](#uint64) | | | - - - - - - - - -### Stat -The messages message containing the requested stat. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| id | [string](#string) | | | -| memory_usage | [uint64](#uint64) | | | -| cpu_usage | [uint64](#uint64) | | | -| pod_id | [string](#string) | | | -| name | [string](#string) | | | - - - - - - - - -### Stats -The messages message containing the requested stats. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| stats | [Stat](#machine.Stat) | repeated | | - - - - - - - - -### StatsRequest -The request message containing the containerd namespace. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| driver | [common.ContainerDriver](#common.ContainerDriver) | | driver might be default "containerd" or "cri" | - - - - - - - - -### StatsResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Stats](#machine.Stats) | repeated | | - - - - - - - - -### SystemStat - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| boot_time | [uint64](#uint64) | | | -| cpu_total | [CPUStat](#machine.CPUStat) | | | -| cpu | [CPUStat](#machine.CPUStat) | repeated | | -| irq_total | [uint64](#uint64) | | | -| irq | [uint64](#uint64) | repeated | | -| context_switches | [uint64](#uint64) | | | -| process_created | [uint64](#uint64) | | | -| process_running | [uint64](#uint64) | | | -| process_blocked | [uint64](#uint64) | | | -| soft_irq_total | [uint64](#uint64) | | | -| soft_irq | [SoftIRQStat](#machine.SoftIRQStat) | | | - - - - - - - - -### SystemStatResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [SystemStat](#machine.SystemStat) | repeated | | - - - - - - - - -### TaskEvent - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| task | [string](#string) | | | -| action | [TaskEvent.Action](#machine.TaskEvent.Action) | | | - - - - - - - - -### Upgrade - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| ack | [string](#string) | | | - - - - - - - - -### UpgradeRequest -rpc upgrade - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| image | [string](#string) | | | -| preserve | [bool](#bool) | | | -| stage | [bool](#bool) | | | -| force | [bool](#bool) | | | - - - - - - - - -### UpgradeResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Upgrade](#machine.Upgrade) | repeated | | - - - - - - - - -### Version - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| version | [VersionInfo](#machine.VersionInfo) | | | -| platform | [PlatformInfo](#machine.PlatformInfo) | | | -| features | [FeaturesInfo](#machine.FeaturesInfo) | | Features describe individual Talos features that can be switched on or off. | - - - - - - - - -### VersionInfo - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| tag | [string](#string) | | | -| sha | [string](#string) | | | -| built | [string](#string) | | | -| go_version | [string](#string) | | | -| os | [string](#string) | | | -| arch | [string](#string) | | | - - - - - - - - -### VersionResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Version](#machine.Version) | repeated | | - - - - - - - - - - -### ApplyConfigurationRequest.Mode - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REBOOT | 0 | | -| AUTO | 1 | | -| NO_REBOOT | 2 | | -| STAGED | 3 | | - - - - - -### ListRequest.Type -File type. - -| Name | Number | Description | -| ---- | ------ | ----------- | -| REGULAR | 0 | Regular file (not directory, symlink, etc). | -| DIRECTORY | 1 | Directory. | -| SYMLINK | 2 | Symbolic link. | - - - - - -### MachineConfig.MachineType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| TYPE_UNKNOWN | 0 | | -| TYPE_INIT | 1 | | -| TYPE_CONTROL_PLANE | 2 | | -| TYPE_WORKER | 3 | | - - - - - -### PhaseEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - -### RebootRequest.Mode - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| DEFAULT | 0 | | -| POWERCYCLE | 1 | | - - - - - -### SequenceEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| NOOP | 0 | | -| START | 1 | | -| STOP | 2 | | - - - - - -### ServiceStateEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| INITIALIZED | 0 | | -| PREPARING | 1 | | -| WAITING | 2 | | -| RUNNING | 3 | | -| STOPPING | 4 | | -| FINISHED | 5 | | -| FAILED | 6 | | -| SKIPPED | 7 | | - - - - - -### TaskEvent.Action - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| START | 0 | | -| STOP | 1 | | - - - - - - - - - -### MachineService -The machine service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) | | -| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | Bootstrap method makes control plane node enter etcd bootstrap mode. - -Node aborts etcd join sequence and creates single-node etcd cluster. - -If recover_etcd argument is specified, etcd is recovered from a snapshot uploaded with EtcdRecover. | -| Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) | | -| Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream | | -| CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) | | -| DiskStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [DiskStatsResponse](#machine.DiskStatsResponse) | | -| Dmesg | [DmesgRequest](#machine.DmesgRequest) | [.common.Data](#common.Data) stream | | -| Events | [EventsRequest](#machine.EventsRequest) | [Event](#machine.Event) stream | | -| EtcdMemberList | [EtcdMemberListRequest](#machine.EtcdMemberListRequest) | [EtcdMemberListResponse](#machine.EtcdMemberListResponse) | | -| EtcdRemoveMember | [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) | [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) | | -| EtcdLeaveCluster | [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) | [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) | | -| EtcdForfeitLeadership | [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) | [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) | | -| EtcdRecover | [.common.Data](#common.Data) stream | [EtcdRecoverResponse](#machine.EtcdRecoverResponse) | EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot to the node. - -Snapshot can be later used to recover the cluster via Bootstrap method. | -| EtcdSnapshot | [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) | [.common.Data](#common.Data) stream | EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance and streams it back to the client. - -This method is available only on control plane nodes (which run etcd). | -| GenerateConfiguration | [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) | [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) | | -| Hostname | [.google.protobuf.Empty](#google.protobuf.Empty) | [HostnameResponse](#machine.HostnameResponse) | | -| Kubeconfig | [.google.protobuf.Empty](#google.protobuf.Empty) | [.common.Data](#common.Data) stream | | -| List | [ListRequest](#machine.ListRequest) | [FileInfo](#machine.FileInfo) stream | | -| DiskUsage | [DiskUsageRequest](#machine.DiskUsageRequest) | [DiskUsageInfo](#machine.DiskUsageInfo) stream | | -| LoadAvg | [.google.protobuf.Empty](#google.protobuf.Empty) | [LoadAvgResponse](#machine.LoadAvgResponse) | | -| Logs | [LogsRequest](#machine.LogsRequest) | [.common.Data](#common.Data) stream | | -| Memory | [.google.protobuf.Empty](#google.protobuf.Empty) | [MemoryResponse](#machine.MemoryResponse) | | -| Mounts | [.google.protobuf.Empty](#google.protobuf.Empty) | [MountsResponse](#machine.MountsResponse) | | -| NetworkDeviceStats | [.google.protobuf.Empty](#google.protobuf.Empty) | [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) | | -| Processes | [.google.protobuf.Empty](#google.protobuf.Empty) | [ProcessesResponse](#machine.ProcessesResponse) | | -| Read | [ReadRequest](#machine.ReadRequest) | [.common.Data](#common.Data) stream | | -| Reboot | [RebootRequest](#machine.RebootRequest) | [RebootResponse](#machine.RebootResponse) | | -| Restart | [RestartRequest](#machine.RestartRequest) | [RestartResponse](#machine.RestartResponse) | | -| Rollback | [RollbackRequest](#machine.RollbackRequest) | [RollbackResponse](#machine.RollbackResponse) | | -| Reset | [ResetRequest](#machine.ResetRequest) | [ResetResponse](#machine.ResetResponse) | | -| ServiceList | [.google.protobuf.Empty](#google.protobuf.Empty) | [ServiceListResponse](#machine.ServiceListResponse) | | -| ServiceRestart | [ServiceRestartRequest](#machine.ServiceRestartRequest) | [ServiceRestartResponse](#machine.ServiceRestartResponse) | | -| ServiceStart | [ServiceStartRequest](#machine.ServiceStartRequest) | [ServiceStartResponse](#machine.ServiceStartResponse) | | -| ServiceStop | [ServiceStopRequest](#machine.ServiceStopRequest) | [ServiceStopResponse](#machine.ServiceStopResponse) | | -| Shutdown | [ShutdownRequest](#machine.ShutdownRequest) | [ShutdownResponse](#machine.ShutdownResponse) | | -| Stats | [StatsRequest](#machine.StatsRequest) | [StatsResponse](#machine.StatsResponse) | | -| SystemStat | [.google.protobuf.Empty](#google.protobuf.Empty) | [SystemStatResponse](#machine.SystemStatResponse) | | -| Upgrade | [UpgradeRequest](#machine.UpgradeRequest) | [UpgradeResponse](#machine.UpgradeResponse) | | -| Version | [.google.protobuf.Empty](#google.protobuf.Empty) | [VersionResponse](#machine.VersionResponse) | | -| GenerateClientConfiguration | [GenerateClientConfigurationRequest](#machine.GenerateClientConfigurationRequest) | [GenerateClientConfigurationResponse](#machine.GenerateClientConfigurationResponse) | GenerateClientConfiguration generates talosctl client configuration (talosconfig). | - - - - - - -

Top

- -## resource/resource.proto - - - - - -### Get -The GetResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### GetRequest -rpc Get - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | - - - - - - - - -### GetResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Get](#resource.Get) | repeated | | - - - - - - - - -### ListRequest -rpc List -The ListResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | - - - - - - - - -### ListResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - -### Metadata - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| version | [string](#string) | | | -| owner | [string](#string) | | | -| phase | [string](#string) | | | -| created | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| updated | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| finalizers | [string](#string) | repeated | | - - - - - - - - -### Resource - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [Metadata](#resource.Metadata) | | | -| spec | [Spec](#resource.Spec) | | | - - - - - - - - -### Spec - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| yaml | [bytes](#bytes) | | | - - - - - - - - -### WatchRequest -rpc Watch -The WatchResponse message contains the Resource returned. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| namespace | [string](#string) | | | -| type | [string](#string) | | | -| id | [string](#string) | | | -| tail_events | [uint32](#uint32) | | | - - - - - - - - -### WatchResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| event_type | [EventType](#resource.EventType) | | | -| definition | [Resource](#resource.Resource) | | | -| resource | [Resource](#resource.Resource) | | | - - - - - - - - - - -### EventType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| CREATED | 0 | | -| UPDATED | 1 | | -| DESTROYED | 2 | | - - - - - - - - - -### ResourceService -The resource service definition. - -ResourceService provides user-facing API for the Talos resources. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Get | [GetRequest](#resource.GetRequest) | [GetResponse](#resource.GetResponse) | | -| List | [ListRequest](#resource.ListRequest) | [ListResponse](#resource.ListResponse) stream | | -| Watch | [WatchRequest](#resource.WatchRequest) | [WatchResponse](#resource.WatchResponse) stream | | - - - - - - -

Top

- -## security/security.proto - - - - - -### CertificateRequest -The request message containing the certificate signing request. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| csr | [bytes](#bytes) | | Certificate Signing Request in PEM format. | - - - - - - - - -### CertificateResponse -The response message containing signed certificate. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| ca | [bytes](#bytes) | | Certificate of the CA that signed the requested certificate in PEM format. | -| crt | [bytes](#bytes) | | Signed X.509 requested certificate in PEM format. | - - - - - - - - - - - - - - -### SecurityService -The security service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Certificate | [CertificateRequest](#securityapi.CertificateRequest) | [CertificateResponse](#securityapi.CertificateResponse) | | - - - - - - -

Top

- -## storage/storage.proto - - - - - -### Disk -Disk represents a disk. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| size | [uint64](#uint64) | | Size indicates the disk size in bytes. | -| model | [string](#string) | | Model idicates the disk model. | -| device_name | [string](#string) | | DeviceName indicates the disk name (e.g. `sda`). | -| name | [string](#string) | | Name as in `/sys/block//device/name`. | -| serial | [string](#string) | | Serial as in `/sys/block//device/serial`. | -| modalias | [string](#string) | | Modalias as in `/sys/block//device/modalias`. | -| uuid | [string](#string) | | Uuid as in `/sys/block//device/uuid`. | -| wwid | [string](#string) | | Wwid as in `/sys/block//device/wwid`. | -| type | [Disk.DiskType](#storage.Disk.DiskType) | | Type is a type of the disk: nvme, ssd, hdd, sd card. | -| bus_path | [string](#string) | | BusPath is the bus path of the disk. | - - - - - - - - -### Disks -DisksResponse represents the response of the `Disks` RPC. - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| disks | [Disk](#storage.Disk) | repeated | | - - - - - - - - -### DisksResponse - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Disks](#storage.Disks) | repeated | | - - - - - - - - - - -### Disk.DiskType - - -| Name | Number | Description | -| ---- | ------ | ----------- | -| UNKNOWN | 0 | | -| SSD | 1 | | -| HDD | 2 | | -| NVME | 3 | | -| SD | 4 | | - - - - - - - - - -### StorageService -StorageService represents the storage service. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Disks | [.google.protobuf.Empty](#google.protobuf.Empty) | [DisksResponse](#storage.DisksResponse) | | - - - - - - -

Top

- -## time/time.proto - - - - - -### Time - - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| metadata | [common.Metadata](#common.Metadata) | | | -| server | [string](#string) | | | -| localtime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | -| remotetime | [google.protobuf.Timestamp](#google.protobuf.Timestamp) | | | - - - - - - - - -### TimeRequest -The response message containing the ntp server - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| server | [string](#string) | | | - - - - - - - - -### TimeResponse -The response message containing the ntp server, time, and offset - - -| Field | Type | Label | Description | -| ----- | ---- | ----- | ----------- | -| messages | [Time](#time.Time) | repeated | | - - - - - - - - - - - - - - -### TimeService -The time service definition. - -| Method Name | Request Type | Response Type | Description | -| ----------- | ------------ | ------------- | ------------| -| Time | [.google.protobuf.Empty](#google.protobuf.Empty) | [TimeResponse](#time.TimeResponse) | | -| TimeCheck | [TimeRequest](#time.TimeRequest) | [TimeResponse](#time.TimeResponse) | | - - - - - -## Scalar Value Types - -| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby | -| ----------- | ----- | --- | ---- | ------ | -- | -- | --- | ---- | -| double | | double | double | float | float64 | double | float | Float | -| float | | float | float | float | float32 | float | float | Float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) | -| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) | -| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) | -| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum | -| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) | -| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum | -| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass | -| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) | -| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) | - diff --git a/website/content/v1.0/reference/cli.md b/website/content/v1.0/reference/cli.md deleted file mode 100644 index 9695aa170..000000000 --- a/website/content/v1.0/reference/cli.md +++ /dev/null @@ -1,2165 +0,0 @@ ---- -title: "CLI" -description: "Talosctl CLI tool reference." ---- - - - -## talosctl apply-config - -Apply a new configuration to a node - -``` -talosctl apply-config [flags] -``` - -### Options - -``` - --cert-fingerprint strings list of server certificate fingeprints to accept (defaults to no check) - -f, --file string the filename of the updated configuration - -h, --help help for apply-config - -i, --insecure apply the config using the insecure (encrypted with no auth) maintenance service - -m, --mode auto, interactive, no-reboot, reboot, staged apply config mode (default auto) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl bootstrap - -Bootstrap the etcd cluster on the specified node. - -### Synopsis - -When Talos cluster is created etcd service on control plane nodes enter the join loop waiting -to join etcd peers from other control plane nodes. One node should be picked as the boostrap node. -When boostrap command is issued, the node aborts join process and bootstraps etcd cluster as a single node cluster. -Other control plane nodes will join etcd cluster once Kubernetes is boostrapped on the bootstrap node. - -This command should not be used when "init" type node are used. - -Talos etcd cluster can be recovered from a known snapshot with '--recover-from=' flag. - -``` -talosctl bootstrap [flags] -``` - -### Options - -``` - -h, --help help for bootstrap - --recover-from string recover etcd cluster from the snapshot - --recover-skip-hash-check skip integrity check when recovering etcd (use when recovering from data directory copy) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl cluster create - -Creates a local docker-based or QEMU-based kubernetes cluster - -``` -talosctl cluster create [flags] -``` - -### Options - -``` - --arch string cluster architecture (default "amd64") - --bad-rtc launch VM with bad RTC state (QEMU only) - --cidr string CIDR of the cluster network (IPv4, ULA network for IPv6 is derived in automated way) (default "10.5.0.0/24") - --cni-bin-path strings search path for CNI binaries (VM only) (default [/home/user/.talos/cni/bin]) - --cni-bundle-url string URL to download CNI bundle from (VM only) (default "https://github.com/siderolabs/talos/releases/download/v0.15.0-alpha.2/talosctl-cni-bundle-${ARCH}.tar.gz") - --cni-cache-dir string CNI cache directory path (VM only) (default "/home/user/.talos/cni/cache") - --cni-conf-dir string CNI config directory path (VM only) (default "/home/user/.talos/cni/conf.d") - --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file - --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) - --cpus string the share of CPUs as fraction (each control plane/VM) (default "2.0") - --cpus-workers string the share of CPUs as fraction (each worker/VM) (default "2.0") - --crashdump print debug crashdump to stderr when cluster startup fails - --custom-cni-url string install custom CNI from the URL (Talos cluster) - --disk int default limit on disk size in MB (each VM) (default 6144) - --disk-image-path string disk image to use - --dns-domain string the dns domain to use for cluster (default "cluster.local") - --docker-host-ip string Host IP to forward exposed ports to (Docker provisioner only) (default "0.0.0.0") - --encrypt-ephemeral enable ephemeral partition encryption - --encrypt-state enable state partition encryption - --endpoint string use endpoint instead of provider defaults - -p, --exposed-ports string Comma-separated list of ports/protocols to expose on init node. Ex -p :/ (Docker provisioner only) - --extra-boot-kernel-args string add extra kernel args to the initial boot from vmlinuz and initramfs (QEMU only) - --extra-disks int number of extra disks to create for each worker VM - --extra-disks-size int default limit on disk size in MB (each VM) (default 5120) - --extra-uefi-search-paths strings additional search paths for UEFI firmware (only applies when UEFI is enabled) - -h, --help help for create - --image string the image to use (default "ghcr.io/siderolabs/talos:latest") - --init-node-as-endpoint use init node as endpoint instead of any load balancer endpoint - --initrd-path string initramfs image to use (default "_out/initramfs-${ARCH}.xz") - -i, --input-dir string location of pre-generated config files - --install-image string the installer image to use (default "ghcr.io/siderolabs/installer:latest") - --ipv4 enable IPv4 network in the cluster (default true) - --ipv6 enable IPv6 network in the cluster (QEMU provisioner only) - --iso-path string the ISO path to use for the initial boot (VM only) - --kubernetes-version string desired kubernetes version to run (default "1.23.5") - --masters int the number of masters to create (default 1) - --memory int the limit on memory usage in MB (each control plane/VM) (default 2048) - --memory-workers int the limit on memory usage in MB (each worker/VM) (default 2048) - --mtu int MTU of the cluster network (default 1500) - --nameservers strings list of nameservers to use (default [8.8.8.8,1.1.1.1,2001:4860:4860::8888,2606:4700:4700::1111]) - --registry-insecure-skip-verify strings list of registry hostnames to skip TLS verification for - --registry-mirror strings list of registry mirrors to use in format: = - --skip-injecting-config skip injecting config from embedded metadata server, write config files to current directory - --skip-kubeconfig skip merging kubeconfig from the created cluster - --talos-version string the desired Talos version to generate config for (if not set, defaults to image version) - --use-vip use a virtual IP for the controlplane endpoint instead of the loadbalancer - --user-disk strings list of disks to create for each VM in format: ::: - --vmlinuz-path string the compressed kernel image to use (default "_out/vmlinuz-${ARCH}") - --wait wait for the cluster to be ready before returning (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --wireguard-cidr string CIDR of the wireguard network - --with-apply-config enable apply config when the VM is starting in maintenance mode - --with-bootloader enable bootloader to load kernel and initramfs from disk image after install (default true) - --with-cluster-discovery enable cluster discovery (default true) - --with-debug enable debug in Talos config to send service logs to the console - --with-init-node create the cluster with an init node - --with-kubespan enable KubeSpan system - --with-uefi enable UEFI on x86_64 architecture (default true) - --workers int the number of workers to create (default 1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster destroy - -Destroys a local docker-based or firecracker-based kubernetes cluster - -``` -talosctl cluster destroy [flags] -``` - -### Options - -``` - -h, --help help for destroy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster show - -Shows info about a local provisioned kubernetes cluster - -``` -talosctl cluster show [flags] -``` - -### Options - -``` - -h, --help help for show -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - --name string the name of the cluster (default "talos-default") - -n, --nodes strings target the specified nodes - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters - -## talosctl cluster - -A collection of commands for managing local docker-based or QEMU-based clusters - -### Options - -``` - -h, --help help for cluster - --name string the name of the cluster (default "talos-default") - --provisioner string Talos cluster provisioner to use (default "docker") - --state string directory path to store cluster state (default "/home/user/.talos/clusters") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl cluster create](#talosctl-cluster-create) - Creates a local docker-based or QEMU-based kubernetes cluster -* [talosctl cluster destroy](#talosctl-cluster-destroy) - Destroys a local docker-based or firecracker-based kubernetes cluster -* [talosctl cluster show](#talosctl-cluster-show) - Shows info about a local provisioned kubernetes cluster - -## talosctl completion - -Output shell completion code for the specified shell (bash, fish or zsh) - -### Synopsis - -Output shell completion code for the specified shell (bash, fish or zsh). -The shell code must be evaluated to provide interactive -completion of talosctl commands. This can be done by sourcing it from -the .bash_profile. - -Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2 - -``` -talosctl completion SHELL [flags] -``` - -### Examples - -``` -# Installing bash completion on macOS using homebrew -## If running Bash 3.2 included with macOS - brew install bash-completion -## or, if running Bash 4.1+ - brew install bash-completion@2 -## If talosctl is installed via homebrew, this should start working immediately. -## If you've installed via other means, you may need add the completion to your completion directory - talosctl completion bash > $(brew --prefix)/etc/bash_completion.d/talosctl - -# Installing bash completion on Linux -## If bash-completion is not installed on Linux, please install the 'bash-completion' package -## via your distribution's package manager. -## Load the talosctl completion code for bash into the current shell - source <(talosctl completion bash) -## Write bash completion code to a file and source if from .bash_profile - talosctl completion bash > ~/.talos/completion.bash.inc - printf " - # talosctl shell completion - source '$HOME/.talos/completion.bash.inc' - " >> $HOME/.bash_profile - source $HOME/.bash_profile -# Load the talosctl completion code for fish[1] into the current shell - talosctl completion fish | source -# Set the talosctl completion code for fish[1] to autoload on startup - talosctl completion fish > ~/.config/fish/completions/talosctl.fish -# Load the talosctl completion code for zsh[1] into the current shell - source <(talosctl completion zsh) -# Set the talosctl completion code for zsh[1] to autoload on startup - talosctl completion zsh > "${fpath[1]}/_talosctl" -``` - -### Options - -``` - -h, --help help for completion -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl config add - -Add a new context - -``` -talosctl config add [flags] -``` - -### Options - -``` - --ca string the path to the CA certificate - --crt string the path to the certificate - -h, --help help for add - --key string the path to the key -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config context - -Set the current context - -``` -talosctl config context [flags] -``` - -### Options - -``` - -h, --help help for context -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config contexts - -List defined contexts - -``` -talosctl config contexts [flags] -``` - -### Options - -``` - -h, --help help for contexts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config endpoint - -Set the endpoint(s) for the current context - -``` -talosctl config endpoint ... [flags] -``` - -### Options - -``` - -h, --help help for endpoint -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config info - -Show information about the current context - -``` -talosctl config info [flags] -``` - -### Options - -``` - -h, --help help for info -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config merge - -Merge additional contexts from another client configuration file - -### Synopsis - -Contexts with the same name are renamed while merging configs. - -``` -talosctl config merge [flags] -``` - -### Options - -``` - -h, --help help for merge -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config new - -Generate a new client configuration file - -``` -talosctl config new [] [flags] -``` - -### Options - -``` - --crt-ttl duration certificate TTL (default 87600h0m0s) - -h, --help help for new - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config node - -Set the node(s) for the current context - -``` -talosctl config node ... [flags] -``` - -### Options - -``` - -h, --help help for node -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) - -## talosctl config - -Manage the client configuration file (talosconfig) - -### Options - -``` - -h, --help help for config -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl config add](#talosctl-config-add) - Add a new context -* [talosctl config context](#talosctl-config-context) - Set the current context -* [talosctl config contexts](#talosctl-config-contexts) - List defined contexts -* [talosctl config endpoint](#talosctl-config-endpoint) - Set the endpoint(s) for the current context -* [talosctl config info](#talosctl-config-info) - Show information about the current context -* [talosctl config merge](#talosctl-config-merge) - Merge additional contexts from another client configuration file -* [talosctl config new](#talosctl-config-new) - Generate a new client configuration file -* [talosctl config node](#talosctl-config-node) - Set the node(s) for the current context - -## talosctl conformance kubernetes - -Run Kubernetes conformance tests - -``` -talosctl conformance kubernetes [flags] -``` - -### Options - -``` - -h, --help help for kubernetes - --mode string conformance test mode: [fast, certified] (default "fast") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl conformance](#talosctl-conformance) - Run conformance tests - -## talosctl conformance - -Run conformance tests - -### Options - -``` - -h, --help help for conformance -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl conformance kubernetes](#talosctl-conformance-kubernetes) - Run Kubernetes conformance tests - -## talosctl containers - -List containers - -``` -talosctl containers [flags] -``` - -### Options - -``` - -h, --help help for containers - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl copy - -Copy data out from the node - -### Synopsis - -Creates an .tar.gz archive at the node starting at and -streams it back to the client. - -If '-' is given for , archive is written to stdout. -Otherwise archive is extracted to which should be an empty directory or -talosctl creates a directory if doesn't exist. Command doesn't preserve -ownership and access mode for the files in extract mode, while streamed .tar archive -captures ownership and permission bits. - -``` -talosctl copy -| [flags] -``` - -### Options - -``` - -h, --help help for copy -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dashboard - -Cluster dashboard with real-time metrics - -### Synopsis - -Provide quick UI to navigate through node real-time metrics. - -Keyboard shortcuts: - - - h, : switch one node to the left - - l, : switch one node to the right - - j, : scroll process list down - - k, : scroll process list up - - : scroll process list half page down - - : scroll process list half page up - - : scroll process list one page down - - : scroll process list one page up - - -``` -talosctl dashboard [flags] -``` - -### Options - -``` - -h, --help help for dashboard - -d, --update-interval duration interval between updates (default 3s) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl disks - -Get the list of disks from /sys/block on the machine - -``` -talosctl disks [flags] -``` - -### Options - -``` - -h, --help help for disks - -i, --insecure get disks using the insecure (encrypted with no auth) maintenance service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl dmesg - -Retrieve kernel logs - -``` -talosctl dmesg [flags] -``` - -### Options - -``` - -f, --follow specify if the kernel log should be streamed - -h, --help help for dmesg - --tail specify if only new messages should be sent (makes sense only when combined with --follow) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl edit - -Edit a resource from the default editor. - -### Synopsis - -The edit command allows you to directly edit any API resource -you can retrieve via the command line tools. - -It will open the editor defined by your TALOS_EDITOR, -or EDITOR environment variables, or fall back to 'vi' for Linux -or 'notepad' for Windows. - -``` -talosctl edit [] [flags] -``` - -### Options - -``` - -h, --help help for edit - -m, --mode auto, no-reboot, reboot, staged apply config mode (default auto) - --namespace string resource namespace (default is to use default namespace per resource) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl etcd forfeit-leadership - -Tell node to forfeit etcd cluster leadership - -``` -talosctl etcd forfeit-leadership [flags] -``` - -### Options - -``` - -h, --help help for forfeit-leadership -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd leave - -Tell nodes to leave etcd cluster - -``` -talosctl etcd leave [flags] -``` - -### Options - -``` - -h, --help help for leave -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd members - -Get the list of etcd cluster members - -``` -talosctl etcd members [flags] -``` - -### Options - -``` - -h, --help help for members -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd remove-member - -Remove the node from etcd cluster - -### Synopsis - -Use this command only if you want to remove a member which is in broken state. -If there is no access to the node, or the node can't access etcd to call etcd leave. -Always prefer etcd leave over this command. - -``` -talosctl etcd remove-member [flags] -``` - -### Options - -``` - -h, --help help for remove-member -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd snapshot - -Stream snapshot of the etcd node to the path. - -``` -talosctl etcd snapshot [flags] -``` - -### Options - -``` - -h, --help help for snapshot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl etcd](#talosctl-etcd) - Manage etcd - -## talosctl etcd - -Manage etcd - -### Options - -``` - -h, --help help for etcd -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl etcd forfeit-leadership](#talosctl-etcd-forfeit-leadership) - Tell node to forfeit etcd cluster leadership -* [talosctl etcd leave](#talosctl-etcd-leave) - Tell nodes to leave etcd cluster -* [talosctl etcd members](#talosctl-etcd-members) - Get the list of etcd cluster members -* [talosctl etcd remove-member](#talosctl-etcd-remove-member) - Remove the node from etcd cluster -* [talosctl etcd snapshot](#talosctl-etcd-snapshot) - Stream snapshot of the etcd node to the path. - -## talosctl events - -Stream runtime events - -``` -talosctl events [flags] -``` - -### Options - -``` - --duration duration show events for the past duration interval (one second resolution, default is to show no history) - -h, --help help for events - --since string show events after the specified event ID (default is to show no history) - --tail int32 show specified number of past events (use -1 to show full history, default is to show no history) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl gen ca - -Generates a self-signed X.509 certificate authority - -``` -talosctl gen ca [flags] -``` - -### Options - -``` - -h, --help help for ca - --hours int the hours from now on which the certificate validity period ends (default 87600) - --organization string X.509 distinguished name for the Organization - --rsa generate in RSA format -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen config - -Generates a set of configuration files for Talos cluster - -### Synopsis - -The cluster endpoint is the URL for the Kubernetes API. If you decide to use -a control plane node, common in a single node control plane setup, use port 6443 as -this is the port that the API server binds to on every control plane node. For an HA -setup, usually involving a load balancer, use the IP and port of the load balancer. - -``` -talosctl gen config [flags] -``` - -### Options - -``` - --additional-sans strings additional Subject-Alt-Names for the APIServer certificate - --config-patch stringArray patch generated machineconfigs (applied to all node types), use @file to read a patch from file - --config-patch-control-plane stringArray patch generated machineconfigs (applied to 'init' and 'controlplane' types) - --config-patch-worker stringArray patch generated machineconfigs (applied to 'worker' type) - --dns-domain string the dns domain to use for cluster (default "cluster.local") - -h, --help help for config - --install-disk string the disk to install to (default "/dev/sda") - --install-image string the image used to perform an installation (default "ghcr.io/siderolabs/installer:latest") - --kubernetes-version string desired kubernetes version to run (default "1.23.5") - -o, --output-dir string destination to output generated files - -p, --persist the desired persist value for configs (default true) - --registry-mirror strings list of registry mirrors to use in format: = - --talos-version string the desired Talos version to generate config for (backwards compatibility, e.g. v0.8) - --version string the desired machine config version to generate (default "v1alpha1") - --with-cluster-discovery enable cluster discovery feature (default true) - --with-docs renders all machine configs adding the documentation for each field (default true) - --with-examples renders all machine configs with the commented examples (default true) - --with-kubespan enable KubeSpan feature -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen crt - -Generates an X.509 Ed25519 certificate - -``` -talosctl gen crt [flags] -``` - -### Options - -``` - --ca string path to the PEM encoded CERTIFICATE - --csr string path to the PEM encoded CERTIFICATE REQUEST - -h, --help help for crt - --hours int the hours from now on which the certificate validity period ends (default 24) - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen csr - -Generates a CSR using an Ed25519 private key - -``` -talosctl gen csr [flags] -``` - -### Options - -``` - -h, --help help for csr - --ip string generate the certificate for this IP address - --key string path to the PEM encoded EC or RSA PRIVATE KEY - --roles strings roles (default [os:admin]) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen key - -Generates an Ed25519 private key - -``` -talosctl gen key [flags] -``` - -### Options - -``` - -h, --help help for key - --name string the basename of the generated file -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen keypair - -Generates an X.509 Ed25519 key pair - -``` -talosctl gen keypair [flags] -``` - -### Options - -``` - -h, --help help for keypair - --ip string generate the certificate for this IP address - --organization string X.509 distinguished name for the Organization -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys - -## talosctl gen - -Generate CAs, certificates, and private keys - -### Options - -``` - -h, --help help for gen -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl gen ca](#talosctl-gen-ca) - Generates a self-signed X.509 certificate authority -* [talosctl gen config](#talosctl-gen-config) - Generates a set of configuration files for Talos cluster -* [talosctl gen crt](#talosctl-gen-crt) - Generates an X.509 Ed25519 certificate -* [talosctl gen csr](#talosctl-gen-csr) - Generates a CSR using an Ed25519 private key -* [talosctl gen key](#talosctl-gen-key) - Generates an Ed25519 private key -* [talosctl gen keypair](#talosctl-gen-keypair) - Generates an X.509 Ed25519 key pair - -## talosctl get - -Get a specific resource or list of resources. - -### Synopsis - -Similar to 'kubectl get', 'talosctl get' returns a set of resources from the OS. -To get a list of all available resource definitions, issue 'talosctl get rd' - -``` -talosctl get [] [flags] -``` - -### Options - -``` - -h, --help help for get - -i, --insecure get resources using the insecure (encrypted with no auth) maintenance service - --namespace string resource namespace (default is to use default namespace per resource) - -o, --output string output mode (json, table, yaml) (default "table") - -w, --watch watch resource changes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl health - -Check cluster health - -``` -talosctl health [flags] -``` - -### Options - -``` - --control-plane-nodes strings specify IPs of control plane nodes - -h, --help help for health - --init-node string specify IPs of init node - --k8s-endpoint string use endpoint instead of kubeconfig default - --run-e2e run Kubernetes e2e test - --server run server-side check (default true) - --wait-timeout duration timeout to wait for the cluster to be ready (default 20m0s) - --worker-nodes strings specify IPs of worker nodes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl images - -List the default images used by Talos - -``` -talosctl images [flags] -``` - -### Options - -``` - -h, --help help for images -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl inspect dependencies - -Inspect controller-resource dependencies as graphviz graph. - -### Synopsis - -Inspect controller-resource dependencies as graphviz graph. - -Pipe the output of the command through the "dot" program (part of graphviz package) -to render the graph: - - talosctl inspect dependencies | dot -Tpng > graph.png - - -``` -talosctl inspect dependencies [flags] -``` - -### Options - -``` - -h, --help help for dependencies - --with-resources display live resource information with dependencies -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos - -## talosctl inspect - -Inspect internals of Talos - -### Options - -``` - -h, --help help for inspect -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos -* [talosctl inspect dependencies](#talosctl-inspect-dependencies) - Inspect controller-resource dependencies as graphviz graph. - -## talosctl kubeconfig - -Download the admin kubeconfig from the node - -### Synopsis - -Download the admin kubeconfig from the node. -If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. -Otherwise kubeconfig will be written to PWD or [local-path] if specified. - -``` -talosctl kubeconfig [local-path] [flags] -``` - -### Options - -``` - -f, --force Force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge - --force-context-name string Force context name for kubeconfig merge - -h, --help help for kubeconfig - -m, --merge Merge with existing kubeconfig (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl list - -Retrieve a directory listing - -``` -talosctl list [path] [flags] -``` - -### Options - -``` - -d, --depth int32 maximum recursion depth (default 1) - -h, --help help for list - -H, --humanize humanize size and time in the output - -l, --long display additional file details - -r, --recurse recurse into subdirectories - -t, --type strings filter by specified types: - f regular file - d directory - l, L symbolic link -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl logs - -Retrieve logs for a service - -``` -talosctl logs [flags] -``` - -### Options - -``` - -f, --follow specify if the logs should be streamed - -h, --help help for logs - -k, --kubernetes use the k8s.io containerd namespace - --tail int32 lines of log file to display (default is to show from the beginning) (default -1) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl memory - -Show memory usage - -``` -talosctl memory [flags] -``` - -### Options - -``` - -h, --help help for memory - -v, --verbose display extended memory statistics -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl mounts - -List mounts - -``` -talosctl mounts [flags] -``` - -### Options - -``` - -h, --help help for mounts -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl patch - -Update field(s) of a resource using a JSON patch. - -``` -talosctl patch [] [flags] -``` - -### Options - -``` - -h, --help help for patch - -m, --mode auto, no-reboot, reboot, staged apply config mode (default auto) - --namespace string resource namespace (default is to use default namespace per resource) - -p, --patch stringArray the patch to be applied to the resource file, use @file to read a patch from file. - --patch-file string a file containing a patch to be applied to the resource. -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl processes - -List running processes - -``` -talosctl processes [flags] -``` - -### Options - -``` - -h, --help help for processes - -s, --sort string Column to sort output by. [rss|cpu] (default "rss") - -w, --watch Stream running processes -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl read - -Read a file on the machine - -``` -talosctl read [flags] -``` - -### Options - -``` - -h, --help help for read -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reboot - -Reboot a node - -``` -talosctl reboot [flags] -``` - -### Options - -``` - -h, --help help for reboot - -m, --mode string select the reboot mode: "default", "powercyle" (skips kexec) (default "default") -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl reset - -Reset a node - -``` -talosctl reset [flags] -``` - -### Options - -``` - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - -h, --help help for reset - --reboot if true, reboot the node after resetting instead of shutting down - --system-labels-to-wipe strings if set, just wipe selected system disk partitions by label but keep other partitions intact -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl restart - -Restart a process - -``` -talosctl restart [flags] -``` - -### Options - -``` - -h, --help help for restart - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl rollback - -Rollback a node to the previous installation - -``` -talosctl rollback [flags] -``` - -### Options - -``` - -h, --help help for rollback -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl service - -Retrieve the state of a service (or all services), control service state - -### Synopsis - -Service control command. If run without arguments, lists all the services and their state. -If service ID is specified, default action 'status' is executed which shows status of a single list service. -With actions 'start', 'stop', 'restart', service state is updated respectively. - -``` -talosctl service [ [start|stop|restart|status]] [flags] -``` - -### Options - -``` - -h, --help help for service -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl shutdown - -Shutdown a node - -``` -talosctl shutdown [flags] -``` - -### Options - -``` - --force if true, force a node to shutdown without a cordon/drain - -h, --help help for shutdown -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl stats - -Get container stats - -``` -talosctl stats [flags] -``` - -### Options - -``` - -h, --help help for stats - -k, --kubernetes use the k8s.io containerd namespace -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl support - -Dump debug information about the cluster - -### Synopsis - -Generated bundle contains the following debug information: - -- For each node: - - - Kernel logs. - - All Talos internal services logs. - - All kube-system pods logs. - - Talos COSI resources without secrets. - - COSI runtime state graph. - - Processes snapshot. - - IO pressure snapshot. - - Mounts list. - - PCI devices info. - - Talos version. - -- For the cluster: - - - Kubernetes nodes and kube-system pods manifests. - - -``` -talosctl support [flags] -``` - -### Options - -``` - -h, --help help for support - -w, --num-workers int number of workers per node (default 1) - -O, --output string output file to write support archive to - -v, --verbose verbose output -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl time - -Gets current server time - -``` -talosctl time [--check server] [flags] -``` - -### Options - -``` - -c, --check string checks server time against specified ntp server - -h, --help help for time -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade - -Upgrade Talos on the target node - -``` -talosctl upgrade [flags] -``` - -### Options - -``` - -f, --force force the upgrade (skip checks on etcd health and members, might lead to data loss) - -h, --help help for upgrade - -i, --image string the container image to use for performing the install - -p, --preserve preserve data - -s, --stage stage the upgrade to perform it after a reboot -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl upgrade-k8s - -Upgrade Kubernetes control plane in the Talos cluster. - -### Synopsis - -Command runs upgrade of Kubernetes control plane components between specified versions. - -``` -talosctl upgrade-k8s [flags] -``` - -### Options - -``` - --dry-run skip the actual upgrade and show the upgrade plan instead - --endpoint string the cluster control plane endpoint - --from string the Kubernetes control plane version to upgrade from - -h, --help help for upgrade-k8s - --to string the Kubernetes control plane version to upgrade to (default "1.23.5") - --upgrade-kubelet upgrade kubelet service (default true) -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl usage - -Retrieve a disk usage - -``` -talosctl usage [path1] [path2] ... [pathN] [flags] -``` - -### Options - -``` - -a, --all write counts for all files, not just directories - -d, --depth int32 maximum recursion depth - -h, --help help for usage - -H, --humanize humanize size and time in the output - -t, --threshold int threshold exclude entries smaller than SIZE if positive, or entries greater than SIZE if negative -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl validate - -Validate config - -``` -talosctl validate [flags] -``` - -### Options - -``` - -c, --config string the path of the config file - -h, --help help for validate - -m, --mode string the mode to validate the config for (valid values are metal, cloud, and container) - --strict treat validation warnings as errors -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl version - -Prints the version - -``` -talosctl version [flags] -``` - -### Options - -``` - --client Print client version only - -h, --help help for version - --short Print the short version -``` - -### Options inherited from parent commands - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl](#talosctl) - A CLI for out-of-band management of Kubernetes nodes created by Talos - -## talosctl - -A CLI for out-of-band management of Kubernetes nodes created by Talos - -### Options - -``` - --context string Context to be used in command - -e, --endpoints strings override default endpoints in Talos configuration - -h, --help help for talosctl - -n, --nodes strings target the specified nodes - --talosconfig string The path to the Talos configuration file (default "/home/user/.talos/config") -``` - -### SEE ALSO - -* [talosctl apply-config](#talosctl-apply-config) - Apply a new configuration to a node -* [talosctl bootstrap](#talosctl-bootstrap) - Bootstrap the etcd cluster on the specified node. -* [talosctl cluster](#talosctl-cluster) - A collection of commands for managing local docker-based or QEMU-based clusters -* [talosctl completion](#talosctl-completion) - Output shell completion code for the specified shell (bash, fish or zsh) -* [talosctl config](#talosctl-config) - Manage the client configuration file (talosconfig) -* [talosctl conformance](#talosctl-conformance) - Run conformance tests -* [talosctl containers](#talosctl-containers) - List containers -* [talosctl copy](#talosctl-copy) - Copy data out from the node -* [talosctl dashboard](#talosctl-dashboard) - Cluster dashboard with real-time metrics -* [talosctl disks](#talosctl-disks) - Get the list of disks from /sys/block on the machine -* [talosctl dmesg](#talosctl-dmesg) - Retrieve kernel logs -* [talosctl edit](#talosctl-edit) - Edit a resource from the default editor. -* [talosctl etcd](#talosctl-etcd) - Manage etcd -* [talosctl events](#talosctl-events) - Stream runtime events -* [talosctl gen](#talosctl-gen) - Generate CAs, certificates, and private keys -* [talosctl get](#talosctl-get) - Get a specific resource or list of resources. -* [talosctl health](#talosctl-health) - Check cluster health -* [talosctl images](#talosctl-images) - List the default images used by Talos -* [talosctl inspect](#talosctl-inspect) - Inspect internals of Talos -* [talosctl kubeconfig](#talosctl-kubeconfig) - Download the admin kubeconfig from the node -* [talosctl list](#talosctl-list) - Retrieve a directory listing -* [talosctl logs](#talosctl-logs) - Retrieve logs for a service -* [talosctl memory](#talosctl-memory) - Show memory usage -* [talosctl mounts](#talosctl-mounts) - List mounts -* [talosctl patch](#talosctl-patch) - Update field(s) of a resource using a JSON patch. -* [talosctl processes](#talosctl-processes) - List running processes -* [talosctl read](#talosctl-read) - Read a file on the machine -* [talosctl reboot](#talosctl-reboot) - Reboot a node -* [talosctl reset](#talosctl-reset) - Reset a node -* [talosctl restart](#talosctl-restart) - Restart a process -* [talosctl rollback](#talosctl-rollback) - Rollback a node to the previous installation -* [talosctl service](#talosctl-service) - Retrieve the state of a service (or all services), control service state -* [talosctl shutdown](#talosctl-shutdown) - Shutdown a node -* [talosctl stats](#talosctl-stats) - Get container stats -* [talosctl support](#talosctl-support) - Dump debug information about the cluster -* [talosctl time](#talosctl-time) - Gets current server time -* [talosctl upgrade](#talosctl-upgrade) - Upgrade Talos on the target node -* [talosctl upgrade-k8s](#talosctl-upgrade-k8s) - Upgrade Kubernetes control plane in the Talos cluster. -* [talosctl usage](#talosctl-usage) - Retrieve a disk usage -* [talosctl validate](#talosctl-validate) - Validate config -* [talosctl version](#talosctl-version) - Prints the version - diff --git a/website/content/v1.0/reference/configuration.md b/website/content/v1.0/reference/configuration.md deleted file mode 100644 index 0ee89c3a7..000000000 --- a/website/content/v1.0/reference/configuration.md +++ /dev/null @@ -1,2631 +0,0 @@ ---- -title: Configuration -desription: Talos node configuration file reference. ---- - - - - -Package v1alpha1 configuration file contains all the options available for configuring a machine. - -To generate a set of basic configuration files, run: - - talosctl gen config --version v1alpha1 - -This will generate a machine config for each node type, and a talosconfig for the CLI. - ---- -## Config -Config defines the v1alpha1 configuration file. - - - - -{{< highlight yaml >}} -version: v1alpha1 -persist: true -machine: # ... -cluster: # ... -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`version` |string |Indicates the schema used to decode the contents. |`v1alpha1`
| -|`debug` |bool |
Enable verbose logging to the console.All system containers logs will flow into serial console.

**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.
|`true`
`yes`
`false`
`no`
| -|`persist` |bool |Indicates whether to pull the machine config upon every boot. |`true`
`yes`
`false`
`no`
| -|`machine` |MachineConfig |Provides machine specific configuration options. | | -|`cluster` |ClusterConfig |Provides cluster specific configuration options. | | - - - ---- -## MachineConfig -MachineConfig represents the machine-specific config values. - -Appears in: - -- Config.machine - - - -{{< highlight yaml >}} -type: controlplane -# InstallConfig represents the installation options for preparing a node. -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - - # # Allows for supplying additional system extension images to install on top of base Talos image. - # extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`type` |string |
Defines the role of the machine within the cluster.
**Control Plane**

Control Plane node type designates the node as a control plane member.
This means it will host etcd along with the Kubernetes master components such as API Server, Controller Manager, Scheduler.

**Worker**

Worker node type designates the node as a worker node.
This means it will be an available compute node for scheduling workloads.

This node type was previously known as "join"; that value is still supported but deprecated.
|`controlplane`
`worker`
| -|`token` |string |
The `token` is used by a machine to join the PKI of the cluster.Using this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.
Show example(s){{< highlight yaml >}} -token: 328hom.uqjzh6jnn2eie9oi -{{< /highlight >}}
| | -|`ca` |PEMEncodedCertificateAndKey |
The root certificate authority of the PKI.It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`certSANs` |[]string |
Extra certificate subject alternative names for the machine's certificate.By default, all non-loopback interface IPs are automatically added to the certificate's SANs.
Show example(s){{< highlight yaml >}} -certSANs: - - 10.0.0.10 - - 172.16.0.10 - - 192.168.0.10 -{{< /highlight >}}
| | -|`controlPlane` |MachineControlPlaneConfig |Provides machine specific control plane configuration options.
Show example(s){{< highlight yaml >}} -controlPlane: - # Controller manager machine specific configuration options. - controllerManager: - disabled: false # Disable kube-controller-manager on the node. - # Scheduler machine specific configuration options. - scheduler: - disabled: true # Disable kube-scheduler on the node. -{{< /highlight >}}
| | -|`kubelet` |KubeletConfig |Used to provide additional options to the kubelet.
Show example(s){{< highlight yaml >}} -kubelet: - image: ghcr.io/siderolabs/kubelet:v1.23.5 # The `image` field is an optional reference to an alternative kubelet image. - # The `extraArgs` field is used to provide additional flags to the kubelet. - extraArgs: - feature-gates: ServerSideApply=true - - # # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. - # clusterDNS: - # - 10.96.0.10 - # - 169.254.2.53 - - # # The `extraMounts` field is used to add additional mounts to the kubelet container. - # extraMounts: - # - destination: /var/lib/example - # type: bind - # source: /var/lib/example - # options: - # - bind - # - rshared - # - rw - - # # The `extraConfig` field is used to provide kubelet configuration overrides. - # extraConfig: - # serverTLSBootstrap: true - - # # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. - # nodeIP: - # # The `validSubnets` field configures the networks to pick kubelet node IP from. - # validSubnets: - # - 10.0.0.0/8 - # - '!10.0.0.3/32' - # - fdc7::/16 -{{< /highlight >}}
| | -|`pods` |[]Unstructured |
Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
Static pods can be used to run components which should be started before the Kubernetes control plane is up.
Talos doesn't validate the pod definition.
Updates to this field can be applied without a reboot.

See https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.
Show example(s){{< highlight yaml >}} -pods: - - apiVersion: v1 - kind: pod - metadata: - name: nginx - spec: - containers: - - image: nginx - name: nginx -{{< /highlight >}}
| | -|`network` |NetworkConfig |Provides machine specific network configuration options.
Show example(s){{< highlight yaml >}} -network: - hostname: worker-1 # Used to statically set the hostname for the machine. - # `interfaces` is used to define the network interface configuration. - interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network (destination). - gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. - # Used to statically set the nameservers for the machine. - nameservers: - - 9.8.7.6 - - 8.7.6.5 - - # # Allows for extra entries to be added to the `/etc/hosts` file - # extraHostEntries: - # - ip: 192.168.1.100 # The IP of the host. - # # The host alias. - # aliases: - # - example - # - example.domain.tld - - # # Configures KubeSpan feature. - # kubespan: - # enabled: true # Enable the KubeSpan feature. -{{< /highlight >}}
| | -|`disks` |[]MachineDisk |
Used to partition, format and mount additional disks.Since the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`.
Note that the partitioning and formating is done only once, if and only if no existing partitions are found.
If `size:` is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}} -disks: - - device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -{{< /highlight >}}
| | -|`install` |InstallConfig |Used to provide instructions for installations.
Show example(s){{< highlight yaml >}} -install: - disk: /dev/sda # The disk used for installations. - # Allows for supplying extra kernel args via the bootloader. - extraKernelArgs: - - console=ttyS1 - - panic=10 - image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. - bootloader: true # Indicates if a bootloader should be installed. - wipe: false # Indicates if the installation disk should be wiped at installation time. - - # # Look up disk using disk attributes like model, size, serial and others. - # diskSelector: - # size: 4GB # Disk size. - # model: WDC* # Disk model `/sys/block//device/model`. - # busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - - # # Allows for supplying additional system extension images to install on top of base Talos image. - # extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 -{{< /highlight >}}
| | -|`files` |[]MachineFile |
Allows the addition of user specified files.The value of `op` can be `create`, `overwrite`, or `append`.
In the case of `create`, `path` must not exist.
In the case of `overwrite`, and `append`, `path` must be a valid file.
If an `op` value of `append` is used, the existing file will be appended.
Note that the file contents are not required to be base64 encoded.
Show example(s){{< highlight yaml >}} -files: - - content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -{{< /highlight >}}
| | -|`env` |Env |
The `env` field allows for the addition of environment variables.All environment variables are set on PID 1 in addition to every service.
Show example(s){{< highlight yaml >}} -env: - GRPC_GO_LOG_SEVERITY_LEVEL: info - GRPC_GO_LOG_VERBOSITY_LEVEL: "99" - https_proxy: http://SERVER:PORT/ -{{< /highlight >}}{{< highlight yaml >}} -env: - GRPC_GO_LOG_SEVERITY_LEVEL: error - https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/ -{{< /highlight >}}{{< highlight yaml >}} -env: - https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/ -{{< /highlight >}}
|``GRPC_GO_LOG_VERBOSITY_LEVEL``
``GRPC_GO_LOG_SEVERITY_LEVEL``
``http_proxy``
``https_proxy``
``no_proxy``
| -|`time` |TimeConfig |Used to configure the machine's time settings.
Show example(s){{< highlight yaml >}} -time: - disabled: false # Indicates if the time service is disabled for the machine. - # Specifies time (NTP) servers to use for setting the system time. - servers: - - time.cloudflare.com - bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -{{< /highlight >}}
| | -|`sysctls` |map[string]string |Used to configure the machine's sysctls.
Show example(s){{< highlight yaml >}} -sysctls: - kernel.domainname: talos.dev - net.ipv4.ip_forward: "0" -{{< /highlight >}}
| | -|`sysfs` |map[string]string |Used to configure the machine's sysfs.
Show example(s){{< highlight yaml >}} -sysfs: - devices.system.cpu.cpu0.cpufreq.scaling_governor: performance -{{< /highlight >}}
| | -|`registries` |RegistriesConfig |
Used to configure the machine's container image registry mirrors.
Automatically generates matching CRI configuration for registry mirrors.

The `mirrors` section allows to redirect requests for images to non-default registry,
which might be local registry or caching mirror.

The `config` section provides a way to authenticate to the registry with TLS client
identity, provide registry CA, or authentication information.
Authentication information has same meaning with the corresponding field in `.docker/config.json`.

See also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).
Show example(s){{< highlight yaml >}} -registries: - # Specifies mirror configuration for each registry. - mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local - # Specifies TLS & auth configuration for HTTPS image registries. - config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -{{< /highlight >}}
| | -|`systemDiskEncryption` |SystemDiskEncryptionConfig |
Machine system disk encryption configuration.Defines each system partition encryption parameters.
Show example(s){{< highlight yaml >}} -systemDiskEncryption: - # Ephemeral partition encryption. - ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -{{< /highlight >}}
| | -|`features` |FeaturesConfig |Features describe individual Talos features that can be switched on or off.
Show example(s){{< highlight yaml >}} -features: - rbac: true # Enable role-based access control (RBAC). -{{< /highlight >}}
| | -|`udev` |UdevConfig |Configures the udev system.
Show example(s){{< highlight yaml >}} -udev: - # List of udev rules to apply to the udev system - rules: - - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" -{{< /highlight >}}
| | -|`logging` |LoggingConfig |Configures the logging system.
Show example(s){{< highlight yaml >}} -logging: - # Logging destination. - destinations: - - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - format: json_lines # Logs format. -{{< /highlight >}}
| | -|`kernel` |KernelConfig |Configures the kernel.
Show example(s){{< highlight yaml >}} -kernel: - # Kernel modules to load. - modules: - - name: brtfs # Module name. -{{< /highlight >}}
| | - - - ---- -## ClusterConfig -ClusterConfig represents the cluster-wide config values. - -Appears in: - -- Config.cluster - - - -{{< highlight yaml >}} -# ControlPlaneConfig represents the control plane configuration options. -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -clusterName: talos.local -# ClusterNetworkConfig represents kube networking configuration options. -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`id` |string |Globally unique identifier for this cluster (base64 encoded random 32 bytes). | | -|`secret` |string |
Shared secret of cluster (base64 encoded random 32 bytes).This secret is shared among cluster members but should never be sent over the network.
| | -|`controlPlane` |ControlPlaneConfig |Provides control plane specific configuration options.
Show example(s){{< highlight yaml >}} -controlPlane: - endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. - localAPIServerPort: 443 # The port that the API server listens on internally. -{{< /highlight >}}
| | -|`clusterName` |string |Configures the cluster's name. | | -|`network` |ClusterNetworkConfig |Provides cluster specific network configuration options.
Show example(s){{< highlight yaml >}} -network: - # The CNI used. - cni: - name: flannel # Name of CNI to use. - dnsDomain: cluster.local # The domain used by Kubernetes DNS. - # The pod subnet CIDR. - podSubnets: - - 10.244.0.0/16 - # The service subnet CIDR. - serviceSubnets: - - 10.96.0.0/12 -{{< /highlight >}}
| | -|`token` |string |The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
Show example(s){{< highlight yaml >}} -token: wlzjyw.bei2zfylhs2by0wd -{{< /highlight >}}
| | -|`aescbcEncryptionSecret` |string |The key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
Show example(s){{< highlight yaml >}} -aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM= -{{< /highlight >}}
| | -|`ca` |PEMEncodedCertificateAndKey |The base64 encoded root certificate authority used by Kubernetes.
Show example(s){{< highlight yaml >}} -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`aggregatorCA` |PEMEncodedCertificateAndKey |
The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
This CA can be self-signed.
Show example(s){{< highlight yaml >}} -aggregatorCA: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`serviceAccount` |PEMEncodedKey |The base64 encoded private key for service account token generation.
Show example(s){{< highlight yaml >}} -serviceAccount: - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`apiServer` |APIServerConfig |API server specific configuration options.
Show example(s){{< highlight yaml >}} -apiServer: - image: k8s.gcr.io/kube-apiserver:v1.23.5 # The container image used in the API server manifest. - # Extra arguments to supply to the API server. - extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" - # Extra certificate subject alternative names for the API server's certificate. - certSANs: - - 1.2.3.4 - - 4.5.6.7 - - # # Configure the API server admission plugins. - # admissionControl: - # - name: PodSecurity # Name is the name of the admission controller. - # # Configuration is an embedded configuration object to be used as the plugin's - # configuration: - # apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - # defaults: - # audit: restricted - # audit-version: latest - # enforce: baseline - # enforce-version: latest - # warn: restricted - # warn-version: latest - # exemptions: - # namespaces: - # - kube-system - # runtimeClasses: [] - # usernames: [] - # kind: PodSecurityConfiguration -{{< /highlight >}}
| | -|`controllerManager` |ControllerManagerConfig |Controller manager server specific configuration options.
Show example(s){{< highlight yaml >}} -controllerManager: - image: k8s.gcr.io/kube-controller-manager:v1.23.5 # The container image used in the controller manager manifest. - # Extra arguments to supply to the controller manager. - extraArgs: - feature-gates: ServerSideApply=true -{{< /highlight >}}
| | -|`proxy` |ProxyConfig |Kube-proxy server-specific configuration options
Show example(s){{< highlight yaml >}} -proxy: - image: k8s.gcr.io/kube-proxy:v1.23.5 # The container image used in the kube-proxy manifest. - mode: ipvs # proxy mode of kube-proxy. - # Extra arguments to supply to kube-proxy. - extraArgs: - proxy-mode: iptables -{{< /highlight >}}
| | -|`scheduler` |SchedulerConfig |Scheduler server specific configuration options.
Show example(s){{< highlight yaml >}} -scheduler: - image: k8s.gcr.io/kube-scheduler:v1.23.5 # The container image used in the scheduler manifest. - # Extra arguments to supply to the scheduler. - extraArgs: - feature-gates: AllBeta=true -{{< /highlight >}}
| | -|`discovery` |ClusterDiscoveryConfig |Configures cluster member discovery.
Show example(s){{< highlight yaml >}} -discovery: - enabled: true # Enable the cluster membership discovery feature. - # Configure registries used for cluster member discovery. - registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -{{< /highlight >}}
| | -|`etcd` |EtcdConfig |Etcd specific configuration options.
Show example(s){{< highlight yaml >}} -etcd: - image: gcr.io/etcd-development/etcd:v3.5.3 # The container image used to create the etcd service. - # The `ca` is the root certificate authority of the PKI. - ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # Extra arguments to supply to etcd. - extraArgs: - election-timeout: "5000" - - # # The subnet from which the advertise URL should be. - # subnet: 10.0.0.0/8 -{{< /highlight >}}
| | -|`coreDNS` |CoreDNS |Core DNS specific configuration options.
Show example(s){{< highlight yaml >}} -coreDNS: - image: docker.io/coredns/coredns:1.9.1 # The `image` field is an override to the default coredns image. -{{< /highlight >}}
| | -|`externalCloudProvider` |ExternalCloudProviderConfig |External cloud provider configuration.
Show example(s){{< highlight yaml >}} -externalCloudProvider: - enabled: true # Enable external cloud provider. - # A list of urls that point to additional manifests for an external cloud provider. - manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -{{< /highlight >}}
| | -|`extraManifests` |[]string |
A list of urls that point to additional manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} -extraManifests: - - https://www.example.com/manifest1.yaml - - https://www.example.com/manifest2.yaml -{{< /highlight >}}
| | -|`extraManifestHeaders` |map[string]string |A map of key value pairs that will be added while fetching the extraManifests.
Show example(s){{< highlight yaml >}} -extraManifestHeaders: - Token: "1234567" - X-ExtraInfo: info -{{< /highlight >}}
| | -|`inlineManifests` |ClusterInlineManifests |
A list of inline Kubernetes manifests.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} -inlineManifests: - - name: namespace-ci # Name of the manifest. - contents: |- # Manifest contents as a string. - apiVersion: v1 - kind: Namespace - metadata: - name: ci -{{< /highlight >}}
| | -|`adminKubeconfig` |AdminKubeconfigConfig |
Settings for admin kubeconfig generation.Certificate lifetime can be configured.
Show example(s){{< highlight yaml >}} -adminKubeconfig: - certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -{{< /highlight >}}
| | -|`allowSchedulingOnMasters` |bool |Allows running workload on master nodes. |`true`
`yes`
`false`
`no`
| - - - ---- -## ExtraMount -ExtraMount wraps OCI Mount specification. - -Appears in: - -- KubeletConfig.extraMounts - - - -{{< highlight yaml >}} -- destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -{{< /highlight >}} - - - - ---- -## MachineControlPlaneConfig -MachineControlPlaneConfig machine specific configuration options. - -Appears in: - -- MachineConfig.controlPlane - - - -{{< highlight yaml >}} -# Controller manager machine specific configuration options. -controllerManager: - disabled: false # Disable kube-controller-manager on the node. -# Scheduler machine specific configuration options. -scheduler: - disabled: true # Disable kube-scheduler on the node. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`controllerManager` |MachineControllerManagerConfig |Controller manager machine specific configuration options. | | -|`scheduler` |MachineSchedulerConfig |Scheduler machine specific configuration options. | | - - - ---- -## MachineControllerManagerConfig -MachineControllerManagerConfig represents the machine specific ControllerManager config values. - -Appears in: - -- MachineControlPlaneConfig.controllerManager - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable kube-controller-manager on the node. | | - - - ---- -## MachineSchedulerConfig -MachineSchedulerConfig represents the machine specific Scheduler config values. - -Appears in: - -- MachineControlPlaneConfig.scheduler - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable kube-scheduler on the node. | | - - - ---- -## KubeletConfig -KubeletConfig represents the kubelet config values. - -Appears in: - -- MachineConfig.kubelet - - - -{{< highlight yaml >}} -image: ghcr.io/siderolabs/kubelet:v1.23.5 # The `image` field is an optional reference to an alternative kubelet image. -# The `extraArgs` field is used to provide additional flags to the kubelet. -extraArgs: - feature-gates: ServerSideApply=true - -# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list. -# clusterDNS: -# - 10.96.0.10 -# - 169.254.2.53 - -# # The `extraMounts` field is used to add additional mounts to the kubelet container. -# extraMounts: -# - destination: /var/lib/example -# type: bind -# source: /var/lib/example -# options: -# - bind -# - rshared -# - rw - -# # The `extraConfig` field is used to provide kubelet configuration overrides. -# extraConfig: -# serverTLSBootstrap: true - -# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet. -# nodeIP: -# # The `validSubnets` field configures the networks to pick kubelet node IP from. -# validSubnets: -# - 10.0.0.0/8 -# - '!10.0.0.3/32' -# - fdc7::/16 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The `image` field is an optional reference to an alternative kubelet image.
Show example(s){{< highlight yaml >}} -image: ghcr.io/siderolabs/kubelet:v1.23.5 -{{< /highlight >}}
| | -|`clusterDNS` |[]string |The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
Show example(s){{< highlight yaml >}} -clusterDNS: - - 10.96.0.10 - - 169.254.2.53 -{{< /highlight >}}
| | -|`extraArgs` |map[string]string |The `extraArgs` field is used to provide additional flags to the kubelet.
Show example(s){{< highlight yaml >}} -extraArgs: - key: value -{{< /highlight >}}
| | -|`extraMounts` |[]ExtraMount |
The `extraMounts` field is used to add additional mounts to the kubelet container.Note that either `bind` or `rbind` are required in the `options`.
Show example(s){{< highlight yaml >}} -extraMounts: - - destination: /var/lib/example - type: bind - source: /var/lib/example - options: - - bind - - rshared - - rw -{{< /highlight >}}
| | -|`extraConfig` |Unstructured |
The `extraConfig` field is used to provide kubelet configuration overrides.
Some fields are not allowed to be overridden: authentication and authorization, cgroups
configuration, ports, etc.
Show example(s){{< highlight yaml >}} -extraConfig: - serverTLSBootstrap: true -{{< /highlight >}}
| | -|`registerWithFQDN` |bool |
The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.This is required in clouds like AWS.
|`true`
`yes`
`false`
`no`
| -|`nodeIP` |KubeletNodeIPConfig |
The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.This is used when a node has multiple addresses to choose from.
Show example(s){{< highlight yaml >}} -nodeIP: - # The `validSubnets` field configures the networks to pick kubelet node IP from. - validSubnets: - - 10.0.0.0/8 - - '!10.0.0.3/32' - - fdc7::/16 -{{< /highlight >}}
| | - - - ---- -## KubeletNodeIPConfig -KubeletNodeIPConfig represents the kubelet node IP configuration. - -Appears in: - -- KubeletConfig.nodeIP - - - -{{< highlight yaml >}} -# The `validSubnets` field configures the networks to pick kubelet node IP from. -validSubnets: - - 10.0.0.0/8 - - '!10.0.0.3/32' - - fdc7::/16 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`validSubnets` |[]string |
The `validSubnets` field configures the networks to pick kubelet node IP from.For dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.
IPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.
Negative subnet matches should be specified last to filter out IPs picked by positive matches.
If not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.
| | - - - ---- -## NetworkConfig -NetworkConfig represents the machine's networking config values. - -Appears in: - -- MachineConfig.network - - - -{{< highlight yaml >}} -hostname: worker-1 # Used to statically set the hostname for the machine. -# `interfaces` is used to define the network interface configuration. -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network (destination). - gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -# Used to statically set the nameservers for the machine. -nameservers: - - 9.8.7.6 - - 8.7.6.5 - -# # Allows for extra entries to be added to the `/etc/hosts` file -# extraHostEntries: -# - ip: 192.168.1.100 # The IP of the host. -# # The host alias. -# aliases: -# - example -# - example.domain.tld - -# # Configures KubeSpan feature. -# kubespan: -# enabled: true # Enable the KubeSpan feature. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`hostname` |string |Used to statically set the hostname for the machine. | | -|`interfaces` |[]Device |
`interfaces` is used to define the network interface configuration.By default all network interfaces will attempt a DHCP discovery.
This can be further tuned through this configuration parameter.
Show example(s){{< highlight yaml >}} -interfaces: - - interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network (destination). - gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -{{< /highlight >}}
| | -|`nameservers` |[]string |
Used to statically set the nameservers for the machine.Defaults to `1.1.1.1` and `8.8.8.8`
Show example(s){{< highlight yaml >}} -nameservers: - - 8.8.8.8 - - 1.1.1.1 -{{< /highlight >}}
| | -|`extraHostEntries` |[]ExtraHost |Allows for extra entries to be added to the `/etc/hosts` file
Show example(s){{< highlight yaml >}} -extraHostEntries: - - ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -{{< /highlight >}}
| | -|`kubespan` |NetworkKubeSpan |Configures KubeSpan feature.
Show example(s){{< highlight yaml >}} -kubespan: - enabled: true # Enable the KubeSpan feature. -{{< /highlight >}}
| | - - - ---- -## InstallConfig -InstallConfig represents the installation options for preparing a node. - -Appears in: - -- MachineConfig.install - - - -{{< highlight yaml >}} -disk: /dev/sda # The disk used for installations. -# Allows for supplying extra kernel args via the bootloader. -extraKernelArgs: - - console=ttyS1 - - panic=10 -image: ghcr.io/siderolabs/installer:latest # Allows for supplying the image used to perform the installation. -bootloader: true # Indicates if a bootloader should be installed. -wipe: false # Indicates if the installation disk should be wiped at installation time. - -# # Look up disk using disk attributes like model, size, serial and others. -# diskSelector: -# size: 4GB # Disk size. -# model: WDC* # Disk model `/sys/block//device/model`. -# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. - -# # Allows for supplying additional system extension images to install on top of base Talos image. -# extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disk` |string |The disk used for installations.
Show example(s){{< highlight yaml >}} -disk: /dev/sda -{{< /highlight >}}{{< highlight yaml >}} -disk: /dev/nvme0 -{{< /highlight >}}
| | -|`diskSelector` |InstallDiskSelector |
Look up disk using disk attributes like model, size, serial and others.Always has priority over `disk`.
Show example(s){{< highlight yaml >}} -diskSelector: - size: 4GB # Disk size. - model: WDC* # Disk model `/sys/block//device/model`. - busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. -{{< /highlight >}}
| | -|`extraKernelArgs` |[]string |Allows for supplying extra kernel args via the bootloader.
Show example(s){{< highlight yaml >}} -extraKernelArgs: - - talos.platform=metal - - reboot=k -{{< /highlight >}}
| | -|`image` |string |
Allows for supplying the image used to perform the installation.Image reference for each Talos release can be found on
[GitHub releases page](https://github.com/talos-systems/talos/releases).
Show example(s){{< highlight yaml >}} -image: ghcr.io/siderolabs/installer:latest -{{< /highlight >}}
| | -|`extensions` |[]InstallExtensionConfig |Allows for supplying additional system extension images to install on top of base Talos image.
Show example(s){{< highlight yaml >}} -extensions: ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 -{{< /highlight >}}
| | -|`bootloader` |bool |Indicates if a bootloader should be installed. |`true`
`yes`
`false`
`no`
| -|`wipe` |bool |
Indicates if the installation disk should be wiped at installation time.Defaults to `true`.
|`true`
`yes`
`false`
`no`
| -|`legacyBIOSSupport` |bool |
Indicates if MBR partition should be marked as bootable (active).Should be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.
| | - - - ---- -## InstallDiskSelector -InstallDiskSelector represents a disk query parameters for the install disk lookup. - -Appears in: - -- InstallConfig.diskSelector - - - -{{< highlight yaml >}} -size: 4GB # Disk size. -model: WDC* # Disk model `/sys/block//device/model`. -busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`size` |InstallDiskSizeMatcher |Disk size.
Show example(s){{< highlight yaml >}} -size: 4GB -{{< /highlight >}}{{< highlight yaml >}} -size: '> 1TB' -{{< /highlight >}}{{< highlight yaml >}} -size: <= 2TB -{{< /highlight >}}
| | -|`name` |string |Disk name `/sys/block//device/name`. | | -|`model` |string |Disk model `/sys/block//device/model`. | | -|`serial` |string |Disk serial number `/sys/block//serial`. | | -|`modalias` |string |Disk modalias `/sys/block//device/modalias`. | | -|`uuid` |string |Disk UUID `/sys/block//uuid`. | | -|`wwid` |string |Disk WWID `/sys/block//wwid`. | | -|`type` |InstallDiskType |Disk Type. |`ssd`
`hdd`
`nvme`
`sd`
| -|`busPath` |string |Disk bus path.
Show example(s){{< highlight yaml >}} -busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 -{{< /highlight >}}{{< highlight yaml >}} -busPath: /pci0000:00/* -{{< /highlight >}}
| | - - - ---- -## InstallExtensionConfig -InstallExtensionConfig represents a configuration for a system extension. - -Appears in: - -- InstallConfig.extensions - - - -{{< highlight yaml >}} -ghcr.io/siderolabs/gvisor:20220117.0-v1.0.0 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |System extension image. | | - - - ---- -## TimeConfig -TimeConfig represents the options for configuring time on a machine. - -Appears in: - -- MachineConfig.time - - - -{{< highlight yaml >}} -disabled: false # Indicates if the time service is disabled for the machine. -# Specifies time (NTP) servers to use for setting the system time. -servers: - - time.cloudflare.com -bootTimeout: 2m0s # Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |
Indicates if the time service is disabled for the machine.Defaults to `false`.
| | -|`servers` |[]string |
Specifies time (NTP) servers to use for setting the system time.Defaults to `pool.ntp.org`
| | -|`bootTimeout` |Duration |
Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.NTP sync will be still running in the background.
Defaults to "infinity" (waiting forever for time sync)
| | - - - ---- -## RegistriesConfig -RegistriesConfig represents the image pull options. - -Appears in: - -- MachineConfig.registries - - - -{{< highlight yaml >}} -# Specifies mirror configuration for each registry. -mirrors: - docker.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.local -# Specifies TLS & auth configuration for HTTPS image registries. -config: - registry.local: - # The TLS configuration for the registry. - tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - # The auth configuration for this registry. - auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`mirrors` |map[string]RegistryMirrorConfig |
Specifies mirror configuration for each registry.This setting allows to use local pull-through caching registires,
air-gapped installations, etc.

Registry name is the first segment of image identifier, with 'docker.io'
being default one.
To catch any registry names not specified explicitly, use '*'.
Show example(s){{< highlight yaml >}} -mirrors: - ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -{{< /highlight >}}
| | -|`config` |map[string]RegistryConfig |
Specifies TLS & auth configuration for HTTPS image registries.Mutual TLS can be enabled with 'clientIdentity' option.

TLS configuration can be skipped if registry has trusted
server certificate.
Show example(s){{< highlight yaml >}} -config: - registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -{{< /highlight >}}
| | - - - ---- -## PodCheckpointer -PodCheckpointer represents the pod-checkpointer config values. - - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The `image` field is an override to the default pod-checkpointer image. | | - - - ---- -## CoreDNS -CoreDNS represents the CoreDNS config values. - -Appears in: - -- ClusterConfig.coreDNS - - - -{{< highlight yaml >}} -image: docker.io/coredns/coredns:1.9.1 # The `image` field is an override to the default coredns image. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable coredns deployment on cluster bootstrap. | | -|`image` |string |The `image` field is an override to the default coredns image. | | - - - ---- -## Endpoint -Endpoint represents the endpoint URL parsed out of the machine config. - -Appears in: - -- ControlPlaneConfig.endpoint -- LoggingDestination.endpoint - - - -{{< highlight yaml >}} -https://1.2.3.4:6443 -{{< /highlight >}} - -{{< highlight yaml >}} -https://cluster1.internal:6443 -{{< /highlight >}} - -{{< highlight yaml >}} -udp://127.0.0.1:12345 -{{< /highlight >}} - -{{< highlight yaml >}} -tcp://1.2.3.4:12345 -{{< /highlight >}} - - - - ---- -## ControlPlaneConfig -ControlPlaneConfig represents the control plane configuration options. - -Appears in: - -- ClusterConfig.controlPlane - - - -{{< highlight yaml >}} -endpoint: https://1.2.3.4 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname. -localAPIServerPort: 443 # The port that the API server listens on internally. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`endpoint` |Endpoint |
Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.It is single-valued, and may optionally include a port number.
Show example(s){{< highlight yaml >}} -endpoint: https://1.2.3.4:6443 -{{< /highlight >}}{{< highlight yaml >}} -endpoint: https://cluster1.internal:6443 -{{< /highlight >}}
| | -|`localAPIServerPort` |int |
The port that the API server listens on internally.This may be different than the port portion listed in the endpoint field above.
The default is `6443`.
| | - - - ---- -## APIServerConfig -APIServerConfig represents the kube apiserver configuration options. - -Appears in: - -- ClusterConfig.apiServer - - - -{{< highlight yaml >}} -image: k8s.gcr.io/kube-apiserver:v1.23.5 # The container image used in the API server manifest. -# Extra arguments to supply to the API server. -extraArgs: - feature-gates: ServerSideApply=true - http2-max-streams-per-connection: "32" -# Extra certificate subject alternative names for the API server's certificate. -certSANs: - - 1.2.3.4 - - 4.5.6.7 - -# # Configure the API server admission plugins. -# admissionControl: -# - name: PodSecurity # Name is the name of the admission controller. -# # Configuration is an embedded configuration object to be used as the plugin's -# configuration: -# apiVersion: pod-security.admission.config.k8s.io/v1alpha1 -# defaults: -# audit: restricted -# audit-version: latest -# enforce: baseline -# enforce-version: latest -# warn: restricted -# warn-version: latest -# exemptions: -# namespaces: -# - kube-system -# runtimeClasses: [] -# usernames: [] -# kind: PodSecurityConfiguration -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The container image used in the API server manifest.
Show example(s){{< highlight yaml >}} -image: k8s.gcr.io/kube-apiserver:v1.23.5 -{{< /highlight >}}
| | -|`extraArgs` |map[string]string |Extra arguments to supply to the API server. | | -|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the API server static pod. | | -|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | -|`certSANs` |[]string |Extra certificate subject alternative names for the API server's certificate. | | -|`disablePodSecurityPolicy` |bool |Disable PodSecurityPolicy in the API server and default manifests. | | -|`admissionControl` |[]AdmissionPluginConfig |Configure the API server admission plugins.
Show example(s){{< highlight yaml >}} -admissionControl: - - name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration -{{< /highlight >}}
| | - - - ---- -## AdmissionPluginConfig -AdmissionPluginConfig represents the API server admission plugin configuration. - -Appears in: - -- APIServerConfig.admissionControl - - - -{{< highlight yaml >}} -- name: PodSecurity # Name is the name of the admission controller. - # Configuration is an embedded configuration object to be used as the plugin's - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1alpha1 - defaults: - audit: restricted - audit-version: latest - enforce: baseline - enforce-version: latest - warn: restricted - warn-version: latest - exemptions: - namespaces: - - kube-system - runtimeClasses: [] - usernames: [] - kind: PodSecurityConfiguration -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`name` |string |
Name is the name of the admission controller.It must match the registered admission plugin name.
| | -|`configuration` |Unstructured |
Configuration is an embedded configuration object to be used as the plugin'sconfiguration.
| | - - - ---- -## ControllerManagerConfig -ControllerManagerConfig represents the kube controller manager configuration options. - -Appears in: - -- ClusterConfig.controllerManager - - - -{{< highlight yaml >}} -image: k8s.gcr.io/kube-controller-manager:v1.23.5 # The container image used in the controller manager manifest. -# Extra arguments to supply to the controller manager. -extraArgs: - feature-gates: ServerSideApply=true -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The container image used in the controller manager manifest.
Show example(s){{< highlight yaml >}} -image: k8s.gcr.io/kube-controller-manager:v1.23.5 -{{< /highlight >}}
| | -|`extraArgs` |map[string]string |Extra arguments to supply to the controller manager. | | -|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the controller manager static pod. | | -|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | - - - ---- -## ProxyConfig -ProxyConfig represents the kube proxy configuration options. - -Appears in: - -- ClusterConfig.proxy - - - -{{< highlight yaml >}} -image: k8s.gcr.io/kube-proxy:v1.23.5 # The container image used in the kube-proxy manifest. -mode: ipvs # proxy mode of kube-proxy. -# Extra arguments to supply to kube-proxy. -extraArgs: - proxy-mode: iptables -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable kube-proxy deployment on cluster bootstrap.
Show example(s){{< highlight yaml >}} -disabled: false -{{< /highlight >}}
| | -|`image` |string |The container image used in the kube-proxy manifest.
Show example(s){{< highlight yaml >}} -image: k8s.gcr.io/kube-proxy:v1.23.5 -{{< /highlight >}}
| | -|`mode` |string |
proxy mode of kube-proxy.The default is 'iptables'.
| | -|`extraArgs` |map[string]string |Extra arguments to supply to kube-proxy. | | - - - ---- -## SchedulerConfig -SchedulerConfig represents the kube scheduler configuration options. - -Appears in: - -- ClusterConfig.scheduler - - - -{{< highlight yaml >}} -image: k8s.gcr.io/kube-scheduler:v1.23.5 # The container image used in the scheduler manifest. -# Extra arguments to supply to the scheduler. -extraArgs: - feature-gates: AllBeta=true -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The container image used in the scheduler manifest.
Show example(s){{< highlight yaml >}} -image: k8s.gcr.io/kube-scheduler:v1.23.5 -{{< /highlight >}}
| | -|`extraArgs` |map[string]string |Extra arguments to supply to the scheduler. | | -|`extraVolumes` |[]VolumeMountConfig |Extra volumes to mount to the scheduler static pod. | | -|`env` |Env |The `env` field allows for the addition of environment variables for the control plane component. | | - - - ---- -## EtcdConfig -EtcdConfig represents the etcd configuration options. - -Appears in: - -- ClusterConfig.etcd - - - -{{< highlight yaml >}} -image: gcr.io/etcd-development/etcd:v3.5.3 # The container image used to create the etcd service. -# The `ca` is the root certificate authority of the PKI. -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -# Extra arguments to supply to etcd. -extraArgs: - election-timeout: "5000" - -# # The subnet from which the advertise URL should be. -# subnet: 10.0.0.0/8 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`image` |string |The container image used to create the etcd service.
Show example(s){{< highlight yaml >}} -image: gcr.io/etcd-development/etcd:v3.5.3 -{{< /highlight >}}
| | -|`ca` |PEMEncodedCertificateAndKey |
The `ca` is the root certificate authority of the PKI.It is composed of a base64 encoded `crt` and `key`.
Show example(s){{< highlight yaml >}} -ca: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`extraArgs` |map[string]string |
Extra arguments to supply to etcd.Note that the following args are not allowed:

- `name`
- `data-dir`
- `initial-cluster-state`
- `listen-peer-urls`
- `listen-client-urls`
- `cert-file`
- `key-file`
- `trusted-ca-file`
- `peer-client-cert-auth`
- `peer-cert-file`
- `peer-trusted-ca-file`
- `peer-key-file`
| | -|`subnet` |string |The subnet from which the advertise URL should be.
Show example(s){{< highlight yaml >}} -subnet: 10.0.0.0/8 -{{< /highlight >}}
| | - - - ---- -## ClusterNetworkConfig -ClusterNetworkConfig represents kube networking configuration options. - -Appears in: - -- ClusterConfig.network - - - -{{< highlight yaml >}} -# The CNI used. -cni: - name: flannel # Name of CNI to use. -dnsDomain: cluster.local # The domain used by Kubernetes DNS. -# The pod subnet CIDR. -podSubnets: - - 10.244.0.0/16 -# The service subnet CIDR. -serviceSubnets: - - 10.96.0.0/12 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`cni` |CNIConfig |
The CNI used.Composed of "name" and "urls".
The "name" key supports the following options: "flannel", "custom", and "none".
"flannel" uses Talos-managed Flannel CNI, and that's the default option.
"custom" uses custom manifests that should be provided in "urls".
"none" indicates that Talos will not manage any CNI installation.
Show example(s){{< highlight yaml >}} -cni: - name: custom # Name of CNI to use. - # URLs containing manifests to apply for the CNI. - urls: - - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml -{{< /highlight >}}
| | -|`dnsDomain` |string |
The domain used by Kubernetes DNS.The default is `cluster.local`
Show example(s){{< highlight yaml >}} -dnsDomain: cluser.local -{{< /highlight >}}
| | -|`podSubnets` |[]string |The pod subnet CIDR.
Show example(s){{< highlight yaml >}} -podSubnets: - - 10.244.0.0/16 -{{< /highlight >}}
| | -|`serviceSubnets` |[]string |The service subnet CIDR.
Show example(s){{< highlight yaml >}} -serviceSubnets: - - 10.96.0.0/12 -{{< /highlight >}}
| | - - - ---- -## CNIConfig -CNIConfig represents the CNI configuration options. - -Appears in: - -- ClusterNetworkConfig.cni - - - -{{< highlight yaml >}} -name: custom # Name of CNI to use. -# URLs containing manifests to apply for the CNI. -urls: - - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`name` |string |Name of CNI to use. |`flannel`
`custom`
`none`
| -|`urls` |[]string |
URLs containing manifests to apply for the CNI.Should be present for "custom", must be empty for "flannel" and "none".
| | - - - ---- -## ExternalCloudProviderConfig -ExternalCloudProviderConfig contains external cloud provider configuration. - -Appears in: - -- ClusterConfig.externalCloudProvider - - - -{{< highlight yaml >}} -enabled: true # Enable external cloud provider. -# A list of urls that point to additional manifests for an external cloud provider. -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`enabled` |bool |Enable external cloud provider. |`true`
`yes`
`false`
`no`
| -|`manifests` |[]string |
A list of urls that point to additional manifests for an external cloud provider.These will get automatically deployed as part of the bootstrap.
Show example(s){{< highlight yaml >}} -manifests: - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml - - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml -{{< /highlight >}}
| | - - - ---- -## AdminKubeconfigConfig -AdminKubeconfigConfig contains admin kubeconfig settings. - -Appears in: - -- ClusterConfig.adminKubeconfig - - - -{{< highlight yaml >}} -certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year). -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`certLifetime` |Duration |
Admin kubeconfig certificate lifetime (default is 1 year).Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
| | - - - ---- -## MachineDisk -MachineDisk represents the options available for partitioning, formatting, and -mounting extra disks. - - -Appears in: - -- MachineConfig.disks - - - -{{< highlight yaml >}} -- device: /dev/sdb # The name of the disk to use. - # A list of partitions to create on the disk. - partitions: - - mountpoint: /var/mnt/extra # Where to mount the partition. - - # # The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk. - - # # Human readable representation. - # size: 100 MB - # # Precise value in bytes. - # size: 1073741824 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`device` |string |The name of the disk to use. | | -|`partitions` |[]DiskPartition |A list of partitions to create on the disk. | | - - - ---- -## DiskPartition -DiskPartition represents the options for a disk partition. - -Appears in: - -- MachineDisk.partitions - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`size` |DiskSize |The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.
Show example(s){{< highlight yaml >}} -size: 100 MB -{{< /highlight >}}{{< highlight yaml >}} -size: 1073741824 -{{< /highlight >}}
| | -|`mountpoint` |string |Where to mount the partition. | | - - - ---- -## EncryptionConfig -EncryptionConfig represents partition encryption settings. - -Appears in: - -- SystemDiskEncryptionConfig.state -- SystemDiskEncryptionConfig.ephemeral - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`provider` |string |Encryption provider to use for the encryption.
Show example(s){{< highlight yaml >}} -provider: luks2 -{{< /highlight >}}
| | -|`keys` |[]EncryptionKey |Defines the encryption keys generation and storage method. | | -|`cipher` |string |Cipher kind to use for the encryption. Depends on the encryption provider.
Show example(s){{< highlight yaml >}} -cipher: aes-xts-plain64 -{{< /highlight >}}
|`aes-xts-plain64`
`xchacha12,aes-adiantum-plain64`
`xchacha20,aes-adiantum-plain64`
| -|`keySize` |uint |Defines the encryption key length. | | -|`blockSize` |uint64 |Defines the encryption sector size.
Show example(s){{< highlight yaml >}} -blockSize: 4096 -{{< /highlight >}}
| | -|`options` |[]string |Additional --perf parameters for the LUKS2 encryption.
Show example(s){{< highlight yaml >}} -options: - - no_read_workqueue - - no_write_workqueue -{{< /highlight >}}
|`no_read_workqueue`
`no_write_workqueue`
`same_cpu_crypt`
| - - - ---- -## EncryptionKey -EncryptionKey represents configuration for disk encryption key. - -Appears in: - -- EncryptionConfig.keys - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`static` |EncryptionKeyStatic |Key which value is stored in the configuration file. | | -|`nodeID` |EncryptionKeyNodeID |Deterministically generated key from the node UUID and PartitionLabel. | | -|`slot` |int |Key slot number for LUKS2 encryption. | | - - - ---- -## EncryptionKeyStatic -EncryptionKeyStatic represents throw away key type. - -Appears in: - -- EncryptionKey.static - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`passphrase` |string |Defines the static passphrase value. | | - - - ---- -## EncryptionKeyNodeID -EncryptionKeyNodeID represents deterministically generated key from the node UUID and PartitionLabel. - -Appears in: - -- EncryptionKey.nodeID - - - - - - ---- -## MachineFile -MachineFile represents a file to write to disk. - -Appears in: - -- MachineConfig.files - - - -{{< highlight yaml >}} -- content: '...' # The contents of the file. - permissions: 0o666 # The file's permissions in octal. - path: /tmp/file.txt # The path of the file. - op: append # The operation to use -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`content` |string |The contents of the file. | | -|`permissions` |FileMode |The file's permissions in octal. | | -|`path` |string |The path of the file. | | -|`op` |string |The operation to use |`create`
`append`
`overwrite`
| - - - ---- -## ExtraHost -ExtraHost represents a host entry in /etc/hosts. - -Appears in: - -- NetworkConfig.extraHostEntries - - - -{{< highlight yaml >}} -- ip: 192.168.1.100 # The IP of the host. - # The host alias. - aliases: - - example - - example.domain.tld -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`ip` |string |The IP of the host. | | -|`aliases` |[]string |The host alias. | | - - - ---- -## Device -Device represents a network interface. - -Appears in: - -- NetworkConfig.interfaces - - - -{{< highlight yaml >}} -- interface: eth0 # The interface name. - # Assigns static IP addresses to the interface. - addresses: - - 192.168.2.0/24 - # A list of routes associated with the interface. - routes: - - network: 0.0.0.0/0 # The route's network (destination). - gateway: 192.168.2.1 # The route's gateway (if empty, creates link scope route). - metric: 1024 # The optional metric for the route. - mtu: 1500 # The interface's MTU. - - # # Bond specific options. - # bond: - # # The interfaces that make up the bond. - # interfaces: - # - eth0 - # - eth1 - # mode: 802.3ad # A bond option. - # lacpRate: fast # A bond option. - - # # Indicates if DHCP should be used to configure the interface. - # dhcp: true - - # # DHCP specific options. - # dhcpOptions: - # routeMetric: 1024 # The priority of all routes received via DHCP. - - # # Wireguard specific configuration. - - # # wireguard server example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # listenPort: 51111 # Specifies a device's listening port. - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - # # wireguard peer example - # wireguard: - # privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # # Specifies a list of peer configurations to apply to a device. - # peers: - # - publicKey: ABCDEF... # Specifies the public key of this peer. - # endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - # persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - # allowedIPs: - # - 192.168.1.0/24 - - # # Virtual (shared) IP address configuration. - # vip: - # ip: 172.16.199.55 # Specifies the IP address to be used. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`interface` |string |The interface name.
Show example(s){{< highlight yaml >}} -interface: eth0 -{{< /highlight >}}
| | -|`addresses` |[]string |
Assigns static IP addresses to the interface.An address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).
Show example(s){{< highlight yaml >}} -addresses: - - 10.5.0.0/16 - - 192.168.3.7 -{{< /highlight >}}
| | -|`routes` |[]Route |
A list of routes associated with the interface.If used in combination with DHCP, these routes will be appended to routes returned by DHCP server.
Show example(s){{< highlight yaml >}} -routes: - - network: 0.0.0.0/0 # The route's network (destination). - gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). - - network: 10.2.0.0/16 # The route's network (destination). - gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). -{{< /highlight >}}
| | -|`bond` |Bond |Bond specific options.
Show example(s){{< highlight yaml >}} -bond: - # The interfaces that make up the bond. - interfaces: - - eth0 - - eth1 - mode: 802.3ad # A bond option. - lacpRate: fast # A bond option. -{{< /highlight >}}
| | -|`vlans` |[]Vlan |VLAN specific options. | | -|`mtu` |int |
The interface's MTU.If used in combination with DHCP, this will override any MTU settings returned from DHCP server.
| | -|`dhcp` |bool |
Indicates if DHCP should be used to configure the interface.The following DHCP options are supported:

- `OptionClasslessStaticRoute`
- `OptionDomainNameServer`
- `OptionDNSDomainSearchList`
- `OptionHostName`
Show example(s){{< highlight yaml >}} -dhcp: true -{{< /highlight >}}
| | -|`ignore` |bool |Indicates if the interface should be ignored (skips configuration). | | -|`dummy` |bool |
Indicates if the interface is a dummy interface.`dummy` is used to specify that this interface should be a virtual-only, dummy interface.
| | -|`dhcpOptions` |DHCPOptions |
DHCP specific options.`dhcp` *must* be set to true for these to take effect.
Show example(s){{< highlight yaml >}} -dhcpOptions: - routeMetric: 1024 # The priority of all routes received via DHCP. -{{< /highlight >}}
| | -|`wireguard` |DeviceWireguardConfig |
Wireguard specific configuration.Includes things like private key, listen port, peers.
Show example(s){{< highlight yaml >}} -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - listenPort: 51111 # Specifies a device's listening port. - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -{{< /highlight >}}{{< highlight yaml >}} -wireguard: - privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). - # Specifies a list of peer configurations to apply to a device. - peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -{{< /highlight >}}
| | -|`vip` |DeviceVIPConfig |Virtual (shared) IP address configuration.
Show example(s){{< highlight yaml >}} -vip: - ip: 172.16.199.55 # Specifies the IP address to be used. -{{< /highlight >}}
| | - - - ---- -## DHCPOptions -DHCPOptions contains options for configuring the DHCP settings for a given interface. - -Appears in: - -- Device.dhcpOptions - - - -{{< highlight yaml >}} -routeMetric: 1024 # The priority of all routes received via DHCP. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`routeMetric` |uint32 |The priority of all routes received via DHCP. | | -|`ipv4` |bool |Enables DHCPv4 protocol for the interface (default is enabled). | | -|`ipv6` |bool |Enables DHCPv6 protocol for the interface (default is disabled). | | - - - ---- -## DeviceWireguardConfig -DeviceWireguardConfig contains settings for configuring Wireguard network interface. - -Appears in: - -- Device.wireguard - - - -{{< highlight yaml >}} -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -listenPort: 51111 # Specifies a device's listening port. -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.3 # Specifies the endpoint of this peer entry. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -{{< /highlight >}} - -{{< highlight yaml >}} -privateKey: ABCDEF... # Specifies a private key configuration (base64 encoded). -# Specifies a list of peer configurations to apply to a device. -peers: - - publicKey: ABCDEF... # Specifies the public key of this peer. - endpoint: 192.168.1.2 # Specifies the endpoint of this peer entry. - persistentKeepaliveInterval: 10s # Specifies the persistent keepalive interval for this peer. - # AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. - allowedIPs: - - 192.168.1.0/24 -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`privateKey` |string |
Specifies a private key configuration (base64 encoded).Can be generated by `wg genkey`.
| | -|`listenPort` |int |Specifies a device's listening port. | | -|`firewallMark` |int |Specifies a device's firewall mark. | | -|`peers` |[]DeviceWireguardPeer |Specifies a list of peer configurations to apply to a device. | | - - - ---- -## DeviceWireguardPeer -DeviceWireguardPeer a WireGuard device peer configuration. - -Appears in: - -- DeviceWireguardConfig.peers - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`publicKey` |string |
Specifies the public key of this peer.Can be extracted from private key by running `wg pubkey < private.key > public.key && cat public.key`.
| | -|`endpoint` |string |Specifies the endpoint of this peer entry. | | -|`persistentKeepaliveInterval` |Duration |
Specifies the persistent keepalive interval for this peer.Field format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).
| | -|`allowedIPs` |[]string |AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer. | | - - - ---- -## DeviceVIPConfig -DeviceVIPConfig contains settings for configuring a Virtual Shared IP on an interface. - -Appears in: - -- Device.vip -- Vlan.vip - - - -{{< highlight yaml >}} -ip: 172.16.199.55 # Specifies the IP address to be used. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`ip` |string |Specifies the IP address to be used. | | -|`equinixMetal` |VIPEquinixMetalConfig |Specifies the Equinix Metal API settings to assign VIP to the node. | | -|`hcloud` |VIPHCloudConfig |Specifies the Hetzner Cloud API settings to assign VIP to the node. | | - - - ---- -## VIPEquinixMetalConfig -VIPEquinixMetalConfig contains settings for Equinix Metal VIP management. - -Appears in: - -- DeviceVIPConfig.equinixMetal - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`apiToken` |string |Specifies the Equinix Metal API Token. | | - - - ---- -## VIPHCloudConfig -VIPHCloudConfig contains settings for Hetzner Cloud VIP management. - -Appears in: - -- DeviceVIPConfig.hcloud - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`apiToken` |string |Specifies the Hetzner Cloud API Token. | | - - - ---- -## Bond -Bond contains the various options for configuring a bonded interface. - -Appears in: - -- Device.bond - - - -{{< highlight yaml >}} -# The interfaces that make up the bond. -interfaces: - - eth0 - - eth1 -mode: 802.3ad # A bond option. -lacpRate: fast # A bond option. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`interfaces` |[]string |The interfaces that make up the bond. | | -|`arpIPTarget` |[]string |
A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | -|`mode` |string |
A bond option.Please see the official kernel documentation.
| | -|`xmitHashPolicy` |string |
A bond option.Please see the official kernel documentation.
| | -|`lacpRate` |string |
A bond option.Please see the official kernel documentation.
| | -|`adActorSystem` |string |
A bond option.Please see the official kernel documentation.
Not supported at the moment.
| | -|`arpValidate` |string |
A bond option.Please see the official kernel documentation.
| | -|`arpAllTargets` |string |
A bond option.Please see the official kernel documentation.
| | -|`primary` |string |
A bond option.Please see the official kernel documentation.
| | -|`primaryReselect` |string |
A bond option.Please see the official kernel documentation.
| | -|`failOverMac` |string |
A bond option.Please see the official kernel documentation.
| | -|`adSelect` |string |
A bond option.Please see the official kernel documentation.
| | -|`miimon` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`updelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`downdelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`arpInterval` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`resendIgmp` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`minLinks` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`lpInterval` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`packetsPerSlave` |uint32 |
A bond option.Please see the official kernel documentation.
| | -|`numPeerNotif` |uint8 |
A bond option.Please see the official kernel documentation.
| | -|`tlbDynamicLb` |uint8 |
A bond option.Please see the official kernel documentation.
| | -|`allSlavesActive` |uint8 |
A bond option.Please see the official kernel documentation.
| | -|`useCarrier` |bool |
A bond option.Please see the official kernel documentation.
| | -|`adActorSysPrio` |uint16 |
A bond option.Please see the official kernel documentation.
| | -|`adUserPortKey` |uint16 |
A bond option.Please see the official kernel documentation.
| | -|`peerNotifyDelay` |uint32 |
A bond option.Please see the official kernel documentation.
| | - - - ---- -## Vlan -Vlan represents vlan settings for a device. - -Appears in: - -- Device.vlans - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`addresses` |[]string |The addresses in CIDR notation or as plain IPs to use. | | -|`routes` |[]Route |A list of routes associated with the VLAN. | | -|`dhcp` |bool |Indicates if DHCP should be used. | | -|`vlanId` |uint16 |The VLAN's ID. | | -|`mtu` |uint32 |The VLAN's MTU. | | -|`vip` |DeviceVIPConfig |The VLAN's virtual IP address configuration. | | - - - ---- -## Route -Route represents a network route. - -Appears in: - -- Device.routes -- Vlan.routes - - - -{{< highlight yaml >}} -- network: 0.0.0.0/0 # The route's network (destination). - gateway: 10.5.0.1 # The route's gateway (if empty, creates link scope route). -- network: 10.2.0.0/16 # The route's network (destination). - gateway: 10.2.0.1 # The route's gateway (if empty, creates link scope route). -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`network` |string |The route's network (destination). | | -|`gateway` |string |The route's gateway (if empty, creates link scope route). | | -|`source` |string |The route's source address (optional). | | -|`metric` |uint32 |The optional metric for the route. | | - - - ---- -## RegistryMirrorConfig -RegistryMirrorConfig represents mirror configuration for a registry. - -Appears in: - -- RegistriesConfig.mirrors - - - -{{< highlight yaml >}} -ghcr.io: - # List of endpoints (URLs) for registry mirrors to use. - endpoints: - - https://registry.insecure - - https://ghcr.io/v2/ -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`endpoints` |[]string |
List of endpoints (URLs) for registry mirrors to use.Endpoint configures HTTP/HTTPS access mode, host name,
port and path (if path is not set, it defaults to `/v2`).
| | - - - ---- -## RegistryConfig -RegistryConfig specifies auth & TLS config per registry. - -Appears in: - -- RegistriesConfig.config - - - -{{< highlight yaml >}} -registry.insecure: - # The TLS configuration for the registry. - tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u - - # # The auth configuration for this registry. - # auth: - # username: username # Optional registry authentication. - # password: password # Optional registry authentication. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`tls` |RegistryTLSConfig |The TLS configuration for the registry.
Show example(s){{< highlight yaml >}} -tls: - # Enable mutual TLS authentication with the registry. - clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}{{< highlight yaml >}} -tls: - insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - - # # Enable mutual TLS authentication with the registry. - # clientIdentity: - # crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - # key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`auth` |RegistryAuthConfig |
The auth configuration for this registry.Note: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.
Show example(s){{< highlight yaml >}} -auth: - username: username # Optional registry authentication. - password: password # Optional registry authentication. -{{< /highlight >}}
| | - - - ---- -## RegistryAuthConfig -RegistryAuthConfig specifies authentication configuration for a registry. - -Appears in: - -- RegistryConfig.auth - - - -{{< highlight yaml >}} -username: username # Optional registry authentication. -password: password # Optional registry authentication. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`username` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
| | -|`password` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
| | -|`auth` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
| | -|`identityToken` |string |
Optional registry authentication.The meaning of each field is the same with the corresponding field in .docker/config.json.
| | - - - ---- -## RegistryTLSConfig -RegistryTLSConfig specifies TLS config for HTTPS registries. - -Appears in: - -- RegistryConfig.tls - - - -{{< highlight yaml >}} -# Enable mutual TLS authentication with the registry. -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}} - -{{< highlight yaml >}} -insecureSkipVerify: true # Skip TLS server certificate verification (not recommended). - -# # Enable mutual TLS authentication with the registry. -# clientIdentity: -# crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u -# key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`clientIdentity` |PEMEncodedCertificateAndKey |
Enable mutual TLS authentication with the registry.Client certificate and key should be base64-encoded.
Show example(s){{< highlight yaml >}} -clientIdentity: - crt: TFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSklla05DTUhGLi4u - key: TFMwdExTMUNSVWRKVGlCRlJESTFOVEU1SUZCU1NWWkJWRVVnUzBWWkxTMHRMUzBLVFVNLi4u -{{< /highlight >}}
| | -|`ca` |Base64Bytes |
CA registry certificate to add the list of trusted certificates.Certificate should be base64-encoded.
| | -|`insecureSkipVerify` |bool |Skip TLS server certificate verification (not recommended). | | - - - ---- -## SystemDiskEncryptionConfig -SystemDiskEncryptionConfig specifies system disk partitions encryption settings. - -Appears in: - -- MachineConfig.systemDiskEncryption - - - -{{< highlight yaml >}} -# Ephemeral partition encryption. -ephemeral: - provider: luks2 # Encryption provider to use for the encryption. - # Defines the encryption keys generation and storage method. - keys: - - # Deterministically generated key from the node UUID and PartitionLabel. - nodeID: {} - slot: 0 # Key slot number for LUKS2 encryption. - - # # Cipher kind to use for the encryption. Depends on the encryption provider. - # cipher: aes-xts-plain64 - - # # Defines the encryption sector size. - # blockSize: 4096 - - # # Additional --perf parameters for the LUKS2 encryption. - # options: - # - no_read_workqueue - # - no_write_workqueue -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`state` |EncryptionConfig |State partition encryption. | | -|`ephemeral` |EncryptionConfig |Ephemeral partition encryption. | | - - - ---- -## FeaturesConfig -FeaturesConfig describe individual Talos features that can be switched on or off. - -Appears in: - -- MachineConfig.features - - - -{{< highlight yaml >}} -rbac: true # Enable role-based access control (RBAC). -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`rbac` |bool |Enable role-based access control (RBAC). | | - - - ---- -## VolumeMountConfig -VolumeMountConfig struct describes extra volume mount for the static pods. - -Appears in: - -- APIServerConfig.extraVolumes -- ControllerManagerConfig.extraVolumes -- SchedulerConfig.extraVolumes - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`hostPath` |string |Path on the host.
Show example(s){{< highlight yaml >}} -hostPath: /var/lib/auth -{{< /highlight >}}
| | -|`mountPath` |string |Path in the container.
Show example(s){{< highlight yaml >}} -mountPath: /etc/kubernetes/auth -{{< /highlight >}}
| | -|`readonly` |bool |Mount the volume read only.
Show example(s){{< highlight yaml >}} -readonly: true -{{< /highlight >}}
| | - - - ---- -## ClusterInlineManifest -ClusterInlineManifest struct describes inline bootstrap manifests for the user. - - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`name` |string |
Name of the manifest.Name should be unique.
Show example(s){{< highlight yaml >}} -name: csi -{{< /highlight >}}
| | -|`contents` |string |Manifest contents as a string.
Show example(s){{< highlight yaml >}} -contents: /etc/kubernetes/auth -{{< /highlight >}}
| | - - - ---- -## NetworkKubeSpan -NetworkKubeSpan struct describes KubeSpan configuration. - -Appears in: - -- NetworkConfig.kubespan - - - -{{< highlight yaml >}} -enabled: true # Enable the KubeSpan feature. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`enabled` |bool |
Enable the KubeSpan feature.Cluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.
| | -|`allowDownPeerBypass` |bool |
Skip sending traffic via KubeSpan if the peer connection state is not up.This provides configurable choice between connectivity and security: either traffic is always
forced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly
to the peer if Wireguard connection can't be established.
| | - - - ---- -## ClusterDiscoveryConfig -ClusterDiscoveryConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterConfig.discovery - - - -{{< highlight yaml >}} -enabled: true # Enable the cluster membership discovery feature. -# Configure registries used for cluster member discovery. -registries: - # Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information - kubernetes: {} - # Service registry is using an external service to push and pull information about cluster members. - service: - endpoint: https://discovery.talos.dev/ # External service endpoint. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`enabled` |bool |
Enable the cluster membership discovery feature.Cluster discovery is based on individual registries which are configured under the registries field.
| | -|`registries` |DiscoveryRegistriesConfig |Configure registries used for cluster member discovery. | | - - - ---- -## DiscoveryRegistriesConfig -DiscoveryRegistriesConfig struct configures cluster membership discovery. - -Appears in: - -- ClusterDiscoveryConfig.registries - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`kubernetes` |RegistryKubernetesConfig |
Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional informationas annotations on the Node resources.
| | -|`service` |RegistryServiceConfig |Service registry is using an external service to push and pull information about cluster members. | | - - - ---- -## RegistryKubernetesConfig -RegistryKubernetesConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.kubernetes - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable Kubernetes discovery registry. | | - - - ---- -## RegistryServiceConfig -RegistryServiceConfig struct configures Kubernetes discovery registry. - -Appears in: - -- DiscoveryRegistriesConfig.service - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`disabled` |bool |Disable external service discovery registry. | | -|`endpoint` |string |External service endpoint.
Show example(s){{< highlight yaml >}} -endpoint: https://discovery.talos.dev/ -{{< /highlight >}}
| | - - - ---- -## UdevConfig -UdevConfig describes how the udev system should be configured. - -Appears in: - -- MachineConfig.udev - - - -{{< highlight yaml >}} -# List of udev rules to apply to the udev system -rules: - - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660" -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`rules` |[]string |List of udev rules to apply to the udev system | | - - - ---- -## LoggingConfig -LoggingConfig struct configures Talos logging. - -Appears in: - -- MachineConfig.logging - - - -{{< highlight yaml >}} -# Logging destination. -destinations: - - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp". - format: json_lines # Logs format. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`destinations` |[]LoggingDestination |Logging destination. | | - - - ---- -## LoggingDestination -LoggingDestination struct configures Talos logging destination. - -Appears in: - -- LoggingConfig.destinations - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`endpoint` |Endpoint |Where to send logs. Supported protocols are "tcp" and "udp".
Show example(s){{< highlight yaml >}} -endpoint: udp://127.0.0.1:12345 -{{< /highlight >}}{{< highlight yaml >}} -endpoint: tcp://1.2.3.4:12345 -{{< /highlight >}}
| | -|`format` |string |Logs format. |`json_lines`
| - - - ---- -## KernelConfig -KernelConfig struct configures Talos Linux kernel. - -Appears in: - -- MachineConfig.kernel - - - -{{< highlight yaml >}} -# Kernel modules to load. -modules: - - name: brtfs # Module name. -{{< /highlight >}} - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`modules` |[]KernelModuleConfig |Kernel modules to load. | | - - - ---- -## KernelModuleConfig -KernelModuleConfig struct configures Linux kernel modules to load. - -Appears in: - -- KernelConfig.modules - - - - -| Field | Type | Description | Value(s) | -|-------|------|-------------|----------| -|`name` |string |Module name. | | - - diff --git a/website/content/v1.0/reference/kernel.md b/website/content/v1.0/reference/kernel.md deleted file mode 100644 index ec772c221..000000000 --- a/website/content/v1.0/reference/kernel.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: "Kernel" -description: "Linux kernel reference." ---- - -## Commandline Parameters - -Talos supports a number of kernel commandline parameters. Some are required for -it to operate. Others are optional and useful in certain circumstances. - -Several of these are enforced by the Kernel Self Protection Project [KSPP](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings). - -**Required** parameters: - -- `talos.platform`: can be one of `aws`, `azure`, `container`, `digitalocean`, `gcp`, `metal`, `equinixMetal`, or `vmware` -- `init_on_alloc=1`: required by KSPP -- `slab_nomerge`: required by KSPP -- `pti=on`: required by KSPP - -**Recommended** parameters: - - - `init_on_free=1`: advised by KSPP if minimizing stale data lifetime is - important - -### Available Talos-specific parameters - -#### `ip` - - Initial configuration of the interface, routes, DNS, NTP servers. - - Full documentation is available in the [Linux kernel docs](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt). - - `ip=:::::::::` - - Talos will use the configuration supplied via the kernel parameter as the initial network configuration. - This parameter is useful in the environments where DHCP doesn't provide IP addresses or when default DNS and NTP servers should be overridden - before loading machine configuration. - Partial configuration can be applied as well, e.g. `ip=<:::::::::` sets only the DNS and NTP servers. - - IPv6 addresses can be specified by enclosing them in the square brackets, e.g. `ip=[2001:db8::a]:[2001:db8::b]:[fe80::1]::master1:eth1::[2001:4860:4860::6464]:[2001:4860:4860::64]:[2001:4860:4806::]`. - -#### `bond` - - Bond interface configuration. - - Full documentation is available in the [Dracut kernel docs](https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html). - - `bond=:::` - - Talos will use the `bond=` kernel parameter if supplied to set the initial bond configuration. - This parameter is useful in environments where the switch ports are suspended if the machine doesn't setup a LACP bond. - - If only the bond name is supplied, the bond will be created with `eth0` and `eth1` as slaves and bond mode set as `balance-rr` - - All these below configurations are equivalent: - - * `bond=bond0` - * `bond=bond0:` - * `bond=bond0::` - * `bond=bond0:::` - * `bond=bond0:eth0,eth1` - * `bond=bond0:eth0,eth1:balance-rr` - - An example of a bond configuration with all options specified: - - `bond=bond1:eth3,eth4:mode=802.3ad,xmit_hash_policy=layer2+3:1450` - - This will create a bond interface named `bond1` with `eth3` and `eth4` as slaves and set the bond mode to `802.3ad`, the transmit hash policy to `layer2+3` and bond interface MTU to 1450. - -#### `panic` - - The amount of time to wait after a panic before a reboot is issued. - - Talos will always reboot if it encounters an unrecoverable error. - However, when collecting debug information, it may reboot too quickly for - humans to read the logs. - This option allows the user to delay the reboot to give time to collect debug - information from the console screen. - - A value of `0` disables automatic rebooting entirely. - -#### `talos.config` - - The URL at which the machine configuration data may be found. - -#### `talos.platform` - - The platform name on which Talos will run. - - Valid options are: - - `aws` - - `azure` - - `container` - - `digitalocean` - - `gcp` - - `metal` - - `equinixMetal` - - `vmware` - -#### `talos.board` - - The board name, if Talos is being used on an ARM64 SBC. - - Supported boards are: - - `bananapi_m64`: Banana Pi M64 - - `libretech_all_h3_cc_h5`: Libre Computer ALL-H3-CC - - `rock64`: Pine64 Rock64 - - `rpi_4`: Raspberry Pi 4, Model B - -#### `talos.hostname` - - The hostname to be used. - The hostname is generally specified in the machine config. - However, in some cases, the DHCP server needs to know the hostname - before the machine configuration has been acquired. - - Unless specifically required, the machine configuration should be used - instead. - -#### `talos.shutdown` - - The type of shutdown to use when Talos is told to shutdown. - - Valid options are: - - `halt` - - `poweroff` - -#### `talos.network.interface.ignore` - - A network interface which should be ignored and not configured by Talos. - - Before a configuration is applied (early on each boot), Talos attempts to - configure each network interface by DHCP. - If there are many network interfaces on the machine which have link but no - DHCP server, this can add significant boot delays. - - This option may be specified multiple times for multiple network interfaces. - -#### `talos.experimental.wipe` - - Resets the disk before starting up the system. - - Valid options are: - - `system` resets system disk. diff --git a/website/content/v1.0/reference/platform.md b/website/content/v1.0/reference/platform.md deleted file mode 100644 index 5d9b53f58..000000000 --- a/website/content/v1.0/reference/platform.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: "Platform" -description: "Visualization of the bootstrap process on bare metal machines." ---- - -### Metal - -Below is a image to visualize the process of bootstrapping nodes. - - diff --git a/website/content/v1.0/talos-guides/_index.md b/website/content/v1.0/talos-guides/_index.md deleted file mode 100644 index 1596f8566..000000000 --- a/website/content/v1.0/talos-guides/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Talos Linux Guides -weight: 20 -description: "Documentation on how to manage Talos Linux" ---- diff --git a/website/content/v1.0/talos-guides/configuration/_index.md b/website/content/v1.0/talos-guides/configuration/_index.md deleted file mode 100644 index a3ced180e..000000000 --- a/website/content/v1.0/talos-guides/configuration/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: "Configuration" -weight: 20 -description: "Guides on how to configure Talos Linux machines" ---- diff --git a/website/content/v1.0/talos-guides/configuration/certificate-authorities.md b/website/content/v1.0/talos-guides/configuration/certificate-authorities.md deleted file mode 100644 index 7af72aa46..000000000 --- a/website/content/v1.0/talos-guides/configuration/certificate-authorities.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: "Custom Certificate Authorities" -description: "How to supply custom certificate authorities" -aliases: - - ../../guides/configuring-certificate-authorities ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v1.0/talos-guides/configuration/containerd.md b/website/content/v1.0/talos-guides/configuration/containerd.md deleted file mode 100644 index bf396a041..000000000 --- a/website/content/v1.0/talos-guides/configuration/containerd.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: "Containerd" -description: "Customize Containerd Settings" -aliases: - - ../../guides/configuring-containerd ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v1.0/talos-guides/configuration/disk-encryption.md b/website/content/v1.0/talos-guides/configuration/disk-encryption.md deleted file mode 100644 index 54ae8df06..000000000 --- a/website/content/v1.0/talos-guides/configuration/disk-encryption.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" -aliases: - - ../../guides/disk-encryption ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only [STATE]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) and [EPHEMERAL]({{< relref "../../learn-more/architecture/#file-system-partitions" >}}) partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - provider: luks2 - keys: - - nodeID: {} - slot: 0 - state: - provider: luks2 - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--mode=staged`. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--mode=staged`: - -```bash -talosctl apply-config -f config.yaml -n --mode=staged -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v1.0/talos-guides/configuration/editing-machine-configuration.md b/website/content/v1.0/talos-guides/configuration/editing-machine-configuration.md deleted file mode 100644 index 37ca589da..000000000 --- a/website/content/v1.0/talos-guides/configuration/editing-machine-configuration.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." -aliases: - - ../../guides/editing-machine-configuration ---- - -Talos node state is fully defined by [machine configuration]({{< relref "../../reference/configuration" >}}). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of four modes: - -* apply change in automatic mode(default): reboot if the change can't be applied without a reboot, otherwise apply the change immediately -* apply change with a reboot (`--mode=reboot`): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--mode=no-reboot` flag): change is applied immediately without a reboot, fails if the change contains any fields that can not be updated without a reboot -* apply change on next reboot (`--mode=staged`): change is staged to be applied after a reboot, but node is not rebooted -* apply change in the interactive mode (`--mode=interactive`; only for `talosctl apply-config`): launches TUI based interactive installer - -> Note: applying change on next reboot (`--mode=staged`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --mode=staged` will not see changes - -Additionally, there is also `talosctl get machineconfig`, which retrieves the current node configuration API resource and contains the machine configuration in the `.spec` field. -It can be used to modify the configuration locally before being applied to the node. - -The list of config changes allowed to be applied immediately in Talos {{< release >}}: - -* `.debug` -* `.cluster` -* `.machine.time` -* `.machine.certCANs` -* `.machine.install` (configuration is only applied during install/upgrade) -* `.machine.network` -* `.machine.sysfs` -* `.machine.sysctls` -* `.machine.logging` -* `.machine.controlplane` -* `.machine.kubelet` -* `.machine.pods` -* `.machine.kernel` -* `.machine.registries` (CRI containerd plugin will not pick up the registry authentication settings without a reboot) - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --mode=no-reboot -``` - -Starting the interactive installer: - -```bash -talosctl -n IP apply machineconfig --mode=interactive -``` - -> Note: when a Talos node is running in the maintenance mode it's necessary to provide `--insecure (-i)` flag to connect to the API and apply the config. - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --mode=no-reboot -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies a set of [JSON patches](http://jsonpatch.com/) to the configuration and writes the result back to the node. - -Example, updating kubelet version (in auto mode): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/siderolabs/kubelet:v{{< k8s_release >}}"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v{{< k8s_release >}}"}]' -patched mc at the node -``` - -A patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -talosctl -n ,,... patch machineconfig -p '[{...}]' -``` - -Patches can also be sourced from files using `@file` syntax: - -```bash -talosctl -n patch machineconfig -p @kubelet-patch.json -p @manifest-patch.json -``` - -It might be easier to store patches in YAML format vs. the default JSON format. -Talos can detect file format automatically: - -```yaml -# kubelet-patch.yaml -- op: replace - path: /machine/kubelet/image - value: ghcr.io/siderolabs/kubelet:v{{< k8s_release >}} -``` - -```bash -talosctl -n patch machineconfig -p @kubelet-patch.yaml -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. diff --git a/website/content/v1.0/talos-guides/configuration/logging.md b/website/content/v1.0/talos-guides/configuration/logging.md deleted file mode 100644 index 341d2a69e..000000000 --- a/website/content/v1.0/talos-guides/configuration/logging.md +++ /dev/null @@ -1,404 +0,0 @@ ---- -title: "Logging" -description: "Dealing with Talos Linux logs." -aliases: - - ../../guiides/logging ---- - -## Viewing logs - -Kernel messages can be retrieved with `talosctl dmesg` command: - -```sh -$ talosctl -n 172.20.1.2 dmesg - -172.20.1.2: kern: info: [2021-11-10T10:09:37.662764956Z]: Command line: init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 random.trust_cpu=on printk.devkmsg=on ima_template=ima-ng ima_appraise=fix ima_hash=sha512 console=ttyS0 reboot=k panic=1 talos.shutdown=halt talos.platform=metal talos.config=http://172.20.1.1:40101/config.yaml -[...] -``` - -Service logs can be retrieved with `talosctl logs` command: - -```sh -$ talosctl -n 172.20.1.2 services - -NODE SERVICE STATE HEALTH LAST CHANGE LAST EVENT -172.20.1.2 apid Running OK 19m27s ago Health check successful -172.20.1.2 containerd Running OK 19m29s ago Health check successful -172.20.1.2 cri Running OK 19m27s ago Health check successful -172.20.1.2 etcd Running OK 19m22s ago Health check successful -172.20.1.2 kubelet Running OK 19m20s ago Health check successful -172.20.1.2 machined Running ? 19m30s ago Service started as goroutine -172.20.1.2 trustd Running OK 19m27s ago Health check successful -172.20.1.2 udevd Running OK 19m28s ago Health check successful - -$ talosctl -n 172.20.1.2 logs machined - -172.20.1.2: [talos] task setupLogger (1/1): done, 106.109µs -172.20.1.2: [talos] phase logger (1/7): done, 564.476µs -[...] -``` - -Container logs for Kubernetes pods can be retrieved with `talosctl logs -k` command: - -```sh -$ talosctl -n 172.20.1.2 containers -k -NODE NAMESPACE ID IMAGE PID STATUS -172.20.1.2 k8s.io kube-system/kube-flannel-dk6d5 k8s.gcr.io/pause:3.5 1329 SANDBOX_READY -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-cni ghcr.io/siderolabs/install-cni:v0.7.0-alpha.0-1-g2bb2efc 0 CONTAINER_EXITED -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:install-config quay.io/coreos/flannel:v0.13.0 0 CONTAINER_EXITED -172.20.1.2 k8s.io └─ kube-system/kube-flannel-dk6d5:kube-flannel quay.io/coreos/flannel:v0.13.0 1610 CONTAINER_RUNNING -172.20.1.2 k8s.io kube-system/kube-proxy-gfkqj k8s.gcr.io/pause:3.5 1311 SANDBOX_READY -172.20.1.2 k8s.io └─ kube-system/kube-proxy-gfkqj:kube-proxy k8s.gcr.io/kube-proxy:v{{< k8s_release >}} 1379 CONTAINER_RUNNING - -$ talosctl -n 172.20.1.2 logs -k kube-system/kube-proxy-gfkqj:kube-proxy -172.20.1.2: 2021-11-30T19:13:20.567825192Z stderr F I1130 19:13:20.567737 1 server_others.go:138] "Detected node IP" address="172.20.0.3" -172.20.1.2: 2021-11-30T19:13:20.599684397Z stderr F I1130 19:13:20.599613 1 server_others.go:206] "Using iptables Proxier" -[...] -``` - -## Sending logs - -### Service logs - -You can enable logs sendings in machine configuration: - -```yaml -machine: - logging: - destinations: - - endpoint: "udp://127.0.0.1:12345/" - format: "json_lines" - - endpoint: "tcp://host:5044/" - format: "json_lines" -``` - -Several destinations can be specified. -Supported protocols are UDP and TCP. -The only currently supported format is `json_lines`: - -```json -{ - "msg": "[talos] apply config request: immediate true, on reboot false", - "talos-level": "info", - "talos-service": "machined", - "talos-time": "2021-11-10T10:48:49.294858021Z" -} -``` - -Messages are newline-separated when sent over TCP. -Over UDP messages are sent with one message per packet. -`msg`, `talos-level`, `talos-service`, and `talos-time` fields are always present; there may be additional fields. - -### Kernel logs - -Kernel log delivery can be enabled with the `talos.logging.kernel` kernel command line argument, which can be specified -in the `.machine.installer.extraKernelArgs`: - -```yaml -machine: - install: - extraKernelArgs: - - talos.logging.kernel=tcp://host:5044/ -``` - -Kernel log destination is specified in the same way as service log endpoint. -The only supported format is `json_lines`. - -Sample message: - -```json -{ - "clock":6252819, // time relative to the kernel boot time - "facility":"user", - "msg":"[talos] task startAllServices (1/1): waiting for 6 services\n", - "priority":"warning", - "seq":711, - "talos-level":"warn", // Talos-translated `priority` into common logging level - "talos-time":"2021-11-26T16:53:21.3258698Z" // Talos-translated `clock` using current time -} -``` - -> `extraKernelArgs` in the machine configuration are only applied on Talos upgrades, not just by applying the config. -> (Upgrading to the same version is fine). - -### Filebeat example - -To forward logs to other Log collection services, one way to do this is sending -them to a [Filebeat](https://www.elastic.co/beats/filebeat) running in the -cluster itself (in the host network), which takes care of forwarding it to -other endpoints (and the necessary transformations). - -If [Elastic Cloud on Kubernetes](https://www.elastic.co/elastic-cloud-kubernetes) -is being used, the following Beat (custom resource) configuration might be -helpful: - -```yaml -apiVersion: beat.k8s.elastic.co/v1beta1 -kind: Beat -metadata: - name: talos -spec: - type: filebeat - version: 7.15.1 - elasticsearchRef: - name: talos - config: - filebeat.inputs: - - type: "udp" - host: "127.0.0.1:12345" - processors: - - decode_json_fields: - fields: ["message"] - target: "" - - timestamp: - field: "talos-time" - layouts: - - "2006-01-02T15:04:05.999999999Z07:00" - - drop_fields: - fields: ["message", "talos-time"] - - rename: - fields: - - from: "msg" - to: "message" - - daemonSet: - updateStrategy: - rollingUpdate: - maxUnavailable: 100% - podTemplate: - spec: - dnsPolicy: ClusterFirstWithHostNet - hostNetwork: true - securityContext: - runAsUser: 0 - containers: - - name: filebeat - ports: - - protocol: UDP - containerPort: 12345 - hostPort: 12345 -``` - -The input configuration ensures that messages and timestamps are extracted properly. -Refer to the Filebeat documentation on how to forward logs to other outputs. - -Also note the `hostNetwork: true` in the `daemonSet` configuration. - -This ensures filebeat uses the host network, and listens on `127.0.0.1:12345` -(UDP) on every machine, which can then be specified as a logging endpoint in -the machine configuration. - -### Fluent-bit example - -First, we'll create a value file for the `fluentd-bit` Helm chart. - -```yaml -# fluentd-bit.yaml - -podAnnotations: - fluentbit.io/exclude: 'true' - -extraPorts: - - port: 12345 - containerPort: 12345 - protocol: TCP - name: talos - -config: - service: | - [SERVICE] - Flush 5 - Daemon Off - Log_Level warn - Parsers_File custom_parsers.conf - - inputs: | - [INPUT] - Name tcp - Listen 0.0.0.0 - Port 12345 - Format json - Tag talos.* - - [INPUT] - Name tail - Alias kubernetes - Path /var/log/containers/*.log - Parser containerd - Tag kubernetes.* - - [INPUT] - Name tail - Alias audit - Path /var/log/audit/kube/*.log - Parser audit - Tag audit.* - - filters: | - [FILTER] - Name kubernetes - Alias kubernetes - Match kubernetes.* - Kube_Tag_Prefix kubernetes.var.log.containers. - Use_Kubelet Off - Merge_Log On - Merge_Log_Trim On - Keep_Log Off - K8S-Logging.Parser Off - K8S-Logging.Exclude On - Annotations Off - Labels On - - [FILTER] - Name modify - Match kubernetes.* - Add source kubernetes - Remove logtag - - customParsers: | - [PARSER] - Name audit - Format json - Time_Key requestReceivedTimestamp - Time_Format %Y-%m-%dT%H:%M:%S.%L%z - - [PARSER] - Name containerd - Format regex - Regex ^(?

J<~Y9Xv~R1;}P=kTMdNV$B;5^eZMao1Eg%SNF$Zi zEB*$Ufa-;^XyQ>?sXxqmW?5 zT7VhC`O{d+Ff^~Cd2hyC6PHThm_(Z|2V!?e<82ZWNcFiGMK?*ZJZL6agYxB3s4JIY zPQ-IuePlPomooN1kyrH3G(2ILROs;nm`y~MG32^txXWQ;y$EuXrAysU}q{bT^huIKCnb)0W=R=zOGw7Cpx+nQ@PdRJx6;h=(P6F#MHC?OWF}ywy@r0h|$jvS})!-fWM$IHDO5n=5pqB zGx-|QIDG+Y3VLq1~t~EDFMxLD6tR{ehU{*)Q}y zs^~D3*Y*A(+!$C0Na~V;JXH48(KJ{EMtZ8@KN%nYaBtkxD>-$%s|V)GGZ1KtGeKw! zJ315d&T8YoxQ?hy#l7^e=b*U}y{5WdZR%<2)TgYr1oC<17--bElq4*1xKy<(36bOkd&4~fc1JP{7DmoW!OAL6H&bho>JM;> zdj#E`D>3C<$atLL(Q{fv&z1LbEPC)!T~=(2cAEy*hq=7*l`tFr$7(kMj9rkz>jc6n z=T9d;$XLe?68R^VrpFeJMzEy#&;_pNXAL*~J)t(8FSqs7wglJh(wKpxWqTxA*5uW zgX18=Mrd5ohUTxiIY1cByc^T%IVL@C;LE)eYdq!<)Ck!o7!zCuoU zx9|D-3w6n&L1M)0wR{FG=+f0usHC0){uO(fgvlJcbZ=Y}c* zS}3o6mdpc{Pe^`_-OA=*J!c`)o+-_wV==OWhsCVZ!;&3S$EE;LaQ%FcN-X9-{>w&tU5>PcJP;7{1k(h zu-|)ZXX77m>EBQdOuPQ?vs+;C~MD~k4jk`yY?n}Gn&El^utkk$p(}w zJ$OyFhiCsHx&s&cL1eg@r2SVJG)XMGZ3AT5V0ZECS`kwhEgs3&kVb)Hgw424ho9@09TjZO z5u=Qjf^fyS>K`t=!jrqz55=hA6+=r;Q(p;#Wvt$L))ypIY`76ALm+ zEJ0*|R$Ch9XRUeGqL8=;^Nz)E8^SbeB& zzGH=wG~3m~u|)7+VsAdg020jphbZzXq6ghzhfggmK!6=k(T{X_21Q+HEUL=~<9oIr zLhGV7()dooJv?y3UDgFrgU?BdkwRhSbgUw7CU|jJUl-_s?dZOW;8|~t+(wx>bF)We zQ4=xin4oXdsO99VpmwYe2hrbmukAb+2vbq0yc%7tlR{YISIEh5wAZ(-`00HHrh;iJ zC{_GTu10#?Gx>jB&(mYYFrXE0DPq(7!{=zHM*otPb8isvIM6pNATh0PqjtEa`XCSM zn8%iVf}_G@i4;?szQO)Y@Mb*q*^Wi5U&D#|V{De%r{DkY^>%zUWN?{d5fHOSVnQ22 z$A3QhW$`|0?0N)?AL?bbpp}ad(`sViC>2u9)OGn;SGRDx>I=9mz<2_^|I9#i7%C2N z_5Bhq1J;0BC9?}^AF>DF-y)?oe$1>Mh9+qk7Gk7=v0R-lwh^Z8F)#3~YFYrlDkgyP zR>#?~XlyBM`7E(gyuUpMQe$xaKTcr{7W1uVX)%rwOu>8_jn;yO9&C zIvst?S{qJzLrt!^B0tY`%u2n#S#T*sb5HF9`ywa+)7g z&}+aSMc`O_t~Un}Eks@G42;21d zwLz;AtYh}8er7TTv6Gwwq|H=A{&$TequrC;4svDO6~CD#Ag-6ac`#WbCp<9 z{5%+T0{D}=^}2}V##<9}$RN*>V;77Q4S-`AT!ul)qGp1l zek{`b5i5bGt>c0qbIliV^KrM~P!jgZ#|Nc;kd4#EDf&+~EYP2nN$f3<57j9{J>DtH zU(&}3Yg|Wge7#*QJm$y0KX>N}`k_wAnLd2fNC&Z<5&p$ei#PWW?7fl#fRwKtTULBe^xmV21Sy+Zz}^S|s~E`}c*FU4O) zHw-mh67|R0m2&C_qTSD-PPcDFxaF3k9Cwh~l^=#h-^_QWkEsYrtg40HSWG!h)a41o z(-@vVc~E7Yqn{51a$-GB?zUMyFSD;QXN78A=3h-4G5u%{XG4~@V2B+Dv_;~a!Os}? zw-H(V?EOQ!x_KPh!6P)l(tPwk<$U}D53Itt&}mV*N10CZwOvAxz>Vi-e^FXoTQSbn zPH5tG^1**yUPC9_c%&U@@enRrR87>`Jwwm<(S-B2uJ?lxE^0z_NPupf<-72;_u9%2 zVepWti`%G9pM54e#F8<0H(+gs7JgJUsaWe~Atm0QKBOVYT#Hw+9W)n8j@SaNGMUq! zN4~x7XU3xZxpF?mj8T1YRq(UwJ95vUR|8${Q~s>(bc>Em7Pj$JlLVMyZVn9WRFwKn zT_z~x%^y)(M1Oz3L|ZOO5~G*Op>1>ym)AtjnSCiIzM4s?OSebJD0KO!3Fg)2BiO5D z=csqKGzI%ISHHaEI{f!}_zPMkrR9VJMmTaWPb4$aC)_!;8RcHd`WH2Cng3p|?fzWq z2%|@P1YTt^xE!uU@$r9fe7Akqj{AH9D*{wpIXiwn(!#6@WPRcYQq&!Ay-_+GTOTwT zXBpt8M_=jTMGcydjq|Ov=iVyd-ITxmbg`WJHZSj+JwYB1)q5tjml__gA80*&d4&@%Z2 zBT56Miy{He|L1PAnxKLQa(zrWch?rW`@7F)+WC8whYN6o9f^ZriHB+N&ahJ@o^)jJ z1M8Wu`|AxB3ENxHvf4xfNVAXwIzPU*)4f!KO^*h;)Y;3z7af{wD8@9U1+{jaNm0*F zc-in>eF|HvPqnO8AeCL3c>VQiI8WhEc{R%26hJP+3OW@sYnX`cD} zzOyhdtO0eJcJBElp{Z2;!lz#TEJ>B|1XAREGLr6Ar|vV6z`6H2~kuEil$L{zFhI-=4Q{0 z{1nBZfHbS;edcNO)^Wpy+U=&wJXZ$eA3(Z57(Ch4}0A|fpiZ=t+im$ ztlzzSOoY5T#-PM=3~@!iq&z3OWkC0L{3e66_*sINn-SlbLs%{r&zsG4BIG2Jw6SWV z@79j!5xzv=HfM6Fpcv7`U2;c1x;XG@3#3Ukbh!IUhsA~Sj#WGef}8B+|LRn%6p1;|);jKeAO7op+y!fRS24ffAvY%Fj~43n zJTnpV2EDlg`Xu0+e#!uVG^`CHJ$~&rKRsv*C4Mo212#2Za60uJr7?w#Rta+H)Iif& zFSlB#TFacU-c$!}Oe#8Kq_Jp=#F>4AzS|=bTih9;p<9oLB+z`&TX1+wXW7?{b7+&K zhA?li>gPA=kNe^v{u&&qfd;^UPqr%*zXIDleTi*%rIl#$cI$3lb#cjh(1Z*8mvR3S4mK_`H0*j9Vj;{VJ&~kr8?o4@)6YN z4>uIuC9AbF?KYv%%ay*Bh}$8RsNi7zjdD2qFf+(_p(?8?h$BGVJ5Z#Rv~QiJVqC?r zD!6HakM+|5EwM{}tnD%Muj;Rpf%#O-CDy>H+^A{x>%6oQ z(}%_b>g(izK{uzXl}n2V8)h>4|Js0%3<-pVk8k6uz&{BB1eW+Hn_)4(qi$1xFrf_!na|Xh==Y3X>wr;5(>^0|~5VBl0 zgcP9mg8jL!q+YQiS15n*n;7XG-s67HPXGMz`ZLcyi~v6T6yxs>2!JbYW47455RLScIbo>Z7tf) zbk0}(oc!p!q~liiJ&Sp}DTAWWY_xB(aLrxTL3#EiC5OPpz(n0=vtT}OfQQBluSU>K zt%c(Jr(!e^R&Tcq2B(w%JP5f;Gs75OOmqkgcY-bfi`AnvX2%Y$c@37C?|ARS|9vN# zas*W0D%T2$kaoA8FA=xbf5dnOA^sY_QxikD^?Q8=C)xlb`rQz5x)F(p!HqJ2E7i4( z8ajch-hSnc{_)wq!TiDRp6N&xaqa9}?LF0OQmZ~N1Z4mtCmxS>qM6;4 z8RVj=jp{jHIRzfde#&io*roh;bNkQFWf_2FZAF>~3cIMjxIbu6P%+dLo%Hi`X7PKJ z4(SHJ62l|6V$@r7`bA~!igLz`@MB~;7y8>(A`G_sWw)J1SW+*#fls;Q+7mAy?`xfl zIE)vI!2z#c!U-LlhWLXV`jo(JuT-;AC)n<=Lb$goTfQECE56L0KU>26h2AxCkjc5* zA0pd7UsH@S$1#%YO!Rms9+No(IgX_AJ{E7DBRG74jB)!K9JoZlvy8rax`r%Df#S?$ zhJ=yeoHnq@)9QS8_+n{iO4Ps4B6pVhx&V_)N_&Xz6{EKtvYrTKg@707&TH-fE)2AP zi^CIXyGx&=IZ(?u>@B#1UK$sp1O7jyoIPCW^2w-n3-OToaMV^#gHC2)`r5`UDM!8Q=H$Xm>Z|334w`CS|IGp zZCV8}r15(BT}9V>Oi(BE(sU-*Y72BDRwsQLC3vroszNG2remK1`fQY|8M2dshVkp% zSpUlfRqy_TB)r*8wb{Bh8}azM`?s&2_-SyJ!{1x&((WkYLfnj`=f0W5ws)b~2!Gx! zMMQRDW<|%1tfMn=&A{pXl@SsCx4%3xjvxPTm=~KrfVFMq4lTc#iXJ3|KC1zxoigtd zONwP~DrjJPIA&=-7*l+cf30v@eo=UPiHrgD#hd@7?QbFoY8}hQ70VJoaj}}_5nz;a z7x74*pCn+=E^HQ<>npJ)wK3l8p^^W`7wO-2MAv=*_@Ww&*KlF{H%elW%^YtjitZ>; zy)yqvI`m=uG=B4KBq2M0jy}V#eXNj>TzMuVkh@Z(E!OHc)6t*wyU4|KpEsrind5B& z3Bqr`-piL+#7ep>pb?|;ZH~q(o+Sr`;>W@0=l98?H|9pS+^Q*6tE%B=wH2NZE@Qpd z#Afg;W$!STW$UJK!i{O8@)h|Tq}nB{#)~)x^tlOfwxYoX>=GppFfpao7cbanv+N1J zZ;QI3Q@gf{t@K|ORDEDl*NqIh$L}$3SfK^BAeeE%342(+cVGhBF}91dZ0-zDT9KY| zznlo7CI-6QbP>Y-SI$qak$~KWkULTEKtGCaRDVc&EckF$dA|iZfXk4CU-_9J1v~)s ztrty@Z*GBxi@wCeIea~=u(M8=?982cq|2D9aqxx93D#T7;npgoeWMAUH_%RPr~SHDsa+OOb)j7_nL}>Wq9yz@ryO57y z?lrxWhY~HTyZKvMvQ7nI-rUcGfR2AK_oJeG*u>nD@Mw4$RYnFEm?ZeQ^WpmERM2W$ z$&$EZz^|7%xKuGn71jBeIPs)}-|i^0@Q8|~23X_~oFU#8gdICEGYT$t4VDURi{3{swX!48XuV7P?R5UdGaz$QV){ zG?5EyI2x}t&Q8Cl;uW1}C?b5Ea}8cQ?P<6%aSSy^h@e_D)}p;O2p&qB*GRYnh-aD^*v?2mS#{q3rD&qNCt^zVEFtE@hVmXTd_ zv!rlYbT_&B@jffEhb^Q^D+l-2_Gagb&0BodA$A%pqB~`(?=0pVa5`2`iKDET&S#1k zLaH#Nj>zs6%=b@tBd#qB8o5zw8}*jC2+Gx=7CadH)iq}Pk>rL`9fV<$>Py_4#ZWsn zsj230=#Y6t<+sFkB8avpl*>?^ce2EkG7szb-)0NeQ4azOK+;gF5HVG~uM!P!HM18w zp!?K*PaN#<{a$m}*7MC!$HLXC-1OQN<&CR(T~GuG8I{A8uOX@&=TyY}qUFO`oDU1} znF4K{1Oe?@djwc!JAsx6D(JA_|8PR--*XJ^y0uq4l}B@XaM6|bJpBU*LB_M4&zvX+ zTiy6rKZm}vl`TgnlOp}{F~KJ;b%^2ee?!b<+o@@V(l zPbW}sP2f}D%FEQROlbbodXffpe|U=S*hW{tp`k`y?%ye~^UfeTzVi|bSsD-OcBC6F zEiSkF;>8QcOde)Lhf3Dvno5^{Bz}5ILHFa_;et6&yMvd7fO`96EARQ{kWT zy?EaUN}XM;TMdsv&$$qBAx7U>?bb+B$O&xi(f=ma!L*W%{cI-O`JL=B$NGX#BMW`Z zLHDp*(8YNt4Lv1VP#!POWnvml&Qtqu|Bo8U5#}P1$~_EIW|qd8ej;zM43Hz0JzCkb zLre+XS{Y5%HiM;X4wb!ldY5>dK5Vt`&@_vCgV-Lrl2MbY(<0<$j6LbgBj z&aCBOzuOP~b89sY8SEdMEoD>j-cgdaDCHi5mLBsrr^|p&g)FAzpoo})8^?1}jV^U% z(-5T4uasU+2(m7G0v__2@OvJi=zKTltKUu=m~_XkH2;jUk*2r8wUK7WTy;$mk5-X| z^RpNU+SgLl^QSeh?XR@YcmFF4Q}zZ*XNi;AbrWq3%2{!MS%*F~b?hYkd0!|@xK@|a zQNAfGQ@--7W~`PX5@|M8zH*+=TM(&m2gl+q{P98i@vTsPrr@aYrB02o=EoO{x=bdH zJWZM}nqa%;Ve!oc7YnyYMTvh!>fPhs6Ne0(>%F!!XkR887f8exqJtN`47zK_*w?pm z392m4{?Dq(o&>V~Xp6Dup$Y%xGDQDudK&wt$CMOS{A|BNr*7={jJx?%*Ra}8=gB}7 zUXVM`8K4CH#$=kz!EVDyuKG8yzqwRqiWBbsJ4%XVPM+?d(}Iw9c31?%=b`#F-lTs+ zq3^Sxu?xmZErUDX1?{k3N6Lc$b1gL0Y6J_X=oU^x`Ro@m<4<$VnCLW0Ds+!n^&rc| zsxX=z1jm3o+IiL*Hvk)=ElrlRf)HBIr1 zyZ&L>Md!CtFGxaI2!nP>f&!6sBf5ER7Rm_ALC5O4rsRgN%I6;OZbVRmAyocX@g+`V z-WnBh&yIxBk!rUU{d#juhcrjc2DHIBo<=JTDzLbbo~I*PT$Z zf6ctKZzFQXo~0W!o{zJ<(k&&!VaI5+7+ad@DS0Ao5$2%9l;J-4vSxh$>PLb|PflIZ zwbK;v;J40=Cj#GXmcM0=B0SR81Z57<+RjX{?{pcnu0?d!@+-NcVs}YN@$@?bY^%W) z3JZU{uO$vD{hGJ=5dv<95z&JC`qpF6Zwjjli0y1?wxs=WXq|s7%NOf@hL~VoDM#9b zIL-jF)Xbek*B`PaQxGdbd@bPg*UemF<-u-B3pmdH((gaPFA5+$9HoQ+*bPsIV)s`aWcOnzA zLOh#Zbfg*CF1#LGk@$F^T0V!RST!eb;}bb-EnpY(gLnICS*TY6&tO}Y;Wi9%lx2ML{fqkT(E-Z-w;WBj<<_RIhV(3SVyPL{Jy?8s4# z(eL|t+ya`aAQ@T+)oaDu~bKiCVcrv zmj5t&hit9&O@zqKS$kd{P;w2NtMw=erB3YRYL#o}iH_de8>N&PU7jp0XbDjv3nuo zLEmjQb;>Gh$aF4#ha^Rdz3xK9gYYI{NcaOQRxj)O?>B+)ZSDDFsdwUor_5-@DHjno z&0PC)V>biVbQ@f49Txu7=$`}TT@V1Nq*jj`PpxS&z4la2=BYCJE&<}Umkbfe`=Td> z0&i90W1(MN*Molpcf!@=rj@&D1fO#I^uKt$PdWX7GS*Pxe6;Wx9X`U{^~V<4TjD0L zv5+6%*heM%$h=Gb16KmSDG>T~yy)r03)ikq(QV$u3th4ZM$D1i+y*k^vF z!WkW{n{{jF3`klhhYyBhzZv(!L~Rp{Qp@TVvxn(aFj|G;*mu<2@~ZnX?rgSrx+e$Q z#W)O3%66(V%uEm^Zv0S1<5h2hXBOBvQV8O3JRoFdEYms)1@ZC$~ znH>_Vj&pG%KC3H6vV7n6nkxLoRdFVv1H~_ib7uaQFy9hWild~nQk3}NY5Z6BOiU<5o!7IDJinC4g=5_n$F`?avJuLF$ zOQ$Hua*bzd4t7H8NH)=u3dbiKk_83RRn#BoiMfbO5g9etol&=hW2q8T8*vY{0hxH5 z?}_S&UkOuc#AlBLG2kjk{gXFH^>eA^gvdq;1h+-g1o}-atjFyCZEv#DR=v4GI?O#| z?1o~jDtZHW+1R?#m@-Jz11=DBjK~gPrc#aB#2{U^$R5_~2hsf8g25<7&Q;v?_H0Jv zI|OAF0}|qo+b7xZ{aMb4nV}PtIhP8^g9|O=gWjs*c-t}ax|tUQ2kJ(e(Ju^<=((4! z(e8V_wVKht3d)6?l{BhWJw+F{(ub#$<4(xjuc=`Knns4a#rmpBRRdTUP^lWZ#J}~_ zWl%|rmq&a0dcO7lxBxr!um1h1lEv8=XV~P)eQ}F9=Nnim)z5kObo+-Wowm3lXE!M* zRGq9D9r88y7~5^p`=+Jg?lvmB`~A&K+)DBD&O;eRUE(d%-e0cl*CU5lpbOKJ!yJ0L zWtvl=urHS>u}_q40SXv;JBfT z%n&x6rfSu0dTX_fT3wphHJ?tYjeNgf^M*-L-d2D7B;&Qco>lH)7h}(LY$AK0UhA8H z7M4=lFTQPc1L}50lH2zzzhoX&`qI6|4F-QSIqK!&T51x}Xy;z_{naM=0(xG{!8p>; z2plL7#S^B^K7VNQ{G+h&)+z5OHUt&FaB}Aa0Hugmo2wofvXRA_U9I7ltII;*2Yk`BDwEZ?v#hAULa0&JZ8- z3w3nYpGk(BSH!&cPFO|r_*|kra3z9xYSiXnR>3sorjmY8jfVi3QR2s>WY*IjEO}pb(b9aNukXzSs#^3FXGlKROH7!VuZl~9zhqj$DbP3C$^yB+I ztryklnGpt_B^9r;}5fB+XP~n$8|g6y@*z0(`FKbp?7hP_S2$zQnRAC zJPK;$PXb`2LsW{R24i21QZdA@9p{*=Sr%l~jlKUpB4O?!@ntV$|GMLB|1bEU`_apT z!O8gYL1HJZ!?FB1OvRmK^P_S`MwD`;PMK^)m7}Skcalt6*%(g`P{Vj{HtzgtqlXV; zG?PWIq|w$^7aRpB%a-0Af;s&32k1Fi6dxl~*{Al}64L75Al;;QQ|>AB;fo)1oqYmrk17HCBBvy; zR6JXkTLfz_<4}EZwWigZlFCR=6{4$kxY@4Sb9;!K#@H8usz);l8xn#^`4e7Cg zn-s#1bCahRxu--lH@kie146cJ2&{*A8cv&*g7+5rd|J3zn-xt2t)eq01s_H)HI=@` zWqx~KS?%pYt4`Oo=NXgjav9O{qoaCDe2tgx_#p+DFbnWSSku`_Jqs23yHhwR!u39C4ed&KkxetI@S2-aT`@Pj z_4JTSNk5TBt9sA-T0j{Z%T9M1zR^o)C6{|14QH~>n0x#i+f!ix^+5W05}p*)>k)bI zat+i|AtLst{&!m<-T~w%=gXK{Qs!BVhRn{b+lNBJi6WyH=gCQamz=U`i%%SrbNyPa zC8dn<2#Jjs_2}r>^A{@(sLKwc4;$savgTS#im5-wacN^%I6OzJ(UXa{*rha?fTey%!j`(V#o_s zv8V^^)i19Vo)?n2p4aA`Om^YYsB=wfrnhfsS8rd(aHkXC1Gl5&f(ikDA&sWspq=|8 zc-P&HP}p>O{BLphy!i^fI0xK=N9l({3h|{^-$q0Ft#yHEA@-VMl?A2mF#lg`rKNR) zDVwL*V3jDmwycyyJy&U88SwC~)kO7TVd>t`&c(>G$A=Z87(M(9ryf0_B)Z5^`EP3w zha%FM>2;~F=VwV&UJa+YzlFu0!fq9&yM-e;dgj3~ZjZe+@gO9?2veT^!k7u{^N<87 zIB>aeIg;$456yWwJ`*8?^P+b>_H|9Sop2oOkNm{o@SD~?)*ju>yPw_2e52`EMw*&S zshH!vf!|?0rY`Trd{X}T4|3i7O1DC&|Hm)gK#zmwF|7&E`|V21*o^yrv6_aVc%vXa zcU3vP6Umz`Vn!&;chPE!OYxshLAb0}y$qcwfmJKcR?|=-Byl^=C*PO7=-<}br?>Sv zKgtZI(SKs~I+CdQI0gj+#6VH!{G zr6UY*l9dt`L_|83CJH&#F`BNh2*e~FUB-v~vHt^;#ITDw@r;ZR zruGu1pvO+ZbYE$VDmcUqCXOL1#nF4_zd2njd3}xftaKjAa^3Hbz|v+761w-k7loOj z$YSr0b!rC1f(NUe<}KNpSpr>ER=q#Fb|jl@|96ZvF4An6mvgP<6wet4Q|nVYm+ zqQvrf+WH0y`T6e3CV15O`vLDr^EOyE4_dbAzObY2t}WV4{68R3_s6AIe$=m`X}qo_ zt=QMd`aWCMbb=n|(D1<(pa0CBhpTvzjF;SXYKHEp|KZP01t)^5T~wc)-uxbHX(gAv zQ@1W>I93w_#f5~? z&TizNbk?~n87Ku9+sW_aD7~hLB)kxcn2=c)$9C^UZ&4>!#gPzPy=tn zZ^Te%e-70H9p_z_;Y;b`K0CF4O^ZMwKyvRI+*@BsXQ-7z`9w#GZPEtB|2_Q$U5%JqeOhENHFUUJ?urN!F6HO}YJOxMZGX%> z0EiI+%x)9jf3FPeDS0#AI>f6#EhnI;V()y46p9whyAe7;6kkl(O#e$4q4YFS{BZ~N?tUv$B`$UF;WdM5NwoCq! zj*>Q**OI3m3@tBFL-1huqzy1D0Dgrh2KQGWmL=dX*e7$%-P{LuQtwaH1W0{ah(6Il z)xs|e$RrQI`2I40xz5i?=e!1ItahvKdHnNQ_4|0L1bx%UWy#TRFTKZ@7YofQsztwD z+4SxA3Bc61T*Me1mHE`%^O%md*|LnBgdtz7^VI93jBkgdo@-+B>PhA z^~R~5IH2`9-4tzhxR6aDFXrGjB1O-^KfT}4=kmL#-h0?)2;yJ^`uNR$YV`140HLZ< z&EZB;@_KdiaNt&>-FJ?NlYWoSoDZcdW`U7TJk{)*WOI?Dnk;GJyj(Agb>$3&Yy!d72l$(aj$G@mlo#-!5BV0c@<3-TbtfU2jbs z+_|a3x}b@wAyIs-8>|gQi?_iU0$~+CWBkViGSRM}I6o!!R!hDls)oXufwEpbbgO9G zX_ge%jalt?Ug_cpx{e@)cbt`Kf+ZL>5}C9aQEriC0K-ZXbUq8jgx(uHdt;m{j^(PA z42m#40Q|WTn+o0?=Wrg0f+$a879=w}QRO;KXd24$w8se&`MfiT>@<1o+QE?{5B98R zVQygfm;vFlQJ_~CM;&AjMWe#+XYDB`MGbB75Jidjpi>PxJ2^b?RmgR`uW+vM5Qhtm z26D_uxc51||4a5zFKvXM;cP?FNXWYk9FLGVpF50oajcX0ZP&{hyHL~n{vAFMYx>JB zV#9?pnXF4Y1ApesA>TtYIp77TSg+#m>C+fH+(eJ*_{6JI!$Lp*%Ly;i9XkJTvsJkE z_OgPEj~ANbuu^vX|2O(I@Xx_DEvvp+ZGwP})A^Rc`AE4ZtC7Uh`2ev!{~v%&VHY_C`madpOI!%|TIwSvJv#><%!`G~x(@1i+f?cMcu>_e z2wXC@Tkyd>lIaK7;?_N-nu7VRa*9yr0GCm`k~fb3T>nPoX`ST_8Xq{J)u1o?h$ zeeO$->>ctGJTp{TWITC61y%y=uH;cPlo8+^U1l$I(~+JM5h}Q2?OkzCY`F~5NW zbt}$M@uYBcw_(KGZUBtQ)K^HHPJ*Z+o^3$tMEBn8{Bumcadp;z1A?h|der+JPT zQG?ad;?Q04PX|`DTzxZ;yVJ&6vfQmweA~b?fjjaKzm*%rsiiuLz_Tolftv-~%Z?1r)x6v+l zxfxe-{-<&;4frIM9&VWN_I6SDUA>}m6RnzdSEBJ|dOiM?akakF=~SRR_TEkJ0&4D! z|3mn{IHJu5R3PzN-pQo2O%g+(Y#rgR=H&I`GNjgbv4N+^E>4-Z^sJ{5^#R1}Al8N2 z_Tuf0AL~=SJ5|(STJ$lk)#ZYve6;|R2$A8*#w`F2<>Jn4FC~CAb%s6x#;2*oM=$8d z50f;gLRyPX$C%f$d&Y#M6ezILaU!wRZk7uN3gj)? zwIIQONUMO0ABE?B>OkgNba1iRj-iGH>#l^69+^cRC~%*W8Pmu77EN*vtc zQ4bkHj8F|WCx$bs@h$tS$C=52dN;TZnm^gU zzB{{xNV}F?#Ma6l1?n#((d$UWG9gr!__ujw751thIm}+`G%IWDx7|~3g^tUotWB_X zW*O>-cl=?bRh901&fV3N4%B#ZOog-xj_o`M>%joIoO^DPB%VlKhV84%`GfKIMTZHk z3W?#U<`M6HCX1{xavusAuL$C=xaF->pQ@o)1G}QIxby#}cZt^oBWXO!B~zbqknJFO z+lO*y>VRFH1qEc$pi#0MAv*ZLV;b4>L(n@FhkEl zxi`tIeR2fw8I9HagwJ=bPr*Wbe-ST~!y_g6?Ar$!TrNhR>Qe6h zsJx#d1u`^ z(mB|WfsfQs`AuxRmH#;4NQ~=R3@^Hh!Z9NxnrcC4jpLv`qKuLicC9LmpU%(gLfY#> zymb(dmb;y)_nd=&BvR%KPcOh9R%7cX$+W_4q7{dm?` z6z2TR%mm@`z*lg;NhcGU&!gQr4}Bk3!Zk87Ct>v6U%N&pCPG}BiI`gyl7aP-IU@trlJwcLjwIbux#^ghAzl1Nr8F4>L-9x?-H0GSCCw1D^%Z^}C+v zdqH{j&nsK!*?l&F!^H!tRlZjgC+J;&-RiEJ0q;Z=6!WED{F>eQ`{t5Le*4CFh9jB7IP(@Sd@ zDN5%(hBc7wEX=5BldTtAj*zpJekNy#RrooD(420F!~@@=b)!0RF>1Ap%x!}xF=NiU z9xd<%B>p$t_Ygt;M+;MksqJHYb>TQdIPv}Ko&U$a+y_|d1TIAp^c1`h|Iw~2w%C$U z2j+nqB_Wd0@(0b3Y{ObN$6unDNd!P~+Ak|Q7ZXlbdB^a95&A!)F4dFJ?wbPl zv2DEhN00>u3pLJbqt`79uahfiL;n<^RCg5WxsbVk%0_$YVr?D+mc-k@!7Zf)8RKKR6Nop{?am`wKF2pj!&F-G zwyaw0W_2CMFypsw9;p5a9Ph1?-XIDMpZO)Lz;*$A0$Br8ysm|E@`VN~!bAMcvB0FK zE(ZXi{P{x|thVUg9n6_VH*Vk!d?%^`-1mb#VQ4Y(HLkXA51cdVItc|$d%ww^fN|(D zwK~~he4yfpY!jPeshVPYJmm6fzyTm_ack@!wHt^nO=pq_!bJ(18)|fN=wIU*LA>o> zqY!DEw3z|v@BNTEAHM(T^!q6F@~0W<_Kbhk(;=HxaGFUnf$Z*3TCsv!|7nQy&2Cwx z^yjrn&cz!Q^6RIn2P~zBMi~F%A*N<*W#nVdjo2Rz9vr+QoPUn;EC{b{^wWYTZ>d2s z2j?Y{J0?$e6=x~6wALmcId#$SN!(yJ@LzlSV!1@fj3;N{PSZ$tlJAe)7ZtfGV-A#g z)$tV}TKFlciwQd)et8+((6|1?hbbdHijJj+zP#rh@0AME8+(j{T@(&ugKP0iT@fuT zwf_q;69cjbeR(l^ZKL&gLEKv1*Pw>(vn^=%hsyn-BeThw7ONvePjjX<1;PL+8-^O8 zg`4Beb5jrQ$et6AB_poG?t-j?zQ4*{WsSEwU>ObzNnLd$)9XCV-{$&<%!mj2{{@|I z=gP#G8W3(Z0=X~VK-^5;F8m*cgPiJfeJJ!4{wN98Cuj`Jd+QJicmkyEbb+MHB{n7s zsT%Tcj=?F{iQP2e($iDH@z<2WxJ#9R;krSkfQ=TPDfC)bVS800g5VXIBSQ@?03OhG zcX4LwBWi(f;8?sHcUKVSobnU0at~8kG14>2XG`kZb7FyR*9fmU=ImOO{IO_S8h8ic z4vkBF348@emoHpXGT%i@54;3L+@F41GMw^74n+mYW$L#7=0EpNRs2PIf0>&ScYVGr z$9wYL*rB>TImGZjqev?gcd3CLNi-g<(K~BZ{qtH{?O69Lqjg!pTd{6U-_h6u0~zi* zr}Czd#9&nz%}oJazu)xTd_$T!@ZJM%0WKbWu>OJmh%&CR*_lWiF7D0X=WT&a=dP76 z@p)Xvb|tiXb5f(Es>?sgH-h*n0RO8sg#ZFw1V8gskg#c>ZoE#_B6KMF&#$cuO@w{o zD7rS#PT!}2XarXxGL@cR`&>8I`xQHdiRkIBcmOVDeJgrYAVl52ECo=7EZd%PkM-PF z!Zb9F$i#P#M2-Og;E|R)#W6CJNw4jZT;(YmaPg~zf#Q$)Vy3$4)#fqNr5o^fnsqw+ z-=s&oC0364*P=mAgoSKzFRAErS(%aI)im0AeOJF7ORQJfIpJ*RRxf$VyClmm)Ow=|4j*v`0? z4Y_uIo_?$`OJ@1Iob^a;r9|zczx7Vz8E^7--Br|g6Ulz_jnOM&@~P_l3HeOx%-^Xt zDqRlUQ|m^MH>^HKioux0=6pgq&BU#Eaov##9~>H}*cI3ZUh?c@Ij@aKc$B-}@|D#6^ZHx}8gwFJSo{=x zH#I*!hQA+@FG}H`qg(kh=QS&|mkss|#bLtmTP7TU<9n#dn0XA{pKU1_yZGoi z?+2{@CoH40q7g?o8JFrXGG~EGL+@-)M=?C5=X#dkNaWWXArwGqulpDFf8(muGs`=N z>rBj@j+WIWGkLQy28rzXs>*@6NtU}PS#fQ6J%=Sjw)xm;qJY*kF6AwbcXuq*38oY^ z1d+;O(%lX9w<&`L20qS!E?;<5Y!i*OB3j0?6T4{w9Lu_<)l`$h}o-Q|=2B1(QFQ-Y4@&xhUg2jVd#A zJZ0k>Q;-)z-v&%fn!9TWb>;pKQ*Rj-Wf!&!)2*b0q;v@a(k0y>(h@@oN{Mt1DIndQ zibzOz4M>L|IrPxoH83#DcR%lb_jl}H{2h*UuPe@V#-oq|t%l>KKv$NB>=|@1cV|+j zZWebJIxZ9qOvYptP;bNC{RNO_4vekq9*Tng8-H!bxnpRzne=9ChqQgy^!*mj@Z zYeEe2M(*QA47H+>`My=e>KyLj?}*b44Qv zC&eZlGm(l#v#z??+0$6-m8=+j`pe7A!UDTq=!32Zt+CZ_v2MbhrSK+YVZ_4PX>4;E zZ(U5fhB!7edZ~V3&wqCso+yo{b{|uzlONsfB1C9qb~r8QA}muOk;k+Z#K2Gg*yoT3 zW(8FK2fQDzEWSCCge2^Bp5BnV&bz+${L6AyO=sA??9I@6S5@Y1`TvrV+ zCahlpg7<>XqMof-1YMUoItEz3=JsGDd z`YM_-2>_r!%xT|A3i*C@t$IGQ^y^`?H17knx0*bJB{1eP4zdL?1NFgdLiJ&gP*_k0(JQpUExPBRjP|xfG^UMNf0Vv$O?CGF+=qJw$A1=V}yGR>1{T9MA zB#6TXINm-#7N+<)sEpyi=&If%eBJ*Pt?U24{(nfo*PzfJd?puJ{G%zPN4r*(s+U1X z`icR@1NFZ9NI_WnzKBTPH`KSD57J+%cfIc2-Rgb^@M#>3@oG@NU9$UIFY>Ng`{vEw zjRZ2|KUu6=Cqe&M%>=eKkP`R2B&VupFPL|Fxx3y^>FYg-dnmZHrAqd>d|xA@1_4MHYvwgpfEkL& z&@D-n;ra!T+dwr~xpTf8@R|TA2xt;?;DRqbI&E`%FZRKdx4;3|kulbo# z$w>Lgh0Ts#Fo9g9Jc0H;tcKiAV+IlF&AahHw4@r zZy@<-)SD~H=8jCz7ULG_!)sp7yjHp}U*E-*jn=B-HRZd!OmTo2t!rV-9ZKy=8Zo~* zfBuv0l0BkINk<(c9pRfCoUl03f+ax;;JIod)in>Mp|uqXMR#(=gy=pugWY@>l@Opf zGoB;X=bK`T9vQq~%2u6CrIx4UJhKrh06zmJAo5VOM7M|gfU77nqrD4kb$d3nNt1^P z=SFWE@!VL#8c8|3X}y79GNRi*f^7p@~0Ov#|dMM&$_su zzL&X!TLe*;qRK~qy|o=gpLZzjkKLar3FK>QY5h^k)AUk*?OOsns_JY{D)gK8!>6kR zhYIn&waFirhCxp)+cj`x@Xwtkr!*Cd{OD+_U7-3dD0NW5 zYG5K_>vwH~1(<&N*0!I^!NngHfVY~zfcuh6E?}rw{rBl672R!fAD-i(v!=7Y^3#r6 z_|)huID2EyxnXVx@3rR{U3=zTngr5_-sn`K-bFc*`L(%v)wqV~9tN(>ynPHFXGjst1CW~2b zfA8bxFxIvDGyk}&YVJ*4o#zWPDYDcvSNzTeWBaEiyJvDaoGo?_d!zWQ=p2igGde*u zDMyRV=}KRopZ#jn=8^+wefK)2)Uhej2-9B90KD!ORD?ZVaR)!U(%KY=`VM1q9+v(< zmYj$>0V7w7ds3SjLSmS)QC7}oKTTUF&<{@9@Q|sjp0be-v~2|t61D-K`kD6*jW)|| z*DTngq8P0ojP9Zozx+rcIerpE@}R+m?AHu8Ccopn+U!mV`JRe&DaCNzIHglGIaKV< zY|DheSd2SyT5quQ_Yd#)CNi$ED(B^>RK+WfaYTPise!h z${|CmbfX{*wzen>njzP~=PX$G8)Vhs_KeOSajI9)Jf+ZQaI7JJ!4Ki%x&w;ml(-HB zxlv>b{-t}XgDjG&HJ`pUh(4)4Y%Cg0X@5VWq$7$XH)W6Q9cR_oc^#v5XdR)`JU&81fs^bNK1=v1`5mW+}- zao7pQz|q?{-QGi;pZ48WS#8Wqak^Yo6HRV#^~AYW$8PVbjwc7Vs2+5HHvM-OVV2 zRY9_+dz+pF)ki(+y?ojISN=KEL)2iX#(Kbo%1hAR-*TvbwIHx`_Gfl}jNMLI-g0Ol zgxV#7XPan6vXwt?!5k(ENef4$yp--2$NUL)U>u1_wXw|D87@+IJ?4UEDpBKd#g}g; zkJB!3FFe*3(+b$Jyor2LH#Kpz)$Va3kG!=^E#*JY4nFA)@9J9d0`Vs?-%#B}KEaujnsJ#;?JouoXK~MvUXvo9UaGu^t$`~TvWs;P;Vs`0T#`HfdZff0RC^Hj$0LIsqHV=0NjJQBA z;*eo&@)KEj4|^8YIqC%FaSUbCcov7dZc_&n-q{Gr14Zd4VkH#mcmc05Uu}n?5X{=f zwzzu$K|`*Cc$V;G4afR5EmY6u?BVnJ?&yXB2nN)A?TuHg8~v^C{Nbo3RrayRbR zUJKrd%A?{*!l=aTVnh%7l`FJ&p=|jixd|xhj-uo+PTRF03=GxRfq59q-&oWom7*dU zF{|R3Qzc70qr2+?Xz(y}p>rcvvO457wH~7YqMLpx$R*3?xQ*fto)o1XHyNp?KI{6I zArspCVWx2pzN*HgjXKWy+zHclS@}REeWtj~4+EZdmj3*k28*BPJ|?HdE$%J0jCHvh z>>*qUC^+&txn<81^S-_B9Am;R0I*-TSFaKbZg^bf&t3_>;?kceN)5zN3y5{#XLDSF zyX!Itzyo~l%I+?hu{MV`!4cATgm{8gE=U^u9%05G)rBOo^`iUG%HUX1dqSOuzZqaO zr-()t4y2$<49T3~CNcqcEMf7ZbIlcyS*hHP4A5go?cM*I8N5VNU0%lmZJ?e?cTxEz zy=SM7`2<(sM}0(E|8Ucu_$mjTH`23edV6Q-7=ba~Z@i$87INkJ)_IT^Qa5~1kUi?67w3<06H`OjV|0L^l_pGV$w;!?Vn-OuRJ|VJomXUAn zK`xbZJDX}ftEE`}PC-@+l?0Q%d>%5KZJnuA&J(WicQrEE%FY4r2Z*iE=uyyB5Vhc| zQHEd=vrB{C8b-64=V+a|Hc;IDgtRx#v`1bPiEh?T>uL~2f2Qxh<^dZ%w#WDYT#5w& z2;55hzHxEyfEzY^|K)NBGSj)+l8$Vl@$K~LwPMZ~=&!$SvG5MS)4k&IT%extP;+D5 zwqN=yI3;`GJJjS)bN^sqUe8}7x6_YSiXy=HsZ?8GU+Kn#Lr$p z1HSDhko4}bqdRWB)8-O#&q}U~IVj^cdyv1>7~sLl2>MJib)}e*(8Z1VEW_g(WZmUr2V|0zJX<)YZ2+7#dpQjV=l}*+ZNi%&g?9d zwXrZAD92@Z#NNAa@rx1o=z9|uh~UpVijMJdtD0FAVA6P=5PTR(O?{&CxE&DiJRyJL zPUsC!sE^PGv%Yeb)enMXkr|hG{Bsn{Bn-Z^ZK<|v16&k zw8B6n9rYN4JuTT}&h0^4%ioNE74a>Q-)e0V*l0BJi_?Tz-n;X-=rRR@AnXnLm|dreL5#}4A z@P8ZsL(4_ncx24KQP!=!oBufW=1Jr^A~fuGvq0mdQWPX2v5(3g6~TG)t>y;VnsV4R(M@GjU9uT|@g<|r4aPT%Fa zQVV^DIudgS;%$m}O&^(9Pej%8nl0M)LUpjK#Ciq}zXQ60(7^`!1U#qfOTtogBb)PE zpQNha!W+>aInZFX)uTY!SLpb0&yG?j33-rwF0i-{KaiG?LiEcZq1J%#Qvj z0Z!#>KEKHEZUsVW<@94l=X2YgXCp&d$@faSjc$m{Mgz)xDJZDbIteVg^M_-XxjrD9eeTNW(&Wpf%2 z^wWz8L$T?2A^mZS@>FKI;ZT(zALEP=_r`=F^=kC3{6KW=EO=t7yN<7F5yQ%1)vC2? z&9dUW3W|FgSukJgbNGC<|GuuHQ}8=1t8U|kO8+leWQNY8Gk%gAI#Qu(H?<2(S>2@d5abH=U3UX8J)?;46xJ=7hd|Y%}1rv9Xg=&GmH*)-mCN*L)7RZXt! z5v!)~^4&LBe5&1L2S!dK2G!+2-`A^Z)6T(*h;PELo1aBT_y}@&_rB&|GcRb6d zwI>hJ!$=IlE=4=sq{ei__|)MlP2=;y#57Y0CtvRII?#IH(}HnD*xkG{n0V}EPGz1- zr(pZs@UE#>xQvCb{4?2C$6`$T!m^*>7Xt&Px$W>QFnl1RnUnQ9TuxpVE& z6{~1Z@gx|!c+HWA5-P-109l29Z+M%>J!jZQq< zX|y0&qCbDcY`i{hkturllCa zn>4v(e7+CnhF2e~&86fpVSHUXDIeRE4YSwi`<3B)#)*oGswU*;YCWz#9cD<3PryGuE)i}ihmlbyhDoX|v(51d>xUCm>_MQuphMPcB*o|$ zgyw|M5IE@U`*kjm{cw1%A3K{YV1#ygChHGvddWk8xn6mP(pi-zUh%3}{!$iRIM+M2 z@RAjsSzdEEZ$PHxFdnt+bv`J*46l=*hC55i!vEy{(87p*`qZ4r1{0O~mxjlUrqv_d zZ^dnjXJ@fgYhoW_pu~nfp6OQ4U@Z>xO1DgGj|DZ@@)+No0`233bj8OhNk(v-xe@buY*r8v^v29RN3 zKSSmES4)3Tfzw=|VLIFTxfh$ecsC5H zTqO`Isc$d6jSE+srD!v;HtH=Z0F->&z`az0T|BBRjEdjDEt1i<)+^a}PL99FjJy5o zf?Ae`%6jBEY;gOkjSoMQ*Ig51XYXfvplbI+UFAi4D8plGbw;))+`V0p+Fh`wI)iNl zqOC$b*Azr#TET(%2-tyENxYPj&ADVjg9V?pqq~u%xjk zUBvr>1-JoQOHb@;578^~S2;w0NeFVZfk;SVu|;ga>y6)12qdWs54rNkS1Y7VMQRw* zq|;^moeIt+i|hUTKDA2v(S3^s@r?{M4ml#c<~+;VCVctQQju+X0#l{H8iR9cerq9?62&A z;1=}OwfX%;`MuUV`*b*4*>eFt$#f-X!nd%-A&7NnxE=XY^(0)mRPZF9HskolZCx)p zK=NPa&6_CH=L+?sb2APl;}oldp+N`ApOvOjaBD>(9n94r5vE49gTe?%Os5yPtgm)t z0I+Os2vl@40VID;OFXj+)Q6aWeV#6JXK4qb6tIxgEH4Fhb?oW}uDLz0X*e+&P>H(p z#~)oQMcbu$gh;xrF>F*bTEC37iTzk9v;KnM4ob^l!;T-IYn8UwTF1{~Ir+GI1&WKk zEd?^N67Wk=C)_XQ%t=8<=UcGLJGI{TKh~Z|6BbO$6weuX1vaGQPM=QO5@9VhgLnVk z0w_>ol6INbnNuw~GYQ))4^;f=O@ZgJqY_Ri$q`V$!FB!5f8XkS0nJ~lRJy@FZ=V+| zi7fc2AgIZ4bY-L>QGU|al}?*{VkNn@FUzzO0IM2q{aR|JZNFKg-S^cD@J0KF)KZjJ z4)IOv@&l&Ssr~oIiDUVE`~bHtGO{Qd<&mXLmB-GDMM88~i$3G;+CK}^Vw3fPs6ril zi**mnx()@BPfuy6*)DmZ;f1Y?{!Pj5>j?7=U&ctfNOilJmbvXcz$t*5@m_p}GHAk) zajM$*rjTsP;{PcF6~n$!5G|9uPBTWk2WxdH)%OLh-rI*4z!#V#%Tf3AIB7A7%hN~a zZIpSW#1o`uh+w;evr5xlWiwaUdf02pM{2vJFDmfibHSD71}|Z-D=$db#*bI_@gIX) zmjpWvU|$7C(P^X1#hEB4Z=yu-gTc09UqvVUu*$QMVJauC1U{z&b|qvgSuS4g zJC1>m&%_MZAZ|&HmQtNq)NwIPbJ?#3S_Tft8JLs6Zb+Z+{ERJ3>SP}@KF~3qu;k}$ zw~W=+9x^^P`Rjq|gD32)X5JmO65chxlw3u2;LNdNyY87FeEMiz?$;j{@ptbNJ*UWU zHS!1^_yc2qu$`+pXGyaQJt)Au7~~|?LGJ(F`!@g*{)_4fJ)YH}%FBkE5OZ)JEl>+& zA1@cFPQyOGY`M`zA%(Gw;2)pkDN5{k5=eQ_of6Am@Jgwv2e~R}n#}b078Tdt_`WgUWCg*;O%i4}2p`cymZLFVR9`zgvB~~XZ<=jV?Xxudvcv!> zE!gJj$&jXRaZs(IJRGsmZ-5`_PFY} zh+i7-Q9$$$f3F6$4)x2vxxg4^-rW|vQ+zGXRr2`sXLzM0d0EgN$aime0?`BaB-auD9XrYS>wcjdp_&5=m)R6B+wezkbmn#DKga`t0pML_SRxhL z?)fb3&;XR@*y*?ISa9Axv=4dfLB^+2-VT+Z8r9e&S5s7e9kZUyzaWE`sL^KevYP|- z<$mCgfph_Jl8w#Fr4RG^^-8WPyZRHCQg(`XT|_iuB_54{c;gH4g^qfqY7fJmA;TsU zJ0_U>dqDMn=X`c#)`I8HM2p3Ne9B#XJUhCXgd_gzZv?jq)BMoE@;YV&sXIntorslF z5fmVKUb%0mQ7nA-3H|_?@4DgmcGpm@Z}()IN42K)o&&$tDs2A}(J{GhScV*D2BvH1 zDhHokq`P=Z2Vrzhu16K%0n!$Kx(|`2KSizA8NWi7*4qyR{V}ljJZT+hZvkZc;^xU% z0lZ(HkiDuXP>n#nQzZLbJh!l8YE?z9VN}BRn*pWp1($9Am+BXO^+UD)Z2^&nk1AN{ z@oKgY55 zncS|})b3QJe%cfq99VdigC?9ZYAxB%YN-``X4u|-rgO6FKaY?}8fiXEb4(0{@0l>3 z;#=X~2DLnYk(i*#?uO~g4={?%kArobURDNdqIZ>+*fPB!(b2aDW(-=y!q-f zC9H#*jp=Pd>NlsvlqB;|h;U0VqpXvSueYtfa6Ti7%2Vc^cUYhZ>HAq9qK)^J)LSR+ z&5+Vy_|Qc*ed3^nxO0jbetF7@ppqIzFl1bQ3nVA4 z2KK*=>3A6@9!5jHhI%YN*ttsU01Z~qchDoJ!Af5uu_?ALTusocIn;fa zN6;ZBgX3d*6}egyWk|7cg>CfMHyzeMwE>N={(_&LFbv+2SxWC$D;EK18H?k(4 zi`}A7r|DDCl(wya>HS|Wz(do&BwVPplNiVw56gi}F0z~=&0o!u65o8#k&!V_8}*x8 za33|^e?b<<`>vDyfc67MQw^#@W}XZ`xBBZAs5l`02_BUa4D^X6)J{jEKQFpxo-SD= z>2wXw&$K|A8>OJ$QJa{dQ(`eo`1!ul)^A8=Z~i_+mF76F`%_@aH_21((-eT)+07*# zZu$BF5Aun=va#&xp7*Zm{kVJfdrA^c->rw7kUun|I-({yuhQQxC78Fuy-RBPz6R0L zM1v^^YohNSJb7Xe%B(Re|5E$36cJg@>j>+Z6Q=YDfDy1)I^w@$d_#O=Ci2p8PfwqQ zl{`D5IQQ|8y^91}vZaE`zC?J38G=^iQ#iEvAjJY4L|ajB&t9PWw&pmpEfFm%#i#!c+r;7pgQ+7zxC6Ru{i@&VJW1N zC5@vEC!VI*3Rrp&Le9&JVbj4Otd@rtsRVXO68M?lbL=>3&j92ORg(HxG8X0f^&-;w zDdm8@Xu??q4=aWa@M!#@^8+vomN`F2R43qf+%5KBP{(G-JkY3Y8bL&4%2EbexoOSlf4fZZrF2^i$j08X=nYNBm{LPmJ&1);QQ za=P(;>t}zW`C`d8qXu^)Rduq!%;5K<4U%(xQSW=k_E7E_cVqi};j`~N{Kmk9DWn$h zn|=4iqX@7W8p|Kcx@_mW>T>Zm7J+nvKm|~8GVwa;2S#^do#tJ$7V}8dmEwt#`vlI8 z&lwnO;2Cpo?uOu3DUfn`1>7-)i15pYtufq0e|%$_=M!btba16R4El#kie&m-dE3qJ z^du1r!!-r|eKElEj%q7XS{fU$`gS6rNL6}J?G_Kj3*|`+mYtY*Ks2-C-|AV#T>2#0 zczOZ>Yk!?Vv$DhgX2NDankCM&yG}S7MapE%X_k_Nlz0`}0eh{$he4+Av+YIO_}$lB zYkupng)<_lW>Rl6o2vxMa{yoIp9gJqJ?1{P|{dG-ph$87P;o)vQ9qh-9RYuJRGz}c>X#a$921466 z--<_-b&xV=PC3+8afFWZRM4R3Q&!W&6Sosz!S_{44~<$~sT^wNgaSL!x}d{>Kc#VS z31su-4K=}it$)t3C!+f3IYb@;YxCOjDxz^OE}saGjv9275)2)%(7E7$tvk~rV0=#9 zAQ&>GdR}AFv^P-cUTiNjj6)jAuYe;%vFfc|MO8Gy`UhcgolW>ZVlZegXhH*KAlPy`44Fq8Rm6W4&0(Ig^~z5(ejY!1W*c` z6uG6?mQH=L7A^iXD>7~5Hfv9D$%fyoHh7^6FkwRjZb8*iio8VTzD1JrXfDTTzlVMO z+kU^U*40((He0w*zYeOe5iU(r?dB?ZXqLhk>kM~!G3i~N18DXX*NiT81X-^OfeAs% zS%d5NS9e2egYX;=0Oek=VFGV>ReGB5)BmUNzXJcJ^*7sv6JrPrLt45@Aa7d-e5%lw zGUQu)ZLkZXKG9bLHyy~hde=!+3fzK3T_u;{&@lhOk`tF+L~yB zzFLt%73otDWx#wBL-cn!eX*4P(UrPu}Q0tJlDna?7?3Y|Cmcr|}d6VdMT zySNEiNmjhiyaZ)ySa>&>F}XNOJocx97QS#t9DmXGfWv*`n390^=K^Eb!}r2ouV2Tb zt{ktkoT|%NT=fnpAmB}!YFlK$zaiyR=f)Lvz+8GC5^oo1?Rr(-d8bMSP8ra1w$4&6 zMSa^|sOnWhZrz54Ibz;i!3uc$%yjBwb+A?!&GP!cfX>(I%B75&v_IU1&T7i))|h~5 zu?AVtIkfYf=~-iY>#hwBMi0C;Mlspm<*+r$A9@gF9DIzTom=|Q_nq}qCyRx+r&_oF z6Wu7_YuUG5d(O#HONV~@;t|o~cD(TB$Sn^h%h|_@vUp|#i9UwARsv3xQh>-@j(~wi z+w5@sbbRxApY!;wq94tCdc-jhCFc~_fUr;@>bi-Vdrx(WKc_5&PC(YPl@gM3Bi3`R zzXtYX+q2ZiXMMMn+}l?4=Jx>pqHwz|{AwVs{^X)456a&uf;XwBHq`MKD)$Nup%<>u35B z5tu%eHwR{$`_$tpN+Efm56e=c$LXJZ>k{QqSw(5VD@|{Nm(VcYBgB|-@@vIS{@AJ8 z0t6DyY?6+v{q8&c1J5e+5!w;kZuP3>`0^^VNhL!I4lL6K?0tW3llBo+!85hjOfMR6 z=;e&Rwz9&6{yEyV1pLzUe`kb4& z_0yfI;Wy~RgR8~{7r(UcS6yb4VoOyi-8F9^z$0@n48P~LfM~;_{Y%I+YOoG$4qj`> z`EuGZ$&M1)HeAvKJu@sYACqw zf=aDg8W^u1l_uJq7F5Nbw9N2?t-`nkW#zwA8}gL*Q&^f2RIS1P^H+6Nqent#L%_A}W^SEYZhfti-bjs(4-UwPYw8dV}m?9H>^nrY7M zBk6#sSo5WvF}ph-)5K*6NsMrq_Rp8+qEslfAq;fbc;xL;YCS&25k&K0T2K3X%^c-0 z0jQz*-8}!&VH}_j>e?KPPerQ6#$4M8Z^SCgcv2LDOoon%lEC7d;(XjJB~M2QaKr5} zMJdgb!FFBZZyM|P#=n|^_N-(6-8wTsQ{M2O%7}09W{S*xeefS(XVk(9Qth?_>t5F{ zDOOs}8EN+1UH?x40F2QfOYbZ$o7Dfck`*At; zTk|mNbf*81A;vM#`~V~LE-+l)>4N`hEodw?3QR1eC`LaAz*kQZUa_b9S*4TX2MQN4 zZCo{tqmOn_p8m&V@-PMu`@0lKVEzRTl1SHGRU&JD@x>Q7hqbf z7543@;(p5P*33qg?(Rl^?I}xe#WCC9r0fY zcxOQt`f@S&LN+ZIS^rEEMR8y6~_I58yJ5gH6R6uz+^D;V5+GH8# z+ZHKO``_cn(QeoXcdOQ!406nO;M*WRTNsJXMK-MeRNE{}w(h#IG}_$U;;WcQCb{Sg z5Cq1t+On@e7Q#sO8DX}bz}~LaNAMxApW*?C>ryl!F-C;7j5mGI-%?ONQk+3ry}^>v zBDfMSrV#4X-YnMFA)DhljJ&Ly2<-$%9=0Z0Oj0 z>r~mcEj7A!%Mnk6wy`jXgM&dd!m>?Uo;_tX*Uh|p`G>Y8J%MrFt>hnxKFeRynll~~ z9A9sAaAlT3->@3fHCcfXA0KNXfO|VY;>@HeBEVJJz?^wIQ2vZWf#TPM{`#0;!0?Dyz z6;BN*U(^@yYFLv5&c2!%C0J#+7O_*Xp%l_aDJ5OERIuO-PW)db`mZL;8+97F_Mvg|iBLD( z0Tk-F;||iVe;%_qq+dp|=kg`|c6=+BE5&|9d?Tz&Ch)Syz}*>3s8wlug-)JCin~~Q zoSt=S^*(EE)usu-Mke5c!!`e{A(9ERG$1+pHvf+{lj7i9YkA)==f3s*v%Gj{GBeE?`klZl#eu>4>Pr<) zmRZUC;AawT?H#;B$nv*6++WDbx%{9&GX^!j#}_GFOM}O%nQP+BiJ}z6M|##{ipikq z16p0k>!6`H|Jg6#vEkVbxPA2ztfo%lB$!*HGWeJ=B-ZSH7gT`_K0JcP;+9a2qZQa2(JJvSaus2LB%U!hIbh#k%%>fe~M zq{W%R-h8*+!f$w!i@5-6M!Hz&DF+)_UU8Sf-lybXTIDy_zYeZ1dHp@@NkT~LvL&?t z!dbB*S^iJ8H;wu&T$Myw=~pTD*lAcGd!}@B$A;+i#)9x4pRSnKeE2=yK`DbN&496V zPrB}!oIx(pS{vLTbaO;Y{Jjh8`BQ^ zwO6;Gk?&Mw@@hO6{&Pb9XUlks0*=!?^fIkI7NR40s_>vS{9Wh!s!qM3%;{qy8@&Zl zjWXF_a^{|D`zrhpcp75>c25&^Vv=#w5nIhiJKP@ zAv)?mBotz;{;TqW6-E>FbhFp27~kzYuX7n*q=&D)!di>GJq+`Wsc9S#-mo@^2fU#2ros0T9`MN776#{de`3?vf;=5dgusCY_LBy$+x$mKRWYGy(~1}!V>+uHwb3X< zAkBsU>ygd|IcH*<-QLM(@Q-A;osR(qk4n|_jK#}bge-XYUx2&_A%wCgcg-2an$W`{ zjDdVY;4`7T`2OTR+k3c_13@Ly_8;cb<2Bt8-{$G`xIZaa?;@)C43X+cy!coowZSAm z*k&~|Gzasv2+e(z__{VGiOk>!5yHfDH=n$sW0Y3MJz)>QC;!0qt!UUGjNqMlr(W4e z0ZIaT)s$K|0pp7Xf7tYAMsW|kH~(ppBvP&ZO7G`sJ~%;8E#iHBOmwf( zDc@v>sWnp>ogrgdiusZlg2A%;p-}stjnXX%J#Biy2#{VjfSP!%=+x{1`I%{|(RfIm zpw|}6V%;w<2-S48rHh_k`BXf0-(3(qC%bM3N7LfpRS4b;qJcQ=HbiXVGPi!KqpPbK zDfn_+a1J!R1HsJ5#o992rN*kgpsZ^FDEhJ}w#^EVC~1=nh8LbjfU%%$xrZsi9|d8y zAE&)Yc`~o5^v;s7a^IcWW!Wxw9Q=5QnO6OP<-DwB>rPJ3d{%MCfj=b?ZBlJo>ZU7! zGu5>_Q4M+jz0HUX1AH9<6F(viMSJMFp3^8c1)7KDVVvVtKR2;s5?COR(L)c;RATE3 z?$38LY(WLB!Ap=GAN@ff$5m0R*6$MNLHy*3f^%%Bx@%LVUA^aCEJ|iaG=Y46NcbW$ z!$^ql#;_fM{o=sNo;Hq1>bL9EiZ-^4<4`}ON*OC(0M{RP;UrYpK8UEs83YwN-N3v# zZh(hG354-n@jUBfmFeVtx^boUOhcO+K%^$Ct^xkIqfKO2=m=H#Q@8&X!tYB$Gi4;2 zlRSKSNK&1LxYvIZHbI8J)F$#E2;uf$_yo!XGKX^eYs1pAwE5E^6BiDG@bI$-%^)KaVDT7^9O56BlM*08D`c)d89X*@$1Ki^W02mrLj9 z0C9BXQq%C}^eoJ7WP&vGp?U;cxCri5ioyXKp(!@!(BZDgQdR{LPjX_O*57Wyr1$Rl zs%H)=ox8Z-Yg5T!sidkN7m{iHe2Jf_*E5Fmb8U0K6$zAuP4?d@Sl1&rXV;(pd;TYT z#(bt0Z4di1*yT1k3z|nXB|}v0t50U5yFs0CxaC{OUVV%+g@?w$+YB zu+5)3XPHveDxsJ2;8>h4NYJ6MvDZ8PJ4bF@VfFvif{5K{qQ}58^n;Ro{P&1Ar^Qe+ zJ47MO^^iPFn!LA*AS*hXOKpBmAMzh zK*m*)_Q6Z)zoRZX`R}MZIL<}c+Pjd$akuNWVsBUj|5?@(Gq7PLAHb9Ka4~>>@C+yR z3VWjU^@~9_a%aj0-F$nPX>RiA^49M zwK&6P%8T!NxkUzJD$cZVyD(`o`Q0<_noxrZcwa}Vl0$|GCN4W3a(~w2zZmM4lmq#u z;Pq(qeCgyh(ozhxT^A>23Q2MoD9*cyNye;?=t%gJUr1w^e%>MQ4K;K?cF1|NaUlrq zjN!fe?fA1cDVtZhz|ko9;bbHr`xwmSpRFQc(+kh> zD}u>>&wbRGu_N(6TybZ2ejAbzut823(^`>q%x%+T7w()pe4g~xUS9`u+_@)D{52}ZqXHaFxKft*fuEB9twf6AX_buE93mU<~Nzf#Yqn33*%w8)c3du-nOW65^QYdB%-Znk@sCOpTC+6b0r z>&E3-7Cn!uP|2#j|NPtkl{MLkJA$9==Ggf@(Xe?X=9lmg#5PbjukAxd;i3QE8072B z7(>WxbdPS{UKD4}nY5Gh^OO+#8~hkNCoI$rbhz8-#h%~({(gQ5*q~Cte+dnG(4>Bqpx}PwO3lk=|C!yj}bUX1%Hy9aJN}^VGa2+GF!{+ ze|&~4nA2M)^=sqwUlS*A_Y6W+Gw#HqaFCwm>;-?5WN@!xi){yueyPg%>)HS0q)Bgn zz^bJZ-~MnmHpwJDBjKyJgs)mKap*;?tTn*oA{Oo_-yvJ?A~kU#nre@p3pv~yPhU#= z>Ic85FfG-^|KjR#-%sh9Cjs7_NAlczKccf5#s7>Q!Cu{m$T&txTxC5?_ODdzHaL4u z_^+0_I(m}~UF;DTt@s7U!OE5T?{q#LjIYB^@FcUHD&C@GJJ^?q-GF#PYk*-K-`KKR zx`xD0#0x_>GjzNRO# zT+~Z)v2ARwBW%b^#B{1gn!$>B8qV9L*`8Q9iPyWw;CkTaO6^i3|M8F9tI|~P z_DmEaSnbSpP}n2(Go*tsrdm;MCo(DC#mKK|eBoxFDpSE;hlnlM6LB}ZD$}@nB2%&& zF1&%a$G>mF-t83e{xj6|{dpz<4E+{n$&UWkbCWYmb1g!E5^(0&MwFd{E%{#Gy7U8G zJL}rFxBJWA%ZvoVbWx2Juz6<}N3aU>*+TZK%R7AS{}}?&Vc16c89&zvVy4NwIZy*q z$mVJVZ$^{2^U0kSID!B!;1}z(G{)$7F97V@(h4^9KTpQ&zp4G>DWRC&&GIw!*dQHu z#*qH{-uxMyOO&dyv0MFz<(@JfNnRtNVP45x=wy1^y+c015x`6OX!!O6WBvw2d;QNQ z_8(2zZ?+1r`|_iYgB{_*9s7JimQVmOYwwx*I=Z9tf4Kk|t98f|abHskLW+M(2~N=X z6yqQUvs3GVfd9f%C)%pVg|oH)Kc>FIEy_MGZjdf%*j*5iZV;p; zM7lecZlpV<8|hxo^PcZ~*LD7deP-u(&&(ame5RM3`yKMN1@DlaQQ>JNH48^++_430 zuf3P<70nWwv7@3zAlhWgC2GpE$y04-wQ93@3-ZmyY4|Mq8cXjmjE49bHFUX|5Q|e> z{Dj||odE*4%rwJGdtqyhH7+SJ7i;rxwe+OTObQmsIJOsys|UYydPRD?sL4o7ZX`c8 z(IbY@IronAB!VMlHA+`^0Q{$_&5e|PFPv9x^7KAHT6Zm&rj!asg((j^J+h81pxc|o z8EGPKli!8K`42y*s>dAHs?|7?OdJXrw!_ghMZrcq2&BbfeLr{u=Lx))0CdB0vz;e? zA&=#T#=P~=c8@FozS{C%04O7i%Tmk;X%#?Fic#vWcK!(Hu2&b4{z`+$uI#s{mM`E8 zR{~IiVsh=q_-@1rcMJarc|8f@2Kz84)H5Ko-cD-6IlJsW zI0M;myJbo0cFweYGBSaPUUC`0POxsixesWRiENLrUb&x?@v;b3T1oM5<-JP=Y2>M* z z{D1{Q`?yTZEfp@UhK)uN-1OU@+I|*1ipT1n*~>aXU?h%5)WAmDTl|?IxM#;{bTl=#ULRHA6&Cr`$~9L(#&7EDFPIuApp8^{@zOcMT+Hed|LViW{1dkPPQSJ*ZGn;P-t^Tnn`r1 zy+$3Dv);j@$lNt9KFp+Ji1wyIixEU}5CR9vZ}+8vunVdS2l9JwoRw;eMh?>mp}J*+ zg}r0nVUy>s%53b5I}FEMOU4?h>!p;N1ik=QK|B^MQeRlbj{W;6M{Sm4UGZM+Pm`+N zbSB%3SEDNjz%^Kts-fo{ZljNCdh`C5*u(?pNi0M~&x*jBdeJ-fezdYTV-Z&vTbkNE=~sUTxpI;!g!wN!P#ptcP< z!LG^QwuE4#RtE`RF)g}&H+Cy0+hgp6O}l{CTy~1XG<~F^5j{03w1QKX?ML`u)oaZc zwkrBAZ$9DZP#3LMsq`1ux?m42r}4iX1um?@FFIkN#tSKP_q4nc&jQcc6n(`KuYxa= zP1q99sWWcaQO(UN5YGKpzVZd%_mS%=L!f6_G3Tw{-5`OW7sCswLPrzpIVERAmLS7s z#Xu(vIP3+!V58j|iQWOX;A~=wqzn95zsJ~w-)HhA*JvCK21Y)>u4V8!qHCI4am;`E zf@E2bC2xwcq`1PU3iACr($^&*L{Vn5;~8`PyejDbz7WVzWZjg75)WfP?#Bd(z!1MD zRi{NsuS5B`>0~;bfP95HJ^H6T*$PVDeUaGHM_By6mM;I&{ZT%U{UG2X<7*qMt(}8= zfps$=-eMQ>xT8g1y*5bGv$Ngf#Z&E7T@VhTMuah~f5870pS_+YguBR==!9lh?2DxX|udId15bmK4L)n z@AqclxQds~IGV_|0(j{YS~PqE67QGljRB6ZthoR+H~O2^n z9g6oNikwGvSeT>t83t--8g64ZxL;hinsa4_rH1^}o{ESY$(t1W%<|t~n;z;hVLdGL z?R#wBnNn_@GrTw$e6ehfz~=uQ$d729Fy-o~#VKvkVJBNPcL+sRg5r&SCUav~iw|qz zw7uHUC{kZ_!SdyQ>^Sb;rUJl$5&5Card1WN00b?CBRzBE1h{uzelQ=tj~p;Ix~n7V zTnB_7pvbN&2rJ0cN~nCsF39tw_ zXPw(_jhvDe=7L@rw=%H0G71K@7kTHcP$u zIHG!A*QYdqz)tKRP>QDRFCY(6s|es2^KZuSFG1D!^VW_YJ5)U#Q&L(MmY zr-?8zSe){Ulc-)lSRy?-aU5b)6y)X^er~$n<|L)q;&x+@tp6U9q z7Fo;mVb|v+s|Q3WH~FB?=@5G}qIXMGclimyjzmc7ilHd5ADvVe#P-y>M7FBq@4jm9 z)6o~fIuBw2T~H&%cd}RGC_tc4kgR#DXUp@@WTZ|7>FHNO;l`F!2`QH-PMO|lj$Pd# zgg2^G11}XwNZkbI@;a}$Su2pl5G?hn+H@`B@o{CkruCDAMHTbyn~#75Ki`GL{up*n zND68}IBY!`(PX>0fqFw|cc)q1pMrF9SOQf5cm;(^jMP#=uur%Wg9Y|K$G z(Y5=yP{w@YUB~YwnnLUDr3rQS9G>u60S15Z7Lezbn#^W_xRkl^W`Lf&g%J_etE&AJ|!o5+kab#jPGxmAP`0?tqfHiS|<|McC6=Kszjj zqED@p|Msyw{b;HLi*q5HmI1MDkwC|PE4pM$5pv>wo{ zGVeaNTatq?hL2i1DhDtBT6L2Cjw4C=ci$7uG@5%pd1 z!~`9p&)~YoMk0VjWU6|%krh2Aufh^AILck3Na}JVu217WL4Q>2&|$4&SK;hlyGFMl*{j3n(`? z_0Sk3=toSOOm%0G5G?WfF*#VPm6f(xlWvivTUR*2eXx{0_%Ae_3c^Xcj0og?NY{0^~bup8e8zU^7wQh{qSYfG&B18#ulNuKWJ?ClJ-6%j^($mg}EQ z7gvL3HP{r^taUOBJrL@-ls5NVl1Oq)M#7kq4%a`+qmw_YI*~?z5mC=SC<7AW&o~ZG z%#`srOg~*zO}-~B+~Tf7T&xZ3vp>SpA&oY#Fdk+C-&ll z^5NFOF1zN@p8JwZrR8LYJ|%}b&Ww$`+e_{;0`KeOF?91+v>SL{o)$?Uxg-mvd%@<8 z>%n7J@4fJgZKx!@v0@t5Ows5^~Ls6-Nl3R39rqoPcP!Nvp~09S|W)shsTYBp4}YCQDJ) zX@GGZ`XbrY;x=#mpqE9mZHID-6I3NDYK*)txtdxtzbF0mQD5vX*M;5(1Wo+Az||~d z8P+Mcau4v;>3h`$_P~?%OIzzP7zd*Ta34DljuG**1`2M*Dkr|vXQ~c|?@pz+H|z)a9YmyLcRizI%O$h6JVv|>g1z#S<)Y(?J;qNNk4u0EORkxG5FgA|8WCjK1yx)&cLEC@=$L=w& z+4MP2`9yBvCwh=L8+niExWr!GoUQtd1OMdpF>1FoWna(diil3>aBurdJ0LcsorA@N z-50fNCRnSMl)57>>Kre0=$w#@?#V+BOIpz&MIs(`HmdqD0B@r?f&P&AH=I4Q|4URL zF-1-Gd!ex*Hv;hVLj15M_HQUeGH!>VQY_S)*)v-$J62kN%qj{!Y#+_q4JUk!JzJ z;jLr_F|U@4WkJ13;YAg}bX@Q^B=$MB)VjoANHM~K!)|Xmq0ldVTHs>5L0WBcFXJsK zuDc{U)Kz%`np0~1Yq$q<_^hWJk>VZe7j zDr^*2mD*NF)8&7;Hp_ojf+3fQ?+btUx#0L``w*A8&Gh=(EK%QMt7^;e{{xIaL}}t8 z8(h$0!`^39c{pn<8JCDUu4QCGp8q||g%(jm!T?p6Z*!GB7x0Lg?%vVn|#RCMp?;ewhPkeBmo zbl2ZCn)HdC60=}46+hSoDnRKBtaVzKR2}hcDC4KcSzJ|NHU+FIuht{|5)8jEwmQG+ z2Nj+-*S>G{Ytay;u1}ugSSkN-D-ehM50J)e0%Q`5re-2s>wrJVZC{iFuon7`EKp~s zUR0rw=K}%zwaMXh$W-;BWV}#qiKZ2n+-p zW=6=w@n`b_qTmY>>Zu#Pym!FbA7Y8@3NIsU`N6(|PmSQVQJ#vIr5keE!<^A}h-*Dz z9eTVT-s~O#$OvUmgy@e(<1v9QEY9=nX?6BSHS-gfoi6;m1QG3PR4Obdd} ztN?4Qi5-+@)4V?{Q(SbdIn+iJ$qN~+@jCBaFz0!X3zWd^(N!arK@z2jIFXweo0_3O zhzoz`Eu7is7k-q=imO1&BHyekSJg)X<=q#dsw2V1Aw`90sZ4FV?Q^{Y^QOAzS6|P820Ik{;BwM>Gel*)$xrv@nlj-vo$3z_jrbGw9i{m7%8K(npAefG19<=(Lb8^z8h6 zX9jX;*H5O+?U*m2bVF_1jXqRf_f7-(9?bx+`!%5##6=x}#`C7{K>`c(OV%K4XwNaBh zASNX*0!dBl;EI32sPAM>yjoUO^y2x~v?J;LLJWEKv6;5;T*P?cOJ<;F$8(;dYMMKj zTwSc_?2ZX=HC#2j%ih>pT15ZV-wSjFbg}^Z7vnqXSkr^i!pI%79c8F+BNu25Sy7~=sFG`1BgQot`A@$dp*>@FM#PfVo-sJBZlDJf+A{|lUdNQH5z}j$b|K-g7%{cd^ zd-`?(wkYjg&v8IMXx?q8QM}I#JrFc%Thy@pB3VNWeyl?E06la6d>Z)onAZhx9d4?w zeZ4xK!-~Vd_vyCTdOo`T)NW)enLlJQVLhu_B`7`ExWyLzaVz4WPu~9y-;q(+;7jDB zx&c~qOl<>tnOHQ-(8g;@x*}HPkDZ%OoEd6ViSdN|j6{v7{dC)2AO7ROgp9Q(7k{`$ z4>kXhV;Ct)U_D30wh;|DSH8+ZdR902VrT<5qUsm6;C@(G_cOiF?RM{cxD#^3hZH<^ z!8+c_VJUq3NaKWU#v$+zde)g+S=HtvYF2)>a0Ac>;QguNbD1eF_ce5H!hcXp_U=o? z+Dr~Z^GPJ@@GQy=9)F9kat=0xh;Y6WniiHY*K7ILKy6{#Zi!)!J)Ct24}wyk&W%Lx zy~z|C>Uah!;RsTcv7o=mnmW$P^sRR@M)Ua z+Jx{g?;sps-0HpktM=yiXJX0Dwd70ad{}A{&-d?Q_W(6*^c7R`=-m9O;&N(D5 zT^1t;7g8`7=PM(ws}iM8Lb-pL_J#(rDJ;1r7kdhrCY8=3q){tVOW9Y2LpQ@QM0KY* zN1lFvtlGJuS1@kwcn~~-XT3Jgox#n#C;y~dDZV_<^ipfn@)QJ?3*Cnk+D-p=s|Y^~ z#b_};cuK~3BCHSptoIsnzqO%QW4sOu11PY1^8sd6fTJ#Ta%jE=5}4m$z~10nUa6&J z!j5-sjN^*!^!}inx$`1cjZb5jX~?WVrcgo-!&3fK9^s9g&&TT zN0`q+DF;G=R9{Zi5$5L^*%VwEB}@Y8s^6fc8&~lxW?aaRbszX;u||Vg-B@1P3a*Ip zkl}q(k%|d}&903F`Y8Q^0SAr~T_~};6$x*5SUBO?9HCPmyx3s-`GPM<-}SSo$oATP zot?73-N{@QtPH*}e*a$J5_uCB`yvg6f<>?hhNB}kMu-1S&;dlya`=??caMcT_Fz~= zKoUi+Sy;<5X9y!|;AN%ck_j>3`cD51mrxVaM%jujw9q#w*h#koHnd?+8Lm>D6{%zC z4(lvpsPu+Ytvx^>_Q^YtyHDbOnAG$^dyI1R1!-)qHN}MHD&@%PL9U{lJvd4xR8g{j ztiJ2q^Lpf>`+IXwFWl)LHUn|5T=eUFf3|kkpjKPFGfP(?W_QWehGqf%CQSR6e;I{rgq4s6%cw`W=0oJGp=N#tjG{ zW1~j~cRc-PB*sw(s1n0#?eaj(as7%6U|SV(aTP%E`galFz>G>#;4w*1ImEWWTu$Tr56TBI{ia`Shl zgnE~mTQ@pDI2Wt_4+XgU&7rUEPo-)aGC%A&@8@7VKM|H%i&@rV~rKK~V#|?}N z6D}4&?M-yB^R%qb9gV(LupJ?Nk^c92A^>9@`0EcbjQ-HKnK(Q*+Fevp7Swt73lDpk z)fV_!LhrB5lAPeas-=_`{)urSS~D|WP*H#F&z;ne&()8lqNX-^Np>w=@YpvbjuKd` zS5^bb^?jrro0qmQq}JM1KKXa{Ij-}8tw$Vy0rI~1A&wx2pE*SPBCo-lN*E6cWKFeSft=BGy1RqZiG<${8&PH?Y}K{ts6wAMaZnQ`&im( zwvY@7Kt2G;(}W@bIk+`3Fk`9jeD~Rip(l+PkE<-T1%B=)Ur?!ORsw&{K!W?>30rh- zV0Phl;UhzNpkD_;patUV8#ThriU?m^^?_rp{aGVSNs5R6=0|S+_UWa}J`Xg)7Em`U zms@?7H7fc>kL8r(loI{t7(yoXG!WN;)#Ye+2DTETZe7@ z%280+MGt3?`1=>{fb1xh(aZilz%i+V91eO*uNy}20D4p8o$jn2z*m7#|zKg zHfjvjf$ks_XvvGb7kX(*qBlpdMA*T-7DN}}zC=2nfvhAj4}7XjKH(wtG+r(7Q{B;$ z5eYJCnvcgLTmz4sBJ55y4m)e+o~#wO!{`F}qAk_W4Vjm;fbg~>Di{g=pipZIw_@2o ziYBMLZcOS9`NLB#y=Y`N6}O-vMl`XR)siZEOiaVir&K1cfkS|u{pCO!6{b)k_(N7i zqw|CgsF8KO2DW-;*)r|I&+>1tXRg>in_zGwnDohwoZIhW33zLg!f0SUPCsY|r{1jB zzQ2NRuL?x~Z3XpVm*d~bFLz2OL)uzry-;h!B-uaW_3n<4!2s$-6Kf{L!e7+g(T~?6 zmT~&P0o^!8l~}#>F4&+P8bY`wgB_Pwz94psUl!*M+!NDdC1qnUiRs|qvIa);9yxa~ z(jqvXBdWfP=Ag9mR?f;YBPc6$4cD3$EI<9dh6W&% z?y3b_P=2HQVDKTO2BRQ;hiw>&8n9e@$c-LHDF*Si5?xo#B>h&urPhD$Qv7-ug;^GW ztgxCR33(H&JAN##C#-b3wVmO3wE$QuuRq8}VJc0ojq+HFGMLw60!5*WAWoD9Qqhp! z(O#1_pwdb?nqMCKq9RMA)$aLI@fr-GiQ|s-1u$@o#m}eZlp4+x5XuMb4WyyEKjwsEHLJ0lNMb zm=q6b+MZUqoK}uVP zYffy|vtrkH_zki`7s)4^^`vI!(5O|WnzkT=zvKlLD2_^e*IL1Ry``}%yBumPI5Z99 zxNqoL{0LuHe@cjJlAAp46e4lQCwYks35_O?$l!f7TGSRrGRJuzT`d@Frfdx9Rw5rf zKnpkC9PkQ`HA23*-Pq1)><2ymi~6$N{GZw1?^exn-^cTsN{O0m9f-c*UI}#lZe3U% z{GP?P+VSLJfG{`ipic-XjvsBfE9!T+G8}8rpI_^c66-xOfUzCfRSiCCC)ga`#}7W= zOv7e4{uL0T*>{u4xN{o2i#>IhcJ(~MbHorXsmL z^IuY|Z9V?5l_S?wUwM`>@yssvk`@n$5U&242&rWlR=$9RI8zOb3mL!lp6SVn{PrJi zv?<%K@VRy=REKHAk+_a-ygr+&qKn^!$R??nRK{T#r!AFK3z9Z-Caa@x?(8M6hM{${ zEUmKE2JEDuHKl3NBFWPr7M#!yTX?hD=8(-vRe&w~C2kKYNL6>j6IhHlu+ZsOqRs?T z+LP|tj1cKgf*a8E0TZ}pKg4xC^kDD>{(1>?wsx|^pzdt7#&ynqO6zpoAm175{5i zpkkNM3uxq3#7sX2sr+=5KF-?SeFc^9!O9Nk0@@a{YyQeoNRrT(}G5z;AC~CwPofpa+OR%pY2^kt0^6+_Zpmk%z>!XeJFu8mri7ewlP+m>` z?_F?uQQy;t_ZAPy4yc^o&@T6SJQo$J>uTB%Uy8-bF?;JFYB=cxTn%BZ3apFFv zi~iVw2Isav!`%&imdcvdI_#Cy`-vc@ctSZ!0=cG@eCj9Fgv8*tEhygtfRp28B;#mO zCt0YuG*7iqBr%KpgBlX=p9@P8L+#I6|MJv!034dOY7COQSw7sGvMMOQi8rX z1JUVo$?sEOG@~^4qw`9fBKCZhbHGMU0=}l_>O2*pS6JIfI6!4MJ?HP{-R9D}ZPyL|RPsNlAH!kFk6zYIm zRtXS8QJ!I3aYBcZo0LxQj1v^r#qMxcL(+bP@bAr|pq#pJ%I4!Xo9xL`K$yGqn`pYG zrFDJ?greyXuz1nYi)zb;9WM`>*jz2k1v_iwRqwKGNK8Q5=Q7x}*=0j7^@rTxamgR&xi^;=`A(wO zCrz|(+Rnq&zv(A_<=B$k7Z2on%@5!m{nH5_=!c{~!e(PR1h93I5EzyPD#VrB9I0Fdf$%w?O3bpLTQ$2tM;=)sN>@!Xpio#jMxit7$4~IP3KEb zS_o6RjDs^e>*>@%mJTs|3>b2GuCqWBP%e#Sn?r=L&fOU3+EDyM683|nh$F;W*15ib z?gguG^qH&ZT3|9D4haFRdtJtyjqmcJ06(}mp^y2XgU;7y4CEhp`#3|M0n%oWF?;=U z#Rl1`(r;X($<(5Mcew||9Va!3tenl=Y;#-b$NBivEn=FNcqC-VCqk`}wt4;7VCceek-=gs^ z{k3R>Hdb~9!5iN|Q?u;iFyFjeQ@dlP*$vACDY|N*zdBLzco~(#xQlhpC+@2((~odU z-@?jso-uX(9T@(G!;J;GzbU68S8blXhYT zyO)3rIJW{Ud9ty86E{zbY465MH`q_)VJ473_Xu??CMIe_>j)hg@{;$`g@rjhb~MVm zv&RjC7})_G3~MOGhyl34eBB>HwnSn;{*A6cVuvik`B}3%w*0z;;a}EH96w6Y!K$4d zL8QQB$%h>?4}(T43yH!oIDQs|`@M$StFG!#3&e9*o4{I?Ff__@DO&~Y*J_Pg?t{^1 z`YN82^${_@OEADJ7!{pDjW|p1P6CU(4B;@;@{PVE1;z^5B|O+qa%LEVJjZ&?N`$R_ z%BZ=0iC7ksaGWHq#YV&&^ZXD+Yz6HITE~gF$2(OX4!gom0+V8|E41i!MH%%u?^0Oq z4((FTWs`fqGp1`B)yb|#4B+-I{W*YldN7vXUrF4>L|@)_7)v9LycUs-%fx;s{zo@h zQGzA3b>FfjTg_YQED< zE$V|mIi1eOk^F-t^OAE~IQ$?i8B@Xq(|;F(+#b_Ei56?(UTiMdEW==tuG?PwxA&lp z@Bx^C*Y;5#6UX)uK)ENYY(J}(Dx28C3sHBKrohjOnd=Tx`Pj4UMpr;aB2aK@3ZIlR zz4F3FEyr|-k{sNN7i?nV%6I&7ctj3=U5UD$?G{gE0-|O>?pUjNp}92ljdLAmgq3>k z97(*XHtN=L`gm{llNq~`dK0j|nQHo`n2;i6GDfnp08~P!T+?pD+9EKu@VvhbuM`a~ zsP@F&AG=&G`x0w624@{Wa%FO7=$`nU9jnFrUiy$%yL$ipi{HaDnctddZERD1KYobO zZ3{zAR!V_Fx2__`sbJbkNI-e>Qr;&b=f;TR2AiWHfQwc_bcDobInUCqKY9|8pOZY!{fwqxe1Z{5AH4{K4O<|B@8&#zWm zPFmDpVBJfZ9(B3QCag}MnmBPsNdkaksZmleE+iRqwA|Kg3BXS7jnZHY=6? zmfcJ3G*m-fV+UCk;?PUzOun7;sdy{_ekZ(RKo%(0vXoUioKolfa2#sPFTaq^PmBps zNk)Fa`20siNDs%|?H|4|4`rg86TDtnJvM60M@8XOiL3igqCh3fp9@5frA=2;;Wq--u@?(%c!P`i9n`-vJ>)gWF#Q?i^TKR`bNmtW-vGcy7(BC{0=$5UuntW zWZ!u6U(>3@w*Y6`z(TJI;uT!u{JG(6!OF$+6fX4U+kelhfb(2CG|QR*immqAKNfZy z&g*or5parpaNS^gT6T=Sxx&lL>nNHw5NKxjXs9Bh_mydZf%o`jM1sNGa7l0LkMNr% zB-u-DYi)&9rDyMdb8`|Tzb~>s5Y#ThA>yJtBhm4V1pU9Xu=yZL*Ua(d)Ibly+#cv^*PkNa+~zZ5=;KR4 z4McaXS-3`Vw7IqY$+c14C<&tHCufY-A)c#@1uHx80Er^Ca5wao#|G#@z}fjCPz`Y!Uz65wq!pB5UqO2p)gkR4EgbJsIE)Uv|<_w)DD0__11 z9=)k%eAOJG1by<}An?E3d{iv{HR0zKe@f0IrHSq}WqN=3r~+B5caaWa_;KaqEZ`jk zY!=O9ekkd^npzzmu~H`swauvx;JL@j4d}QemOd&mu1Op&L`4INA+K~u`j@*Zb}kRE z!3K}2@phyV%;SWw6BE<~wD+qhD?3?e)|*O4Ys zN>vo`QT$N~)wgwKWX2yU<-}blhFKz7u_(uzi+VQ+d0AKK2_nB3yDJ}i&JpHc} zxE|7&;{V{-mn59z#zT*5Ss1)2Y46R6c`LPEJ7B>+pa8j4&j-^)wO7XAMM1^a5zEyt z>s8}X_7e#Kgw^p(y967i_65xIiZ(z;#JwUU)b zd#QBnI$@#MZukZJ?d&i?2ZJ~4)M;nXmG4fZ?W~gb(@PW;b<+jaf$LA31!=f-$xgS( zY=Y0hj+~d)+ayAVIA|y76B5!BC~RZM|M8Q7g@Io0sHMvZ=feonZK%i)T-5mZB&q%ym>m4&9IIPbi zD2+R=$}59_ae4$L{#ltC9Ro7&*2g#ckM*^#t*xcp#9^X)e2JppKTga*xWUY)qo> z!&&qMtd1dIHL8r!=83|{c^?zD_{pO**zYQ3ba7@uBb=|!iow7bBgq&|QmA8Gx1N?h z6I>>IISiJTa#Qlvtj^`qGFL{CW89^+p0n=RG5rUBFvrkAg)AAVF)2<>A5`8>ESPp3 zofL8juab#W*bT2@%@WocXQZSk`@BZDH=B4`#JT`Pl0HeD%a7<&gK}gC<-qqM1UpC6 zMtO9PsNlj-rFTynT`WCV`T zmnPDiwJGE#5tpIi9Kg9)Bp#_;NyRwBOCEjYM zPnw~6+a;}wkSl=*`@(tPPucygsn7Zy+R@!PWIQVh>VCwoL1ywgDll1ALdegFJJ= z{9Jd&=@?gLaa7XXuST3%-_K_yUC7KLOhPl2eJO-C9)}@X&_Vl{US_6<(kPB8$hh*6 zUd{V(l=sD=3i1onG%w(6E?_J6{>fZqa+&IX3gLx~>O!v~KH*uXNBn21rVH#4+GtO^a!q-}kEDP<;vtqV0x1vNx-WW{oM_fD-^E_kp0INER+f);KA12n7oXz$s~N``vQ9&^mpQN)!k z$Y|0AHNumY(oPjnVJu-?mnr5FX1_MQerK5ha{MJCBLj{WyCt^nE5Ep@{uL_^bh;XwAO|Qo8k8UfHmz`^&)gM&jX~$) zFDr8eTnT)qGmmWp#DC~;JsfzZJQAD5;Po5LBZafPoA=%V&K1h=-X~T5m##_&e%%9u zTdt3E6MUb}pZs&z&V~91|6d=_q2}*Av_(eWM|nqmd5%c7I@CR$%_)AE@HHZHXNkWd z1eYJ+rJsf!F=QdEPEX8N&>$M&2S@Y6)5qV#Eiti>5AR#uf?Sa^(o9SGK{D%R{&^cP zzGs?C;l&B4WfGWHSa#TKP&P=m)=Vk#Ffj0I5tS9R>omHX`k0)Ip9?Iia{VF284F;i z+Y~z{cxETrw|Q&qa92g{)F7b`{pf3{YnP*G#pW8BQi4&I?A-93dioCW$&t&E%#V9M zKt1YPW<6XkGw$dr9gLi-RvZ*cPmXj(CPbFtkPpQCO>#v43^bmzcS@tm#m3uY6|84< zoF5UBg~drymwIMf8{vN42ky?x)Nk4ogZcPrSN6`U7J8DNUQ?3Nua((jPSUDtFHQ4Y z&SR?I&hgh~NlJEz-O<2W<5y(1xQd_OGkJ1qMCvJUuZHuGkAshVZnKhJt}cAm*0n7c za9^HUAKQLICj|RPLIq40&W>b-56Pi92YuODfQgm4|Co2k1Mit6_QB!>#lePFOOsBi zThA}9x3g}?DZ3Iteif3twNYvVZWr-YLXZv5j`Yo4$*Vf06&}8N9XnHpUu2B=@%y887wJk2Bwv1Pun>^EGq8r$fCXJ~)B(Kf{l9OFtLEN!)%LHmd6C zB%7~}fMX_*Dk=)C=gKg;2i#+Ulp7*l|8AvoGyji^#F7gZvis)Arh3g>g{PRp`4;9< zSWKr1Aa%63^cY^7ZCIr3bqKCJ0;8svQ8A|NLFfTdQt(=2m-&)@%b>MUdmw2(%86i} z-%e@8HvPb(7uDmbSugM^guFbnab6JTr)4+mRer5lR!e-k`t%^Cb1?khA_=2EqmzD# zQTv~3^-9elZx0FHa<8f=`+qGVIo^LbCkIWH)g&QQS<%8~TELIp-de}?AkYOHhzLNK zN5{T&mKge&T^Dcjtp1XH*h{eXNwD@SBMf3H`;N! zBMUXPR%OLgly{zZsE_71I;5w2o`y>o&=-0j2L(p@DF>Tl%#_~pnr&S~`p)9*=yE71 zOuYCdYUhJH_B59Qk`~tY`_YPMc4gXEr6-@}38KDe{R5#1i%wgWfDFPYiFB`}MUTQ=8S~hx-D@;g`^Xur z8-^&)V))$1E|yQ04a*nzhr4>y4|H8bzns_}C|2X(#>^zfsPcuHr!y|Xf&PH({Y;qo z-{!a`Uie$w@}_s4d*>J4H;Jdw!f$4u*#E^^A&u98zHKD#$M?g(MdEovElxAK&)6|5 z3kYSqYxO~==GZW=XdY@a+0gn*@0_Ali;1qCdfMsI_;Z#+U4x>e>bNdMsd$rMGsC3@ z3{Sckg6c%t)ib&tzG+ky_k!z8MHajVVyl;lA9_;cQb+>l(~gieqfk>9#Lui+<7VM_ z)TU2kIXq+~ohp{#EGCV!-)*-ie@Y!u=tsNw$*w6sS&_Cf=yDPv&QUvadA)(SgVxaQ zeRx*Io-Uz(i@QHz+SYm_O2rA}47?aJayIGUjar+LKQXfXsPahUVHgCY=w=Nu8F1T3 z9aOfJDfT870ZQ+)JTrVeg00Ping?1mtk5f) z#4PgU;DATN>RNhBinoq4HT$0DX0oygM|(rSFma{+Bs)wyNkEuS7Rd!>g#D~;t)z?c> zjk|}?5#ZSmSX-Sxt=4kR*SFEiAldJ| z%X;p4|0b|h0?}w@p&;%EXqIr{%Y4h^oh!zJPcya+I)r$?M$C|v;c0*4{JJH&jGB^?L**W!xTxvC~AiYM(n^)W*?S)PJiBkLZ+U$eBmAOp_I43b1G7`%7zgz&Aa&jz! z^ExUnz8R{;ve;-sR;4_G?noo+C~n?)^rxkTGp=tZ6~6L61{X)!E>^x&j=o#}{aQ?i zP^M6f06)#|_!L#9A`M96?@WPVdimnr%_S?{)1qU0`*wO04cyf{b{&w=j$>Q%CIn1D z&rEID?PTSBxPrdX4Edb6&?Y(V9?n_Tlz1Lrc1O4YR(Wq4MJk**!7FX$#wGk!{3Dj! z)(~{vF@Em+Rm|TR?MT*z1~){f%>*LlhQw3-12db(&W!6j#tB)q@Zt4*zv1x^KCzVy{@co{_lxU+m~Z1x zPJ!*|pu9ha`YYv8B}^#-8{X-Ru~#uk$bRv#77)HXbJsU=iqwkfsW-Le@vyE?0V9wslUj1mj z*(z#Mu4-*ooTP)7DDR&To-23|%%&uF z>)np7V?g-wo%dZ~T|bjRpA69ll)toZn%`Iq_|-ouJXL)8dA{*w7+T?fz9BC&z8(MT zC9CW;Wmq@_@J2^qeG0oGr-LD#`ygh22aU4p&cpkp=s+h()VB=@P;}GwdF%CV~8HEP?%BsRo+qEq~HIc z=_}l#ZlAB|ZbZ7fL8QC8QCd<$x|^lDkxo%T1nI7&Ls~kQ?#>04-FKhwd;R_ct`DOM{25heH*K6w~o*Iitc85WiCli5Ka3hZ|7yKn z4!;)*F)#-U6X_ON-DeEeTm z^TqRt&_b*^W;u2XS3wh!#Pt_IKWc9$X=Ro7|^1Y_-^& z7S#4o>!q0(E?xQjQx9Qd+C891ZJ&AL7$~t8&-vy1%WuESgxA=GrH@O)xAiAbRs$$W zo(#m?LszQ7I9&skfLUoWrZv>ed5S}q831d{#ANsa3diBf9y3VH-dNi9QoE{hL9lpG z#fua>`&I9JCqCbCovJ2*N4GbXs~9Z*E%gFx&L=I1TM? zB~^PBKa|6q+;S{JLs5~_05DcWL4%XkZdivM=F(iz8>el+&hBK?PT1&C`{nI^*LV$5o)~oH5 zOF%|9k5B5~OvM*!)NV=0liB>@4g)V<-1!KcMPMyI=t20ga2m|$anwP_TGzq)!E;*) zara+1Vyj@_u9ryy$~xB?9b&9PMc+C!^M1qW5nKL2ChvZkmV;SUF|;7&e(3qB-chj; z6o`uSLrk!xq5jVB^Y2lQFLh_k1qIs!JSs)QLVR6toe~f-G$IdK zh}a|k;rhS|ow~O#2#7jQ9eA9WJ?vb5fMbU*gy(l46{u3{(59dD-FS6rg%Y7$?S6>+ zbO3tf%2*)%)o~OcOX>7uh;NkTxUI0?YtkqtH(fZR&J8%!(wQ~#Yd-&kmeyx23{UOT_01BTv-FP%j9PKVD8rAq=&jc#f`=&?aUZL(vlvt?!b z^T|>df-4^{fB1#Zg=a;iUw1T2ioClrEiSc=#hJ)p*Kwf-)}qrI)|?=&*B!xgSVF6_ zZ^zzAuu%TB4;uG}RtGE*OL;^!s{kDWbc_RduVMy4vh?lTLW35>(pW7$!7*z;F;?z6c(7<>onyM*QL zqXTo&q}4+fbx_!F=|MRx4e>tVMJ^OC^5i=ymg0pvA#;6ptiN6wWZqP0H9AM5;G|b^ zjg$0daksu?DQTIE(y%qs1St&lZ{$I1sbBP{FAXd!p|zjF5t6l9jYV0%&xJj*ji`x- z{64wlh^+9K1OGtzI&%COqqnJ9KFTUD^26fC_m;!_o;Tmn^QGudHeb>J@*wr($BAz) zTC?Y-`|W+L#Iu(IBU7iJ5gKZQJEq&UgwadD?T%}jCBH+$QEG8kHf9K?){?@b~ z0B;uPF5YBF+PO{9_o3N&$JG$aqbZ>q7z9$Q^lEMp;b_6*HcIBgj>X*f9&+36h|3c= zQ_9fpp++OTWh0wskaK#dYee%{ln|yPq`}SNBK6c6@a2S+tbEfD8x^9@l2JpLvqSjX zu$`q(Cr50%!RrsFsp@-I7PaE*rFIrwoG`giHjl$X16r8ydk2fe-DNls%EjUPr|a`(fboTTi?O1i6qk zbgA=Jy*>dT+{P;s!kL`dbb37olpNiy^S-H70BDVUg^Y7dqZs(=s;bU>u-Z9cuTY4u ze;O2Q=Cq8T0yhLCyn0PNUZv>k?LF-LzAPDjq8Pv{Jr0lCr9uB^>W|a1D?j&nM>6vR{!Y8`Q8%j9+Ekv`!i-iu<@jG2lUZ&#WtLTz~@#ms2OmnKNl@&uN+hM73 zLc$Z>ZmGL(*~uk_gM|ia_j${AG5||?v^B9Gh?R}V&Nin*xr4Bl3-KhpyrkrXd3*Ws z+^z4o39QVx<9pNK2e>*cu|O1omkr$u&<_krQN#UGuhYW!N&f6QzO~Vwy>Iih(rYlAa*EDaXb7#s$4!)zTV@^K_Hptzduukz&x(KHI!J^Dgqh(Zf6rBtU~5x| z81ob9rQ1Na?RS~Z&8h&+2DcAO^uB2dFfwo!(#8~gFUwb?lo;cq{a>)5#q<~bn#p52 z8@tp@{Ez;ul%vC0MGO^{OqOww!p+My8X~^$XPoy`t!&ylEcJlKC{#s+idCK%u5<9x z>0DfIe%r!BFo;dCIuNPogp86@RJ0JS%L+#LRt*i+1kl~^p~Q4#R?sLLLBmu);nY>S zx~rTc{6D^9+(Fo_>>&Z9W*;P-3$B1tH`1>nj*%JdllTAk(>EdKoEoWry~l8b1p>V* z8Hr?{abCUP$!mr;lbwA`>Fz9K;s?K?EFWbOKejSN3}Y*3XlS6&!LRo~ZL>8~HzcBP zeU8nRgt*>81aAsbn}JiB?;8}&M6<>D>QcC+aY77@x(_2JQbZvo_PcIyccp5CbOVRH z`A5_htNTYQE6Nq4{EKpth++#ut6jf8ph{iBFdrBMZU23R6m}4kiNxHG3vhu>Qn1cV7@(?;nLr*kvkKl=+6j#7VXbdr=oM{V1I`P zSvF0cb*fT~q-~yt|8bvX(mtc8+e&}cA@cqZGZAXf99MrHR$vpJ=m$HoYY5E)KD`aUcgxWPf9;6uQkPT#H8 zL*enR+lJF5Z!9!$A=F?LJ7%=yn|rK~UhicrC`9}_eySK_x~a!4ITyka%B1>lhes=_ zASLLVk$-Fs_oGCdxP2)BK$@IdCPzeCEIZeUl@3H*`pvX$BI1pghwnxOd?Sl5Ptpo5 zyYSSNCwPuWIb;3(1QRMR|3K%KG09i97h7&XJdI!Db-PMXC;x=YsDUI}MLfodj`sPF zt{S;J7jrb0Z2mv4weR5BI*rb|r(`S1QM#E0gf9~g1#xhd+2IR8z=nUy1vI-5%6Tpg zZch5Tl3S&Ps=296zOMaGDDD#1lM-hPh=NGC_%0nG`FJ5}7HIr!Nqf;o{y+O|45f^4 z5^IW^PiZ8@A~mAF9QcIBc`cWJ1;{X_gj~IQz7~93DW4 zf@MD6pxEticsxkSAsxHjOtOdDI(sCH%Fd;l^`j{TEar^<3L@^-Z zohm5qMW3Hwp@q3a;t&4a>7zF4;$WBOb6Qv)97hsfi`MiP+IlD!{Q;ElF97`c#R&at zzYHWT@4bVU$-ryR_J$Mp1Uz^F!!;;1U=Q?UY!=dw%a;~fepa>C-beY`{q5r7{y02%-W0+~ey&hn|-$uaOdw4ce&=N)N`Py3Q@ zhfD=bjpLU$H5NGSqWQ+3^&ggR*Wiz?O)+aF&$2h>K_;Z=(=a_RjdfF|lN@pkuJLvBgV_8ISg^m)LBa;Is;2{q)xKa38+{k?lC0S;oAv zRX4|uy9yNH7q#X1U&}0i0al)P=VIy^8`y*y7d!H*V9j_5iMOZdUp0QX;KNgC(%kUF zjaZ^orIDkaQ(*Ft*KA4Bsap2)v~$zXd!VVse3t>MlHb8nN6+A8QZDL~0yn^pG5cJ3 zcL=xz@D^?`Y@cX2CS{OP1aMu5i|LY7wcDkLL)UKEq3$A_gi->mt7E-$*@N>6W}Vg z%*eemhorZQQ3S#|U=$=CMHx^ug6vE6os~|mH+a;V&+pcU8odn=+}pPmM(zL;_}Xnea2lGc@mlBC$G`WD5UXU7qF>~JH?imk(Yjq zUBr^B`Vr2GQ)kel7*EJG1FO3*;T|CbqU_8b8W9+6RADlp`ihs|=1Jx6lA`B#{-w5))haca1Ax8GMfB5h)g5d{Syp z7uo8B_)-55iKpUysGcFreq>Klz$VDfV-VTz{0t-oRUmquZ^>|XGWG&ttF{UK%otJ( z$CMuc92}${@*cw$@rUo%;8^jZFa!L4i$tY&Eq@92ehU;7X%Q0O{6P~1ih-zk?!53( z44%L8g8$qZ^97XKjWGb{x@6F+Yz|vN4Rh>XB=(r&DRXP%;}tB|$+ljIj%iN|q2lPP zIdHMjoItR}?^~V<*p9az$8kwG90WJ@ln7Sn2BTiR-u#^X((Si}@a+v;b*}ycnTAQ} zNH7j~Tw!wgIjcqHu6ChVJ3mUp2s#4vL zx=nvmb4qO8&c=C_-@OPo=HJWYt~_KTy-n}=u94KWw2dDokr$WHRl=muWx5a>^_ON$ zLs0T#$Ljg)P(eWtgL|22T6ik#*n#P94dm^=ky>XcHNWp2H1aQ5)Jmeg^oAZoJ&{WZv%$Un+RtqX!bop0Iwl znDM?j)QY#5K$v9eT;Jc6G`4PD|BdpfoqfUKZ^K@s{dwk3Wyo;IjjPhEN-A{4yEm@4 zDkBWIl^MqEa)6aP2dJIDSuC59`S!!jK&qN7>G!7?iSusdDhpO5CvQN(=$Uw>))AHB z!joe`6F^Tdqgr1rKQe?aq=oq1XB;g6qjxM5!XxdSA@;}(fjd6SpgiOpsm^_Hn;y1l zw@D8V0s==;uJ4W+qX)nEV1}3so?kYrUQ`_`{Lyt@-FS>{lQJuVeoL{ycD-TZouQDQ zgCd~F3Kw3M7*`-qFGGaykzV|MCE`$%FaNMm4qr^Y;UoxGtw6-K-23ACI9L7h&_~Jn zhrY}GEc0GMAaEV`(hL8(wKB2V+5Cq0WWYT-c`8Lt-_Y%}&b6XdXfC>HliESqwN-`w`S=w2JS#29mwlh&4S3$ot*)g{Er9u+DlUGg| zu#|+R%>FDnH!`7`GL=B~h9#-NT?gR5$Z2o@q4lobcB^%Q@gp-z(D9ekG~$SYcc{1t zYG^U*B`+=1QLE_@K@?@ZTrCP`a#i-h^FE_+QSC2DtZ5o6od4?#K)B%Cw3QB8{w4#m z7E=gWTQO;@x7c+mq3#HknquanE_xN2WPvLJMo9M^*8UZIA9so_g!@Wz>|K-)5#Cyo zH@=^`{+K6ag|Jocx+|0f(kAO}_53YyDjC^~pT8S{|VM+_6DDU2xK5*pKvG_F+AceR&MbRa>M zNs&k!Wi}*t7(K1%{FhX|0s_IST{20`bQGOd%U4^eYhkSFOX+HSgNHc5W`svh`c0-~K$i>Rp z#0*tCF-Zdu#%K7D-{I#8))FT*p1^8K*x-wpM|65}0&m9GLGO2O3_P9SAb|`nH%#V} zczq1>m>|nsuYmW1OD2y9iD{=ICc~ZyC21t0cWX04MPuhSO?}o>p=p_b_S+)gLc7{{ zu9=X+cH`?vu@pbJd;nB2n4NUeT=mxgR=Y9T$OK2i zcBko~&F_{y`UWD87eX{lTeaLA-uN_!_ zEFZwG&woZMKf+&1QL z9(>pf3*ZlA*hvE)fRLT0WYa>|2*VFk2SVsEZ~pCr{~CF0_7q>%YI;5{knbADxp;{} zmu{~Kzo>3?&%B1{+@ktOlPRHmPYbUg3a9oyzPldny?XFKN=u;2LAf&BwE+Xa>ivCE zMnPk5=*Y4M-%%g>;jg<%&W@0Ld^`K-y69vpy%Fqxs!R;f_td&6P=LbeA2Krb%;0Nj z96>b$=PHU!fN8uJM$({TEpYZoTh?>is3Hk6-edQb&*VA%Le%((fhQm^U>wa6J^3VM9E^tPqApmf3ak_5<+;#Z>q2}MmgYxxgTP`QD0 z6G-TDT{!!!GN??%xH6?6|Lfo^mz+K*BE5W*AxvsQ3hLm0!mEn+0?o*r zWqSD+S_FKh{UOHis&T{H%6)Z6^^NzgW%*KQfi*F|M@MWb;OHeBZwA{>-qLzqr~`l? zJ#ax)dJ|Pw!ibw12q+NDvSI)?Bw_=`5>Rj)EtD|~rD`BjPrvm;OLa~ne}{g+Q)^C+ z=g~hU?s{e>G*bNg8Ea;OKif-Q-#&W;hj2Il_dEZ9uDG^+SsgX@%P7UEtH10Bh;6Om z-2x2Up?h`YBS)%nA0|>4hzTRlnyjE9VZkmPd?!vu^`&hg9YXw`QqG6?p(Xz^K-KQ^ zm?}HeVGw7Wt-_y}G>A^1K=$J$&gE}`alnxI=ZXz^ztu_^qMuX@Bx|oM0HU$6-XkWK z1}#NCr60VGYs#$1@-JU0zale_rhB^t&O}($W?HNngPx2F%%=M3RnR}R>N&o*SZ3Y58Uubu@@^2ZK$i}P?@uBqkneF7 zObPYsFL8RI>*$EjQ7fy5FR9wSaBDP77qZ>WO4M73v2gA%YvcI{z&-1sEeQwTm41@f z|07y$_N=B>9nUAHO|dy;`PdW}zOS!=cTS=bz$=5ke7CKw2WMK6BhA<>M*ggU!b8{l zGy^nPjKi91# zpK>p*tP>0=@q_P?+}&;i?G-*jX08bUkwfS4{-Z#FuzM$)5zeK$x$yV)MWQj%Q;m@~ z?0@Eg(kNbj#1q;N4Xn!JC$E(mIlF0q*NoBH*nGEx4S=Iy4Tf&nSN$Jy0FJBn@+6!y zCEIny6bbL0)e%3*!pmojK-oV41=S>uJEpyH|?E zOE}mxWL2%?y*AV)I==zAurtiYhDc~x+jtt6RiCY6KZ};hM>r6!*>=1zr2bC92DfsB-(Q`Ck$_SyU!SD zlskqf}bZ)po!?t zdfMf9$x8;HzCKRqsTDqZlmtB2(o%TP$OY?yl(DPTskC8=-;?xPEK8Qk|5TA+%x#eD zU|Pp1whUz>9{ps+p6XQO=VD2+wo;)Jbcefi4D_VpqCw_6sn zzKea?`1~^}5Sorred1P*FiC~nc_=E@D5d3~jIzm>@{_@tJt_pnWQbqTofRSRt&VUn z7Iq20s|Li!*Qy#g$N@a3=g+sp2F z4L?Bhx2bMyCT<<=zhScrzy|gOWZ-W_MJtdMJH57`GVH(CVtQFT*uPenzQ0ZNbeayT zXRA5}bS?^T*0vwV{WFl2rDvT9F!uGa#u|Olon08yNji=ESe;8MFLXS<{;JPlO*4V> z#28;fZqxePY4#TZ)Y>*mgOoy1L|CkJ7aY-Rp#xK;s zpgKz*`fERs!Ls4(xQvSy?*N??CElL)=CAbM2Q<;F+5&63lIr`jEb#?$mk)3D*JyWM z3g;nI;1T=iTm4}pOs7JEZGn==l%M^(N$7H38dOnyh;_bmfj(xt)W_)2K;jA>*Qq^X z=s{nClYZTnE*DDZXo5i4o?MOalF`y*n{|N_I9jMmy0};3id1>pZ5OAr^-B0{6B`)9 z+i^g`x2|H!D2BB>)ElpjDy1O9&`Ij1&Vu%dduymgKX~<_RwB0q;pyteXP9g{-;i@F zG)Ke+#OgGaKfx~yDKwP_ix2SdR*oLN(W!k7PT%zU)D{m|`E2{rdf^juy;?UC{h3R- z0;Z?5_u6-)Ju`WbwX9&V)&yr68}gwIw*~0@yNXNAznotUE1>KO9ZXuGY;iO42&JHU zGIMSHaBrqlUD0yW5+sWC-G2Cy_qNN$_+j1USH=gjtSePM?D+6;7WxSpJZ%H9xNwgy z3z^{}Ribo<{m(WMEf5j!9Cf~Mf(j&T&4z$#Gb*Sa-lH?Nz<^Z0^1r4wIqNC7(_g6U zB=qm_?s)w!Khbc~lEiFn!g%<=8~e)7FgjBi_()>0S;8@;RtQaOmhS`WYhlGce7J(+ z=lb4O)`8e^57^a`;(gbt!H*uqz@f}}5UM2!f`M&c*kK_>`(^W?a5$z^{?fGI)q^qh zfRPyr1afH6uGpJ@6NISP2nkbIQ$7f&s?jhYeLwt8nCk)va%q;^8o7{;x_|SK&`^Wg z+~drF!x+5iac5I`73z$_!?-ig-G&_|N;@A)$k}stwk@7=OhibmVR}|L#tEJDbW;GQ zyB0gu!T1Xl)3?yv5bhy&@O<|`>%3D>Sme+Zx=y$ZeBzlXIb0PQPT4IPb2u||v$}u) zuZNA^tV7j-55MVz+tVCMs4idTLpiRpU2vARG`{mPM#@UH3|m{Kn{NfnGY_W=Z9*(J z0lXhK+ifNMr<%#f2dibiD6L--**k#l1?at~ki-x7b_JZKwAWfAGWoS2O20CESrP!E zS?fKS^EImM(Z3PS;EFBV9SaS;4?#Hl6`dF^;cvZM`t#lNio$Ad(Y+hkOL%YYEG+nW zSn9RWQs)2xF|9EFt(T;I;6=N*$>FFc(G<_~bp3}%B5mN>c|J3qtMT1xJiInqvdFA8 zo5;xe;_oke(dkB5390P`1aI%dz>{5w3`BosZlgxVq^WZ?dVeGbCq}@{%zAE){QeFT zrs{@cj&7yo;Hzx@R~uGRIj~OJ_r)l5iR3TMaLVOX?v8N@`j%5D-VSs6cth5f>VCmE={<>jPmfp?85sJ)x|dQ-G)_jvgZpkX;BjyNRICfZ-{ zJy)cSNNcaAUJlg^I4QEEOrJ<=GVhrf=0;f80x`r`=aQzYze}$KBuCDb*>~pPtBmM%d8~q;CpM9b_01klHkBA9`3@*Q;q~!T1S_mE`GnWzp0uch z5Xw?e(-x3v2sTyAeqmhMYTP;$aME~?wv&I;CgnM?ofrX}hOj$yDu^3;c&!7><6L*S zq202PtXLPYdkXD2{r;&Wl_Bg0{qR)5r@k5CQq9Y|pQZ%gcl#+rt+&22hnvSf9fWYy zErDM-_ixu?g46^3H>Mi1<41#7DK8%5Bp+VuFOo*Pvihgm1*3qC7me4I#JABv6B^!Y z-nGz2S~a|(dk^z{{BcJd;2^LbzCY`2~7XG;oo*>}-w)oa-=NnzR z?gHsd!Jx7GdKXxkr84lTEPOH*D#;22xZFSOe~#}pL~MST`{yBHvZ#kaL%zbjjFJn) zW&MPcbRZuWu3Z?IPpmFk7la+LAVj9H`533nKspjPC+)LI@CuRI8pH;O2Ima|-$`$RPd^Q; zvPag7*UB;g<8mX8FPm@u(55MRyB&{TMjr1hq%2b0A_R8#7_XdLN9Oi~&nS~*ewIgt z1fSg!JkcO-YbQ*fMwjoT#)mQUdE+MzHsXKYr~Ub+8>4MTakPVlux^p>gZb9iA%GK* zB$B`=^Y*t(l}GM;9eg!_b+Fmm8Un-9lLZlUIG`j;?u`Bv!3g`nt12CKZ{f+q1JM-I z^tfedy=wi+^{DbMp00O3Gtnm6{%k60RLVGSXEPc>20Phg>EgCpf>{H2FDL3`4pEp3{ z0>~CW!C2v%^SBYOT_YIb-OqqUcmy_e^4TTf>?k`KsRVmo!uiFj z_nj>Vj4VNzWgZKsG^5Q2U#|Xsej0A^V~cZX1wB@WQr=a-tU0fL>ph0gzXx(jKRqwa zNKjXPY$cOjiCD`0R_tEygRc-qAtUO-+C!oByLw_1 zG%uO(k8KL6s#M-d6BuCX9kEH$_Pg!%yD&y`tHpSF)LNgI&>oDPsDRi(!SBN!RuEGu z^G=ASNw)f91JOMiJKH9S--*!Q(MOIu%x9RQ;Ot771w(JUTV@iw=IvD|F^Sv&;C5^&>3Yt@OS$H^+w7LW8j`P*+Ek`iR3zAgLvN-*edZ(z z$+5QQ@8wp7auIS@OQG);L;J322ONX?P|I0eFV=S~Xsl5Uut#Ja3Y(Cz*PZG1az|#b z%q@11ZB?!gdlr}A2A-@a+B602W;+)6v`mF#_HT*b>GJvbR6_j$!GWTZ<9-uxh2d(S zoTX9|dI{NROH`>LjPfA<>7Q7yAf+()CH(JVqe7v~#1FWZ_6d9g3;}v53;<(!M zoCUll5XBE&w|N~i-xn%_own7Op`UXQCrw9Cy0p#9JRd1`??6@!dt1+aTWu;X(271^ zR@tdzyGJ#iOoo5>nx5o7wUtD=E7)jml0S(Ya)M})St5KcDH&9KMn!#9=h3pbvtb>? zI$BG(x2lZ?+`<<2+a3g2ZY)7jd~JeS`lzYOv1mw|No3&8G<#y?5-`GE63@r2qPDiy zxt+GBLB~@DQp2yZkoM8?^WF7o#-+LEK`Ke-r;vV;On7nz91W|o5Z6BW$2%{=N z!?{P6**Q6}D zRDCXct4^Dw~&hv)^ebQJdwQ`rh7#Se>!oROayERx!25A zz@EW~Vu;mvHR^3z7(`HCnwgJ5sd}CvEFteND#psTD*HQSd(n1JAG{wxM98$F$p)-3 zHuKzS1kMeDM+CKG3>i7oiX%T%Y03%jDtmD<+5Kyye&wPD13XF|#(Cma#lNkhO`7v( zJf$uPYP~3W7>j)2o<^Va&DSD;dW!tnu?V2DH`5*zWQyUh zi}%{8tzUt7eqDTE@2CA-69kFXTqwt4Xk~lam0urwe1UjgkHg%kKhX9rJ`ryJ-h)-_ z-NQUA7UEL^U27c!U^s@D@85yEx>0FoQ0x)`jEB!+PWrUnLe=7&rp0rNsG9jVa*S=@ zVP}561A{GY8`@8O30y6Z^ZTJ*UDnaSVl=Y^Z5cNJh5L%pj3lbW;bKyl-FPgw-OE59 zN%5fyybc1e0gPvdO^@}e6g}DS_L?CFG3|sMy^^<0@$I^F+wx>%a-maE)*<9jwNDG7}(#lBBLCLU+8x_va-UlPObgDpyJ z%tr+MMlgv?tcL@|0lPgYeFxlxY}#IKGHr{5$k-bB{*6L zZ`7=VN$FP6&z%tRE|;fCUVpa{-8w`AKX#gE8Edd9K{zkbH}DU3Pe+UYN%Fjc0xDqr z?s3`^ilCk*>3gHwI|~l2ikdY=GX#0!?~^zS`Hs$O4CdeatKDknP~85h$x7cHGLu2G zX-ndM9}0!hT|X#az;-`WT!&G{g(WU$cVEOJ5JY~(D$(V!JiXCE-E1~K3R?tKp6-a- z6)9jOZS8oZZVv279aN$8PIoj4Q@7V$jGIh|bZ8$BRWRB?s~I8O%yW{&(gE&|14zW6 za&mW+mP<%}YcH7v#&LNi`RNqxxzW*yijoShH#me{5%YnVz#_m)Z7P9?T%y>k7^?meX(sSdNlH_pTa z><3H@^+-1)WzZN$1D6B*umPPys^3Mmhh*Jr*r5wq-!dT8bi|+D3n9S$!JZ@Qg)mn8 z8Ygv_F?r!h^Y^DiGjI9Q)1?b>zH#{^8@-=sEuo9|fQqkM>Tkk`FHLTDlHlR*@CZ}+ zU;`lsGh8m{#=7?Hp*QV!zeK+9D|&YwO5ubGwq?c(mQ7Xxj^)>NY=-pnhdAsr2(oD6 zHi|N4gl3DFR%fac8L2kT`kp0)u`EvT-a`XFvHlJ*P2r;>@T@<-JEMp*Zb0Qg z{F79Wqa&&TrNEUfG1Svvl)uR>{b>jE&>RWQA@7_4>!{NYH+3t;pW#33y~ntAJBNhq z;lEry-y5&upVKD2>B1z}+AbeaYALr%;a8Bocae49h%!-IPPO@!c6APGdieJm3x@vS zK9f}Xcc`v1l{%l&7EzP`L&DfsMWF=k?6@^%aE&$@)+{ka4z#6Ha>Lfm*)2$r>vi%# zw8-H_fyRZQ;%QLYBY#;L{LP9TK5HgEMR!=?7)REJX2gFo{v6bfkK$Aws)XU@;FqsYo>5- z56KcVNX!LkXjh~Q`O<+6z9L9pxW{O>+aM*{#rJ*B~JtfH)cDW zZe8IhIE8EvijDJ$cr5^Rt=unFXX2sZ;urB$t_$l@3d5 z1d+g>ULF-$rl9kPk1d>@eHaBBw7FM5-cwM#sp z#st}S4@v+ur(Jr$M&*t|_|+g)?CYHpP1}NSPWOax+CysM%T$OSCgp0-0*zO;8Lb2W z>2SXKxaxUZPuV{OR*SfhvsoWwL4;T`&O(BiBb44MO#v(Mp^!^J%==k8@rpzCiv^Y6 zSB3P-C%VEKn~K02(?x)QwuF0%)O1a>g0A ztzB$CH7QQ9m$A)Q9J}f@GLUISO(Fn~%AhBxVG>oNt*)+OHyYCx40co4EvaLi@qY>- zyjsjS!`vb9Pb#jZ@Mj|0oOYvlfsRRtgWGzp45hVZALZL5|5;Ayd!%*!(+8+u6T&<> z+y6*wD073nxK!Vt%>hh(6@TVgMCGlQi+oitxGz(<7OdcxXN|jgNK5x2`tMaof3?ROG%btHBjRudLN}Vr7R*(ZtWWc6ayfk;*45TnUek!wx{j2ZprIKE)DLRm<`dXN{ z$8+rq=>F8lt@v)d)fw{{1*IaY-I-vRGkm+n3~Hph@vKYGtE$JBk&wc6fhS|9dB1 z8S!hrr3o67V(%O*9HVTFir^VXoY|x}6+^4eg+HW?BHY7OsA$&DKi^#T%%Y`#&td46 zgexQ9H|c}>+0${sPma^7MvPIemZ*pk#)$BM%Oqmt)ac%ySCNe-6GwCY1#7g%aq&^} z3EHFFs31R^^iBvW?b}iOgNMOaiDCL@$@f^~k99xk4r^Qs7XwNRR~c~+;A8wyfhuHN zHEwqhlS?(U@Y&jx#UlkCWanYNY2>~5OBX zM@uZXlLpP%Nh4E{ZetL(6J?_F$o^3K|d%tCH3~0=CL=S72HP!cL zTWXe2TF?;3KCvO+hej`2o|f?kc$oP!u9JQ2=zp&RNG#T@O7=?W?b^4qDTX5*3<^6B zS<@U}ZMpE=kA&iR~IT4E&H^X~1>t@H>F#AMY;f-ko8+ioomUC4Z14w~C; z>{Xlc#_75$tb2i@xK*F zq4e>%5G%2*ztX3j7+6}`vWl@0SvRgoulXz);+*+VxU(y488{|N;kG%)1!$8^*B9{{ zx=oCP9+=zT)pA1?QuXgToqu(!tqhEy>L2peD<~cYGlR zjO6JN1lx(05S|r)zqHKJ$$}{3{BzbTd1rU3d!}kFSmM zPZGH`QwJBsRy5+PGeGulZij#!{zN2){pYWgUS`y-mW$UCuYNPqccAHzZ@aTlcrL=@ zL4xxc$}5mu-m$CAY*@nN@!U^LE!mZVe!-U-!w@?VzL0h>M0u=oEF#$L zid7u`(-0r_lV$WKHu1cn6~o9BYF-h1A{f!Icy#wyYiM)FcWRM>fctn-2Olg@xB#UBchejNpX69D zeAS!yQ53g(`2Mq(|8bPrFxRw?Vpw1clMs46X$=g-44;*iEN%;Na#^?EIwl_uVMK4b zEaIg5enr}fwb>6U=l-{xiV0BHEqXRp3j^oiUP;tOo@#X3ZpboLimJr}l*vAj=r_Ln z^$(f1z*{PPfOBPjzb>a!pu|Lq{fkn~Nacp^Tbz<46jRz^;AXlwe8Pd#?Pk!j{?JQr ziSpzs@1DYME0kZ@rOLK2BP>&MOGQ}T|FTTvFUoA6;pa>xTTYql3)AKTQ>FSQik5I8 zI#a2n^?Z-fnUYTo9~-oap>HAsI|N!n?FsMAYGHLAxIaL3B4~AdspF3?o#@j6K#`GD zq3LD?pbC$;cIY|R9V|Nm8k(NIO;lr-2E9@tn&e%^?%7!v!{L-s!wARDxD};(?G>qMT;OLx_p$*?A$a{Wq zHVp>Dao0orN8li+tju;0w8D69Ss=d>+y~2%r#0u2Y zJ~s0aZwY!1bDw|X@SvYd`EV4wvBwzUOXloc$BPPv*g%Kx4e#LS)^71`OqU_J6Z!7@C}%K#G_Xfq#;$jT~x2T*|T~THbgtj%!i+piQ2BT}0cu zv(XRA{?_xyM**ngx?c&b{q3v*`LhAI`+J-L=~z15dLFI`q#A8s4!94vI{3wsS7*-r zpiDg$HK_}z{Ns9tsSV5O^G!fF9=Tu;p)WGl$x8amQwc8s+!&QPKGNwWiU$gmFF})u zEyP>iJzK!|-QiL%+>^RbkntCf6iT*vy{obo6eI<+tH~u;*nlY7;`_Cf?v*tkZC9J&Dyvab~)ig!%e?L&Gm$0GyY#2rd!8M?gy5K zcoO{v`st8=V_pOo>}g+FoMJ_h(s z%WW0?hZb6pV#cCUL#Cgs!;~Q#I|GE0CD2X_p(&#(Z6YiHfL|{(%mojw5;Rq7396Lj z_j(!)zr+<{rki+!Xg?6aL%9tU8hiEz@J>*tYT!#H@vcJW%T2e=JZ5soamq{~K{i4r zHo5lq+t?A`RQ1D3!_t*-3gM9PA6|KO116QIkhfAVhFDAlG+@|>)>UpROAGm6+NOtK z*$GcEB)EM$_VuiN)4^_D-}0l#nvo)KKxySvT56H#wd|?60-Bwn3Q4T5s(jCZrD?Ys z2Y?fk^NF9Mq$4M`Xx0|7+kJc;bs6qf=|uIgz5A(3rpba#w(cx6P*pyVwy~H-EY4mu zZ#RB>b#84k2AH!#yQ6^tI_iD#5%F_yhU`QjQAMtsPTyPm1QO)$BHCR(%(Cu@W3aE5 zqir-QI$ob?v|kK<(xZFTbq)4%lcLpd#gbnJJIuPVivqI}{L!KV%z8j;lK$`^CP_jm zIG~30S5n7R(^Cuo|u*BjVkv1t+_L)HSYtuk`EX;c!?lP_25?0HqoIQo4KY2v2W9Z-iigAs&H9nI7a;u4S`yt_RT>j&vIY-k%2!iv+YaAQ!zD=_)C9O-Oo z{`QPLOGSmo=`z^BQc7LCyt|FAkDCcsSj9}2ErZHMx6a3Td$JESb!IUmhC(CDh(CoR zVj0n2WycdBp(}XV-R*OAiql^`;#-Es4z?uhex2UERtFxwFA|h?TMk?0{j4}F`NmGL zGaAUv7$Oejh9ryKx4y{(HNW5|=+j0vG5gLuQW^VMF5e{V=8<`J@bKB4oazFuH;x8w zw|hmRWebctfTP3|4KG#jryK^qtrod~WLFgy>mN%dQe(Q&!dG(+hJbyIv%C2hcOciI za2SEXP09Bi%Jm&kRatffAu6Z>*^jsWN$RNNqIB13fRp|hjMvpd*Y@>0)AFC%ru7k@ zQ27j1oa#<=HLJw%*5SB_V(YD9PG#E!jn7X|Lno_q0fj=tt%x&ffIj$iuJ{xaaJ$Yr z_=&OdD#sLKvUlt=_|;^NxXsgM@zjK ze+6unV=4x+^7&=h@|;xMH2P25=uF%vj zi(|DSv{m1wNZVtD&XmPBhnoM zMoWi)bSNk&4brjEASF3^bi>FI8{^sg^L(G{`u+p2pU(9<=iKKGIulv16@ypYg4}u> z>SpF=caymSUSnlUmZ?b%a;@-ONG0VWS{8b7|NK`)8E|J{yUjuwl{b4rE~~2W@v46r zae>?YdrXY~T+;EP%L34$hnGycHA>8wbMy)4Sg0h$e=aAIVt&(ygzLxA%eDGC-5R{Y z*K2?v?#kHv(U#SZ_Otr)Mm3n$sxMLFvsm*vsjjwMp++FH>Hh-nlBZbMI zysL5i{_c1_7;w3NI7TnQ?WfJLNB>d2Nr1ccuL6b@)ghjDz9hP97UN;dDj?DHo@$DC z0J2*sT!`k&SDs<)-M+~fx$6mvj5hu27D7!DK_qf|rUz!jH$2OHCnX}y0AL-|Z^P>j zX?m_yo9o|BpuvSd=Y2$1)YeLuYP0q(7_VEVUBuzt=Jd4{<{y|x7xaifAKEn0yF{*w zd|6-ek;Ci-Bs3)QXU`E-Y0ec}p*zu?%za>Ab0a@je)Nw=D_VSg;P>m6EO+qTMs_psL`N#9q{*U#e6c(j_7{OVd9}tEQw;3*lbB%@Co|}%E9sac)co>(! zQ~3(S^#d`SI>~$-r{^_B6-t!eIAMAGyaq6KPjB0wpu0vsy9wF@)B4$&6rc>wg3DofUr++=2mRIWvZrA%@sZvzHC6+FVNe;mQ{7R?2`A+3FClF8V z+blZp_$f(*Y93~LiSqX-j!rcQ=MxM}j5JZAXtd}xmnI5t2EFXrd}(#b3>|~jQOwII zUXvU?yqTYfI!w}?lVWz zw7iO?M9L%{4D6W%x1L&(1h39s3oTNs&MYs1=J9@XNF(|J+R6QFvd(I;Tk*wPUA*-r z@!Nb&(`RlwGPF>9L1YdgPMzN{+X6qKVDz==3rxpPa1Kv?7I%wJ71TJ-T6@4eLR&pf$Zk-eaaS`r%sG zz_IuHqX`dpD}r-*rS0f~fG;EPtf`2uMf=q50|8!#iWd|G5!x3a6U%UpXc$^#@hBzFl-{*3sc?y{l3obY(-iU<&+l%Oqu+4qH80)pp9!gG!a!S5P2t`;&4!-_6>)|by?Pq^!TEj` z-u~8uXRQ~{@i_41(F_9kg8lM8H>6<25rS?~dZdY4uIEOqN~gnQ8F$YK(P*Lino-+! zcEyD7U84Auh*FU3)0jz&&;&r#E{|fLtcguv5i4Fp%B>`f)bF~VD@tLGm-j8E6Mr9v z>fV^eH{bZ4?v5O071$e#jWD3PUehu?2QEZ_=QbV}@YB9F6MU%8r9u7Jcr`(u;q zd&LBngu!;mRoOJxJQ`V>CA_hcpA-SW?jhGV=FYg=THQ%;y12oY#f9h*8DanJMmbJ| ze~&m&!8U)a3;VxqBfKjKrHT1KDlrpIs0xa&%}q~&>#$G)A9kya*)|7m<%gk6K+xqA zT+6zOF?wuP#`jcCc3ycxMI!p>BGI@H`mwOxM2R}+&ur%x+5xHGmLzx5G2=VU%&idh zg9A1C`_H(T-CP-J#>R{bqV5u?@i+P#V^tEn^JFP}>GI->Bp&>)o>Ql~VbWa&n9D@n z<)HYV*SBM~wd{(q;riY^Pr=Bg)8~BZbbP+JmY!Y)E>w z7C9QLCqqHqVs(P^t4dPV6`lA<>LG#7Dm(MZaM$6_&n|*h*XO^Ls*#8B8-NG(iK8&> zti!s%RHjtV0;I%dsyVlb~gTO1oIVN3N>tFvXdZWJuu2Ub2wOgNh3 z`MeIl(u_$GW=zYQmRO8{Y=U2c!+zqu;EgBA+BY9j>k}~|WVUzzx-$K%v)CZKp$OlF zuC^$0hV>!;`&2G+v{$( ziX`2i36H+}mS)t`A)ZUUg6c+pr4r2{M*Lh|Tuy;m$o=^CHpuw~zt zI2M-Sa1N-Bs=xo&Z-B(WjjzNxHo6AI$F(Se>+yalkVJ?jgi~@@l8`%8KZP-%hv8a1 z;dAeWESKHic|Jxg89hOF5qrbeJ%cqp zJISgOYR>w>rvYm4OF(}})MXX%^+7opWDS~BL{N{!oL$2F3Yg0tcGSkry(g-8tIS-!;QUb*Zmi$&dfJ;HwHLyJFIrawRAU zr@i=!o}LQn8u)altonmx}R=Inx!M5JcO1 zR-cOoUQVBhS3%tajYwZ{Q1#x?CxpxOhYP3>C={1rgYNe8t>{;(O_WNjEk3{Uk#3~J zz$P!S1^c}iPnm%19(~6Jyyby3!H&1SK=DK8G}q`etv6>;6=QD}j5+ls{*G&7kkWdI z*%O8GdNKt?<6%&|t4~eC7e-|4tNSc{qj|tfNs+<mO9&L4pT%P8(r zDiRVtYeTCHxa4MzOm;%Ob5izu3`U(Y^k#Ovm;YL2s{?w=ksvuv@lgG={U-{1;8yna z+(ZV0MpQ>Eg9AiP)9A)l{^&DFKtu#t4>pHE^h&jX=FP}it+;Tlz@o78Z5w%r>Bzs7 zxQJiZqBSY@mJ>l-LU{=+oO|I4ac_?!FX)LV(Xy}p*GR@MdNgEQ zs(vz=!bqLO8>2?>aU4kBZ)je&zu#CPpZf?SR=jpEZ&~IFCoxc(fTKH9`mW@jSJrtR zUdg*C$nKk56YY>E>Gt0cP`}C!aW6VFS69#<0dfyVLtt%tJ<=MO*5Xcl+5!$KcM_~j zkXFe>^Y%zH%2WpNIF1JzwvT*7Dsip&2{V1%2ja`k>@=Lf{CUn_J&SToH^Hb#v^0*U zY5Tb3y%vAH_iO%l=V5~7QJwXNlfHLbs-m9znM1UTpv7*#Z#JE!mER^30Qu9|sl% zkq8(3)&NW@zwF?`#MwqH4|Z(8w6v}9%l$0v)!%Ea7m-zB#?%U@u;j`A#?&qJSwAFL z_bKM@;9*KuyDw+`?Acfov=i8|(u>^>X~63TRKr8gw%^4^{DNUKlG@XT3-gttc)b%s zDe=^Se#O5$1jo=nN33xVn85Qzy3vW7_M41HH8uRG5Spi1pxVHyGezyAzYm3!x3{5Dt#oFp#y-(nY9x3(rP#9j>}mSekwRwWFgZfxof>TL{bx*$qW}``-Fnn(F)WqCdx}iG$RR?59T`ylQgB|R2I9KDw*aojl=((V}!l4o+O$meYKFWPTPzr z$ogjRCHw6Ce+Ckx5Jy2u4_@S-uI!@QA=-I!tO@yczZClrf!8N++hd+TlG>2AXt2!c zx=weIEoBePBGAvPCjG_;x1B@nYk70gZsjxx`I7;m>8d|`_SmoaL`tWMyi`P zSWghpZe!;kzrzSgX_gqwmm=vndn}yiohizX#f8w1p{ywJ0@QCa^|sLDn`Gz<&!qkw zJyiSaj#pGw=$4-3UtfDY7UxjvR`Hr=P|a!kPdMli zxi&Be{D(MV%+^%$!7(wjWQWeHFtioT7@SB@xUQTe8pRZu;vPC_(0tRwFMol?Aj}(H zM*sU_@LyTRg!GI)(-&J^1~SqdVj`sLs)?>qFU$s8djrzoXW|dl<|U3#Y2P*r0rJl| z&L{1c^V&u_A15CF<+HTnA$ywPiRvKO-EF)rz*U&LL3TflRO>|t$HG7=yTWqE!@4-t zs%vHCwbk)GxOu4)_wx65Fad1C8NT-`4&lewILH@743XB#8M8SZZufATi?jM$n{puu z-J^r6hb$WGEH4I;Q`(Z;!q?`yKMs=3l!-H@kM zx+v#7*qhw(6ThLvG9Ysu+T3F&z5IdzvfvQ$$sx@ z!)^L-^yKhg+zp5?$hE+($s0LxtLQg zhWjA0x(wfKz&tX#F`bJIG*-(tRtkl*0AA2z-EGZobvu(vz0kYRWv?Wm(KVYv+@Mq) z-1kiDvTCoR6fih>p*ao)7SSq1RMbzzUlD@LH4X6p5Xj13lWpYd30LJgPP-zB6P)eBmhTBA)YVCR!P*q_%yC&DK!mxU{EMhc=1^L zg+yKBbz`@};{X7;iLsIDyTT8C1{ymffE+<=K}XTYp!Y0(D{kS}*A7d1F+Od&>UM1V zhK{Fg2nGF`^2097WkO`8hh`=l&M+@W&{NH7o$fjDxHQT(5bN~Fs)wuqpp_jx8W(5M zou|jpuY%U_t;u{Rx@`O81UW&zm>$-^HvPFkUcJfJE!5_&c{QIr5OeHW?#1{7;q`;d z33AIKs__o>YIrDdz?058C(Yl)HYA6Z_G}8alq+>QAm_0S^f!NBuMxJFT0x)VstI-u zSv@^@xh4slZZIR1C73|B__^Dy!b-k$ZMg6>X>wCx?)Scp-BgpqI}1XwpjR|V*=*Kj zs#{*E`{wvza^Hfr9F(02NcqdZ->xehuE&ClMZ6fQL>G&z!dP|5wi&x0bP$<^LJ9+9 zXbvW{d_*0SJ#Ep7D)vv_ad;(vceP(0{$#DT%U9={m6!3a%Wl`-pU zHt${+##BXlZwZ7O~iXkh|a%b#IY(M;Znl#kZi2b2o=AnZ{DKkU-1o zN3s)r8nMGht$N6-O-4cxo!qgJeNiIPtuFb-KV>{*hV67dujur)iT77&^;8w-y$sb9 zCLUm`WJIk!ud(}?B|hV$FEI>&#GWH@>Ief)v@|FM>kgUWFS9riK@|7#r~euy_kH$A zSg)919p>QF6WF>4Ri>T$ke1hoc3ibRX<9xaUzm_qCK3a`g^aX69S0e*30Huioi%~~5Qobu zeA=R-RJr6aT^j(>*9x+xZeGf?UsZPJ#Kr1`M80T~cJ%)x3SVd1Y8$ipEyK!z@B`X1~7Qjm?g~z2PgeO~dpV7B%}zX~{P?2A+g3k`GQSMQ}F&F;4i| zo^O@DY!TXtGM9iqx(zfAY(W=gp_`qQsslL|RQS()X)(&MrJDCg$)+T;h+Mh{h-)o? zINE&K}aNyfPpR=-I&64KPR z8?wgUDUzk%+1 zixd`&o~14c;$4l_u6UzZr_)~#`~aooAjT=kFisUczJ16xJg)0Y|4gaXOeML5OLOCZ zV?Nk2PDS8E0@pnVuJz9!Tn4pRpFoG%drF**_{ z)ZmW|A_1?f$42st?~;r?p!GxPVIXJ0{>ng4RquWepOzFP(QK!xs}d3Aa;nF;ystk?0f^X*^u3kA#BL>g*rxyWiB<&=_4M#qP>HyLt>KjL^(XbIQ&rJQlX z7lBL6h07IEG%X{)=)LWba$jd^YP0F)RoHAjrb#B6EZcwN*gBV&))*r-UFUW{T^OPh z@UJhB}inT!>bQz zPe8CnR$xxH$Jr;K^+szJCHp#Z-8i=l_+Du41;x>XR#6}u(7kx4V_6}z@+>3cv7&MQ z)H6A9fb)PLuR%{7ZezwuLoF|%VSISX2XVzgqW<8>@XRC`JyQPNS$3~+30EwZ(>xyX z?gROaznu6@h%`r3VIii0%N}6Kz#|RbR}S`)<)zc$>{(m7JwjQGcoq%qW_yS->r0)4 z%;hEAmVEmAj8C~b#$Mq?9J%K)n@xE3JT*I-=HynKtshKm+bN%Ja0RksvMGepjFW0I*%?KHS)nYd|5gO2GBq@il=(6YEtRr)EY z7*VD^j(F%aD6s%qnz zeM_9_r^zw*g`;&%muZ9G212P6cYzMT7ZF+SS0|2og2vd%erAX$y_d#HQ<2JDm;+Kj z_&MpZmW)lR{`OtCGU4B>!II0Rso&W*@7HKebtdlmF12@V>E|iosu7djMAry6iXVU) z*4ypqC`bWYO_t8waOZ3GQ=tOe}PFxu%QVDe7;16PZPk`im_OnPPL`->dWCC6_{q=|{)z`<$z!&_|D z&z9L|zs7sH^U@oy;Y#uiZ(UUpIb38t8~U3VLSM?EtdX89NfE*@c$6M_2CT(j*$ylb0}U({&EHdKnyAln+N$@UvkseP zgHN4_Kr61PW%mcW^Ze`ZvZoEArl^r$ef#ddHf+7aD|~&*ehP0xMlM=cU~?*(i-IBp zvwtxLa5%AIJBtVL<8?JAYTwRIaW5oqHUKZa`5BjG^n6NZXFm+Cs{0x{_q|)3!{Eah zL$J<-Bu4Qf-Vc5+QyepzpRxlY){GH%K%JVGS_pjNb?S%wu-er9UB@8Bc98;-K26IT z6jHbAXj^!iiX(rqWgWy9aq}mz$?Sxu1~~)_VY&*4xf1U!dnLp=-|_SQUq?RI6S}Le zUpxA?5vN(tkER9hp^Ko(yJg)yJHN{3 zciZ1rng(0>n$&Ft?o1idhJN4$!*$dI7j4$~2;VgC5r=oDO&$}3G1yoc8{pq>ymI58 ztX3op#-ltfk-vT=QdsfOFP8h;?+3e+cV#Ved|P$$8SjcW0500z#ipaU*zq7R&b#D;27-c9lT-|_$!^kd3Hb)P^6?R%mgC#SpMov$_^ z(liNkRv)0#1?ueVgDvEf$j87A7_t(6>0?b7;OO?-GW|zxgVrJqZyij`bcFjK9B0Ou zw*w+sC9iHRtv3U|7I?HZbACF*aD!iWme(DZFyrM~Wx}3JodJ|_&9M(%4;uzP3w!MZ zxKy9svuU4dCZ3f!Tw&Gp`#W3Qw-}URW%Vi`He>1eh5}?Zo+PLc+~zb@?YtunVaE7kEs@mb_jmiBj+PR<#9nLXc^0!)Pz5)XFhi2S0r$a3YE=m$4b+!_l zN&RCEo4^6O`LY6kaO?kSMCcRYDDpWiRtUCYmYJz;+SXPlYpEsO^Rt@Sll-=N&##`> z)vSHsYI3f^8@d9D+}sJwr)|mJ1xsvfiGCtnn8Ebe1WeltLxKFLuIRYDluuW=^J~rbFY1%jF9dPL2bEHZb@P zjxaJ!f>Vemmg%%wtPkANS%0v&k2OO5@M+F}p`+NAvQs`{bypKZ6GLe7?qfnmt949Z z*wGbKJ_2WOCU+PG@JfOJ(D(c0ql%4pn5HwRK>IEM zl~$}&ULa%&<9D?|zM*&W9NJBHso|%Yn#xQ+hA_7!HpF9MumhCmQ;%AqwWxj2u#Ns?< zQu<+hihKeEEPA5m@~$a`n*|(t7#1m~3`h6D6;|`t`2(;X0Htoo#ofP)fF~RVA6e|Q zb43V9=hME1{NogTOKI=S^Ce1M_4=ksGwc1wy4yd_Z0p-cOGj^)Gjp^DwL?35oFMeN zA@!wC#Gq51$D|c4tcF2@>0>R8(co&trwau@iyrbGa`p%IxRc>)XgNnj;syXsUz>hr zs_G}CUJq268%%0jmQZ`v_a2fjv;J>jd<;vg@1-A^le7OMn)&yCL+nT7@DH+&9N*K& z%Uf8s+k?muf@CK=!2BlPDg~j*i_JitItRa@MtFE>O7UlrYIp$AdQhmso>7O68b-k8 zlapZB&e@llFVvZ^6HSmI4=x%TAW_fyd8p5A8^kp*wDF4cA~8D_z(==U!| z`HyX^(uJ6)%=3hYZd`4jmBvMTAlg>=&h^!snEIm^v*zy^9!|;WILN*Wcchegh+Iq1 zQQUw1ei@yJ#oA4$Or|~jm*_fV^H8%7yiKq7XP3lj!%RgAJ0?fM$GqJx!-I5*Bfsb) z>ze0_unUB5_w^lv5^Nqnc{1ywbG_)^!mOcqco;QjfzvojiIs5lB0s~>lNZcey1PsC zi*j>_eP(|0&cT%$nD_>4RkT^hYc1Lx`Atj%iDQ`n|9aLiyNwaNlYvlQ)vMwx(&Ieh zRdrEsU$1Do8%+_0sgegklSjq-4c{1##vt-dkDf`#VpkU{{n(xFDg=p%m3OZ_Pw z!WTrE1L={Q_)jsgEU*RnQ5aJ5SL<)@{JR+zoi?)@64k10ndcxlU|}&c)|W6!TQi&+ z&_|hYd~d-7x>9-%0!2Yi%l8;|CHB7%H~M`TqrOZqVoM0YTz4Y3j7p1!oHn0f3o5Tl ziFhPN3pmuwp^cv<$7rMD>xyPpg>w#Q(O=&!tAd%RDYCDXTq2e?0KQ*zw`U)6WnnzM z)1bJ++^rD@i**(HXAg;YS`$?@3GEITES{kDxqnMc0&mx;?0wc@?|!bbjf=!g7`3Ht zw9ka_ST4n@-3jQCry5bI#NxIYhp_^yEaWU)0Vn149zK%mY)zYqaOT~jjn(=uNY!@@ z42vW{sn(cu`B&ey!Gm&W+Qsmap+6~Ux7qt;|A~?WcctK8OodUHomnUsNvv_*^=-8| z97e-)cGQws>R04N1TsjWVTxdViTPhf?~dgQC<$Ih&09hlkS=R$Uyw7$D4DM3e8K;Y z>Xtxd$nxgU*Kpw4KDfT=u*FZRlCOL>ia-OFOXs?|K|?(rdRH@B4FKQHVgQmxrUx>g z5X>Lb7?2RA<7R~1h8(tpVUGKyuWme_U)<2klsFfy&nIGv zBxILYQsR9n#f`~7X}B?W`udZEOJdy@r+)TrkFu{k$oDJF4L)T?^;b$wRG8fWRl4X7 zG4zTipak@8TFrr#Y1olS71G)b;Iu8&d%SKPyFzQ{tuQsw+Jv#_{kSE45AAYj!E`RRk0kk+)*Vl1Ci{(xY**qoA-rT@bR_xa(lUnP zhE4?{x@xO6XPV~?-}Er%jp5Eya!v@faQ#9AnE%k*05c!tQoL*z!NIa4=en5}=G;%g zx8ivlcqIUo)$uCyw_vpWCK>t=(gHSTeGl5{k7CX$#vPYSRLByicnGaIE266x|M?+f z@+VevC4lKrGg48;@HkL}7Td0Eu0pulyHN5iYhrNhH0XFjz2MZpv0#oV19rJ&$QSv$ zn;V5Cs`^2KYP;1(UrUn@Ul0%W`G9_}m`Y(BW17*vj9*e7Sid{Wjz8|#g`1w5fsxwt&ByRw8c~BMI7)7!)j9AkVP}8U>)<4&22T_8p(a7DgqTMJ}EL z+Q(ywC7f4VzXvxYPS;i|qJSizf;yIjG3UePB`7T(kb6^ujhH$6yWLGO0l`Uln(1FK z-K{M9>7;Zhl>bD1+x(1BI6)6*l{VC9wcJ`?o@4iC7QMw_o&^O;2ADFt;aHzj-*gI{ zeVTLXi(wn_;;g&NV{qi`7b|a#fV-N?8YbV&7u?QMR39dLk=(rS`5}uT>XGbFrr_bwP*_Za&R2 zVdX?+W|SeWs07CzVX8;=X<}T^MYIqp@?&PgFHcPi?LJCK5rP2*xS4 zRbOsfnA_vd&%Zo^qK3-s*RFq!UtbL#EyS4N1}B8QDrJ;6qlM+W{Ikq0PTPA=T3f3pHNarlregM3IE)HN*d;jfmSDYMGD5 z!k7PE*XQHiTK=wKM|WbfE0kfMabSrYR=A=eQ6Igx6z=_>+5``y$^Pl=P(d$LemXwL z{`xt*8gc+PCw>1Bwr*_jGAhV92Ymbc0W2t+(m#yXE)-JF8?rP>g?})En@V!H6jkjWH zq6rO2P4EA8dCMp$_VchE$HYEOFaBB&%(*9w5PE@c=q<`a1QOiG>lT%f2w2!p4xeJP zDa?Q6Vq;}c&wDB#Zyu@E`4aee^t_S=X}wr93}ji*6KrKuduMh9Up&q#;^52Yg{ckt zCWJQ9sEe?chTMnlq14IfEOzud_52pH+;@LK_rcx1rRLLxN|gaMqn}ymyvHW{7GKs5 z3Kv-Wy`EH`W)i#z)Rir`!MEzGgyY0ayd*0w(gcT@en|+UNj-1RfIX={14DnImB)T4 zFk!0W>kToNL~oTI{U-8E(9`k*g=-zD4^+NaWCWFK)Xa|SK;9$6LwkW6lX#Eo)7!3u zbu5hKA@FQ?uhe5Ba+ZotYy((hNA@;x3v)`A@twDv307*ZEV`W7mZ?jq?mI zu=oc;ZGd(gGa-xa8GHV=#Q4V8ym@;__BSrd2D%xwFQ^~R3-+EMJHm$G>}D9|1gji1 z=(O(lxK;zCde3yTouBx<3xv6SzZ%~4+SZ^z%|4qvrd!6yRRu4qD;=6khtmfhbB^E& z!XF47>I2W@V=^c>(V3Uft|I}I>UXF*`39hupxesiDt^*F_CD#Y)~g~i6sL_9rBDM$ z5lBwSV~GAaDaS^`F|6PMoGyLeQQ39hzshchCli$bt+39aaGCLl0TJ)FTpZo!c zq&!dN7?drb;6X6Llyh?fo5rpF#GCOdvzsO5LZo|wa~ufsWfZ^+T{s@o zMznH0!J2SidK!whGgAngk@Zhtthxrm$zO=W8HkubgS z-EM{@e_vCH1cs@<&KwB6Fj_7q>s0^VbR3RFp6GMO`Hm3fSMtY#*V4uc&X%rTZ1SHR zl1Z=2pZl+Zos66wwxI5^9{;UMZv3o`V}04N0BW1UnF^TkbIoIu8>2)~1^=+RD~*r6 zM2fiuy7e$RcFYh(9N}UNHZYp^Lt^UlJLq6Mk9R$_b;H;1R1be4GMU4Ldjmyf{9PyX zMT6SQMr0Usc?g^U$UOGaF)H&z6Njauu7nSazYPjG%(J&hi0LajS*Ddk23yzV_%_dd znie^L3J7Qmdj3_-d5UDRMlQ?8g-2su*q&9sR=dg;X4ya{(cn%u`4F<=tgjWH)QIU( ziPUCR-XyI*?)A>n*YAW*=j4spb2WY#EJX0_cm}8BOP+vv?*#A~xQ$Oj;LC~n+Q}nO zAx?^Qz7v*X%Uh&vL^jWJZnTJH`%CAeRFX$yjQbMJ-&h|7i{T9gZq~B(*sRF#``p0? z-3sBJL;k%?dI7pMr@xSahW**+)J}zXl`gA^-J7f@pO|xD)9?#ZD-qb4Qdl0g zSa~VIy^)`KeK=2es_&`Jra#0IXs)pnHAu&fy;W|t$+ zFg_R{^`OSyDiAFu*z1W06>lDY%1!g*;HmS|yIrM9srxK8R%E|+C=FRgn*zNbf5>tA z(2Ox%lBA*C2D9|)bccj-N0;x-1+0+&FNGd?i~T*s?D|jdQa+vd+9gbleeX#Xv;4w7 zIEuGhd?x@u7QgMHO?mA$G&dUP$6Qy$DN1ofl&&Sa;Ui`XVxDIi855m+&E?TW>VjV=5hp=wbj~L+iXa49N6Q1D> z--bu%=lsEoydFTKLgQ`G<54=a#0cN@uX|D1Ga(u#--RrYO?`gA$dZqr1*(u6=kaP%y3d0gf5n$SYpTjeI5z76Skp17qGQmUIQ-v2JGXy``okabH4s@8=2%VCz$D> z*S$;saumdZqFW&1_Rm{MTDc`6qD0|4o39it8B!v(j;Tar_m-Pinm=J|d{dHJuG_u| zY7^Ul!FZtag24qX+AGfJ{`tv3=cyC;M_9Vxf}IFbR2Rdi{et@3)dtNWOTjdSeQ?tj z)4lBM5)0hrlt}fn-wWLb8jFfPac-U(DrLxvx><{h+Y8*4RqFyZtn7l{yD}wp2%-?4 z8eS-2k#j^}(2jVs^s@NfWtJH#Vdu5&*3u|zBk~TDu)Ob3kR4yY-W{hRu)T{>Nn46Y zHq?*eBQn-rhV-wEa^br@{DVxs3loAHmt`IewJS9>e&imVu))W&P?2XefvJ}J`_QBi zL*5{HNQU{;8M=DpzDP(&XrwNc4*+2~N+{&9R36Yi{5bt*w{xST`d4Isf%GiqmHY zK~LEBfq~`E!435MBgl!4V){&FA$@$2)npR=Q|x&yuLemNUS}rfTB>`1k+#h!(TdPt z6yy2Tq;Ef1!tTjr6}cbiu?i$R6ucWsxEHdB$EHWD)+3NDJ89VGGra1KLH#OfY~>!x zj%D-TI}LIzYDZX=W%I+_`nh(l&gSPY8Y@ltwQQ&(jQb{H~P zX$lAL4N8Wic^;#%B|JP4Zc%?97tP5W6?8%_iDVqs3e)2ME4RT4CFtJ=V;>#PL!Ax4 zY8}EeVUk-0GCuc<$H|LewXrgZ!J`F4y7L50J}VcWWAnykqnqU7%2lg*m^XZ~>V%ss7{rbU+eDox8U z+0SD@!Bga_O7;H?+K8bv=>ThqUOz7r$+#)mTffa<`d4Tc?PT`F?QFQe>x> zz`vBu?D;fTxk!1wCw7&_*m;Mh7;D>DH1}ZV_3hh%iJyM*@;d~`F4*eLXdTtqfr8$hZ=>I=ybm#E1K9nw zFEy(B?*jpg9ZRptW{T9~7JxYq{y6IR5gx+-#~tk>rXY?%63wn}<|1(-JQ$-qg4;Vn zpx%yi(e_h-_r?D3GlF7rg8vqjv84u~`mweLu`0QrlOZ>Mc!~fy18sPTpxf2PdQ93O z-dFd*Jju7Hy!$Rit02*$h8F@AZ1gmxR7)YMhN$CEJv?0jTnFsn0C5sjlXV|NP-#7a zl@sX%`4QZIkbO(E-%b~Io!=D=k*cH@O3)RqMW)Ue?jj-7tyIK4fs&GHd90E(vT&u3 z8$V)?7B^t}Qv#9hQ{aBw;q)y}U}&+V=B19QBB~=1kX%5! z?F(j?zU4jdQ|g;kZ=ZG$$|IZyed(@57A6m3u-oMD22b?1K8livzi*5EShN$u)U(;g zzPmp$Nj)KO=W6(8K$dg!Rf%zaRI^2lkR3}EueIkRHC26ugd&!X7H%4Y)V2+lGPn)B z*uk}GaDF7{PH6G-ETj!e4Pd1iqW3Ps8(aLbiNM=ha1uT_>w+$8MMgm=IjquHq79~A zxNS?~c}m>bd^*0-WH~F~3B7_bM~^5!nM2moVdpK{vh5kN_@vsm)(L(<+-~yXy4^=N z-{EAPKKpl&`M^&dDDOqK5WGYQ zt{Q){W>S9ti1nk=RYIh;Op%$zgIf>BfeF|VzqrdSExb!r3|phcKCH8;B+bO7-Bo^P zW>*gtKplHOeBHb5ea4YUjcLX4RI5IlPRFpc8~=bip?)39lBEhA#nPG-;G0*6zOwbR#J4jkHuo&8kGPcSo6k-suOqZzGdNk(8%m8Xh@fqBr9C}8T~31@V(t5C z|E&27^J|P96FJ6*@4r*aSo~az<5pLR$*OS8l6}+$VB7cNrqNPGUnJsmo-7GDo zuLld_`?f4W1u`j-aPqCk_fBZvx@nLz?>Yc7>v~1gsWN!Mc|0Y-?Wp)3wvV9-aYzgZ zF#<3|-yf*-1%0V!RU3w(1{97ZAjVohRB5vDj;8*c>J02Wb_dW~K9)5Y)9dju+8Q$a z8^>})wqZ^n=1z~yo!!I9oI!!|tv65=#Z#5axtHo)Zm8`riWe+={(A_jaLCj4CiQ~~ zg6ZRgxPdH$-uyCZLOs!}I!t9NKZkB;r|PWkIt5gm0eFe-e7_7G-+;L|JE~pY5lR5L zpHDS?%W#dg$M2wOsGmQ=f4AoMcZ95=wtig<*L>*9|KkGSX4Ds_Sdt#mn7_XGf^jM& z_i*EgJP^dX!*OF5#tfmushUx=sKW^wk7+o3!`LP^oIj!f@n&WuTjq@vj-lDZXn@EZ~7(lp7smQrd=IW9a zhgH`KCEUHYYG6sC{P-466u@XGy3ks{-zHW&wrB<(kea zwidBZg9_wSdG!7B6xoFl$1>gOq%MR*HGY`0KEOUwldWCdbfWq!;y@ghYWr`SieBkP z*;|_y2aKjJY;jn^?!DSbQFgi062^!x!1kN>ONbnNU8zleU7aolpOf zZ0*)O^8DO}A&-{5d?e-V?Dn%S3M^snD87;%cm#DUMbQHu)B4Hu)wvDOg3 z6V^Wr&{8WN@RV9q1_+S3n`y9nd@$UF0t;>U>PtM{nD$qpezMJ}AzxY@-#ljF1==LA zRA9nwF6Pm#4vRG#XUGb>V3@WW80`to`n0)|ribi3Ij0hQ<3A zR4Od589FXmsh`0!=h{qCpS=(f)=cv=S9X+tjODpdhqWg(qp9tVoUZ|uET#hp&55u0 zQgzOC9+^6PCb0W=d#|lX6i#_9_a~(00lXnQo_qvv6Bu$l5w~F%L=4&0`065k*SjE? zQFK%{qo0ua#}!wc@vhbyYdyv{(}k|;2OpXxSA_H>QZg$J9w~~^xz5|Mqva}eY-Fm6 zM(d0$sK=aE8!f-V6*i+$N76m53+;2Lc5C@}7qtkI{avlY4J{N&QKbD$3|j7UA&!Q8 z4$D9rl>i#AY8o>V7W&oO@jy0XmCZ;o%55qGQrYK!)poWDP5&NtVNka(3E^5MDiqqO zLoUO5M2Kv6jd3@AZ7bY$@-Y#iz?!FMN&!MkvWV??BcE!Fa96#v`FHF4?BGQqeT)fo za2}?gf9K#hiA#dfAJ8L|kG<-FU*q%sBK$|48~<$p-XCemY9Lr&{X1Hi2sn;^LRK2* zpXp`Ve(7f?;&{`x%P4dhIX3aCe}@keK+YLf-l+l z#uIqI?*#azVy`j7WdlE3^_LEqw?u=fwhl|2xjNo_Ylm-Q=R#vPFCM+X9#1rOdaaSw z1j=yo9My`Djr520-|Z@-=(FO8NJRO%ox#s3wq9O|n4}?GdL=YZkx*mSzug3Eug*w( z1ts*F5|#MBCY{$SJ$dxfr`<(W$0QJ zxf2@JvAja+D}7k`Tj7kT@TPWHl)U%?6Fz(=cmKJV>^gV%|IVh!2@JSF6tN|4|2-SQ zh*x#f3{0ApKohZK8pOgQ3|QY(Z}x#lI%>jQ#{W8m^--EgWGlS!@92Ai3$w9ehkZNH zBZ|P|5;YT5s#OPk+Yuh-6pqj&X3mkpf7U4L#ay(`v+6<;C#eWOaU7*V_p~ZTmAh}1 zBjN(3X(-TrUd!JB@9kBV#bh03Djf4+yI$wWx%$=YjYr`d082SlZ32%5)s>nrEf>@v z_A?JxmX|l)B+L_A((FQCnM@)Ds2>5J62-}atrJBw2lX$sBTdOT*51vGj3kfzSQWq? zSdii=bRN_@NbDzjVHp{3AGc%u$_Vmj5Yt1tvFZhLbs|-Rp3)@z;0tN=oM_C~$^3E`l?;3`iN#9SZa8RFJ2@C@<7uY*~ z(#9#YFVx)WH+gqFU6rPiw#QfI%*;XHHcC>3RwKyQ=d=;jmwAEl^`=^JbW^z}pb}{P zW+tl0Q}AUjHoR$`)9wy9D{Qn!LxXMX3I2Zg#4X@f#3eUG9uCk0_X~b7K7#I1(Hy&X zUGy@IR(^z81EhiM7w;^V+P}3W_Y?LtK3-o&+QE39I8mer$k_T@p;kQ(_mz;Ow)Y?_ z$F{GpN@LKgJetS^mi{jrsa#+#C=FXk*8o>0;D|5Q2s}eBE{-1&ppmCNl1mDDghG7~ zp)MDZ$la$FA5=Vk$mm?)!3s75VDh3KBX*Y!qYZ^->}GzPc1}X)gxus|lbUJD@Fl)n zzEX`^fBW<0ZkU6{%jIdYA6%7=xx2ew0q4Tf<}cicLgIn`=0f$`6OoJV#Fp2)(alc@CvJavK+Rc)>mCiYmgTPZ^vK$r#9HNj*F z=Yvx`x+Ap<^eVUHau9fI)FoKP#T!`fTC);_2bwjugCmB!+nBV_7ekZ>>u zpNk5oUaHQX=uM3)%i;#jouwL)#74@VyHIO0==o{LACmAi&NZAZW{#mhhY_@! zc9e1Pmg-RbuH&@l;@I7VM{U^Muo-nINRLt!J<$E#7qD|=jIH*YcEuF%=Q!S8G6ezm-?m+x&KWj`sb3^CeGzY5A&L% z3FL9_+0Z5ft`IF%EI{lrUqu+euJz^VsZn3;&dNSv1jJ4t0f`hM6BBRk`=A0Rcu>sRA%;wm98T)__@NQJnrk^l|DSx?S^SZ#^w34h{gl!`GD(QFLx^{B9}j<8gU;Yhr+_ETw%Xx)PV_-a-UJrzoD9=avv{x3q2H&Lr9?z!3{e7Bd&?a* z+&OpwqO9*J&mJ;9Rk$^6H60kF2+&a5guT+kyj}31!8jB!OLZ{pNTB$C{d>10=nI5- zd}ZlP>|TqYW|8YC6)afXV7SYDgeRo2_&q7+y1-&hD57@Ozx!93qt-WioMHt3j@k&l zDJ4!76LtDT6R^H;Akj`0)1m9j|B+cXreVe3>lLEnGO0iUz65y7-$jfu#8g{48!&7o zs~Jb+KVSZ;$_3%=v0ulI(C-SPDO2A<+-DiDWUgJ9?v)h}AB%i?xN@SPhaE2X>Qg3t z=LXosE9)Z2;SpwN!z+lawz9DgN>xyf#&{ihGK`Q^C)76To^~aK6Ka^BIZ2UC+&Y2) z`h_!b#5X?z^*?vtsPP=Ldbm?I&{u%YrK;gHAr{fe zMy<@*&86pkOs>{zUF%&s>`j*=pfM#D%yJ|M_RuJtM z6cTq!j+x@RxdM~axu#T>0-Cp~j&W*e(7iD89%=rkP4nYpwVTpJ+KQC96r;Z(K>_zN zrlc+}*m9V1_m%>m;hH~TM$ap%Re1or0gNMZqTY^;&#}PgGHph(FGTvkZqc&c8282A z_F`t-pGUnzyUR6gNFU&jn^K@#uIpo^Gd$}2FkS17fE`1erU08NQm(G*X?X9EUkV4U0Jb)GDKlx>Rd z!v@K#hfcxjb29dAU!8ym&MHrUTFz*fY(9066U#s~J8Mme%nACH57e$Sm zVPvUKDDOVtuPV$lOY&}8y>Pt$eE9(LyUVRDk7mjD+*v5FSgT#-4k%&jipWHWndVFlLi_V- ziYAgl%xtn3&J)gx1|aKs_(?O3nfHnDAccq~&>@^&NQ)c2*q4;V4D;C&dfuNV2BuBz zT${w1=12_~IXG_y+Ovv@>BOlFWBnTbI^17;Zd#ahkS;ynU2Yt%F;@1Lt22%ohwCmi zd_^oKSnJEMWaWr3`?J(@s>7QP9Qv z;;0<-cBsYGgUE>C(~U?%W*|Jy{;9qKim;$DB*dfY6ABjKD?E&uXn*oCXDW17Kwe=7UYiFzAN7%prH$WyU${Nt7($uaJb}9-m*k?Zh*-gT>Z5tSb@%XQGl&*LD z)#8?|SF{;F9cj2tXHh(S{T+1MMSf37uYtG#01Gd&L!u|nb|QwQm<GiM4~R7 zdogt?=2-|25;`nLgymn&`~etop;UGPw6&Sb6w|v>(7dRt*1TB@bJAH%av94??9`*36nc0MQERGtz!5uF~ zwHrU&CHq_jJ^aU(byb(YM?W4?aHH*gDJ5htl+Js959lD%k{HfUV-NYz$FQ>RaQ{wy z(~@+2!A+SK*w0Yrn~Xu~4!D0*HFy0~{RDm%oSv2NB95Q$(;gu#7x8X1i7ZVURzYEa zttJOsvCHhPfBj})zi-WXf(QMjL4q?*WQ%n}1ue!RSfCJWw6#vr)YoYe{NZ?etN3MX zdLw(LKIbl50a;?M_aHZvNB=B@Z+8fIcoH`5W%QM(e)^9gOjKYe{aNOro>H9{$$RL> zAnX<5EL(KqCWmAW;!np0Sld#gU7sxf2<)Auhe;Y(h&lIX{0fVa(4U(P7gjY2Y7^OH z&OMS_+zY~!>{#hR9h3L*-*vp%_{h0;1vXd~0xaWW!?Y=dH45&Nee<`oIBlZUJY7?1 zeQFI~1j6|1krtYGi9azrkHrFH$1N8B-KadqGhyN_Ba`JFk?-tXdcbkEWU$VxHm0AP z)R33<7RCz>11#i7{FzOkMnBVQJ$f;w!QX!Kx=d zu)SZZtjY*F!5E3;MD#-wPkr1_mUDn@PJy@O)nZ!E+x^0C-$yg|ZuC5uzoX>l1%yXL z8#bakmoPY2+x!RA3jUlx4uPnwM%P}t(&T2!RuBHwV>Yzq(M15h6>i!&D-W|z*%#Q} zctBP7BKPLu?EnO@z;*|?`EeBJ_cGt(7!jN@y-y4dD zJ3Y)R-oO`k4RbBgSgQ7bZ(MNGoGrK1`CUM(&2{~3Ulg#Fie{d|oTo}PQy{COTzcsC zhHAKJ^GA+jYE1CP6mmj@B}5ewwhe)ilrG3fh9&?Op1`@(Xnf+M1;sLN+61L_V(P>k zL3Sx~f;~gl(hm!Y(U|hjAr zBR?6$Gcu5)l~q;Mq$|_z7Jl96`fW7wvnQkbH_;D0tPee`xQaqK)FGD9ICZrt? zsJFGmN@ewz0k%STo*aKj`9z|%h1klzmCxtT3!iK{(4&;NLNQLmR^vx$O5l%J$0NkWfl$*FKsG zbHX9JeS_VA4Q+oEUkvOOHR)PN3&LALU{J`WX|W%ekQ%fOck-}jz44itGis3%>8}*v zTlT{Ysy8!r+G%a2h`OW!!FbL4@Ba%P3RUe2La_Mm!%e#M< zWOsgHCGx{82Xohp=jl;~k-wReTy^zHx$Ex}PfT{wd_?2qNrkI~!R-mz8zoZl;0r~O zW-%u{;MgtEC)6C1!J9}`3jmL|f-Fj$0WYKFGLDqBxkxC^b6@e$A}}pIBY9nqQU^6Z za_pY$_f0}Drhxxm71QGGiA! z6u`3PM*`U}&1>yvR_AXY#<8HpcGT{=)XqmPUH1 zTZvQVOPrzR!gJwGgw;zW3q8#Bg(!k0LH!L*IwOYoj%esJUM*^#`Vj#e0jaWKRqXd} zKZ{JLn`6Uf+x4m_0GF4o#OV%+dszV6Y#_lDRG}LGb_Q!`M zxxJBzX6y7c>gR`Zcb-IhLv_|K9Hc)P*4QAMoR2}d2c36xSvl^pC+q94k3CTn|4QAQ zX*zF6pFt&lHJkSQ9ZxxTTiryZ{KHw4=d|IQmz2c6MsfeTZ2V5t#31wILR_}DBGN>F=UjR_*Z ztPyX3#Wx0?+7_IscPgUa!Y4NniM_W=!yxv8LGd{hRec)h`P3Rh^4TPAgyUw7K9e`; zq{Dg}rx9-oQL^#ar?Z=fB5U~NpW92v`ZeAdSxqGKD{=jt;qoTcd`{u}q`KWIghRv# z&r&(K2D|GV)pkkv&uPm0x}Uz~3j%oM#%gw}XiYaa4W&QwCV{l?^4!$H(d}zAfJ(e z?}s^Y-#W#ksZ2~aBED_5rD-0(sfb}C!|sI}y93OdLETcCa|Xq62lgZR2j~wXH7DrP zI4r}nnx!dGBIYVp(qM65D1Zanp))H`Hf4?+U`bUsde8#MjCFrZ@6j0B$M{lp_ zt^d{yPDx#!OtTzk*nfokTZ8*1Qe2#?n@;^XZE*F8HX?Oo5Vk@^dYE=jaa5{n5}yWw z(kZHEfUxKLIY|d>vS=p8*xx#GIxHo2c{DjBGx$mMqhanE>h3BU+=OE|yAhEKbz}kV z>0XDb?nnUJYoa5G(xTmiD%Hl{mikvDwQ@R~z&UWW6vd{aysju!=BD3W7>)I{mqTx- z3y8>l5U!c1hnZQRkDa4QGN{kV(&5~6<3=_Ekr>kLCLfNyu`?c*{^Hu;f)v`4^gXaR zfD3Uk{!3l^er{ob1nPXr(l~$AWC-%7sm0fFE~^1f-|Y8$2g&;E`_yawTp*{)vt961 zI4+zrnC(oFwdwOEiuDnZP@k~m_Z>GKVwut^1_od9YHEf!RqII3M)xJlrDT&>AFgjcu}VQARM#;;e1?rL2Cb; zwAe(c|C&(MrsUjqMg?2FH6aam=yL1+52-%B2~l|TjLsQSkDUgq3c;CYNb!lJ@r*w1 z4h4LQ5>0=Hp!_Mggx*UT{>$EK8G{-sVBryl4P-T8OJGOuYS3W;`fwV29HsE^M`+YX zoV3|b%#?9D+@uFXjLdrtCKD|w8B4?=@hbvo5PONt{`19f=Vf$9 zsn!N~go!2R>}fzGeG2bxiw=@R`^DArrX05^p!5XT;qQ)&W1wAKbzd4It$6>0NBec$ zR(?Co6*W_%r^Ea{;h&2uqw)7YXU(NSbj`|cJ|@12JzS8vePHUM=%C`0<2ax>FrQCm z35M{&n}*jluc+`cHgYWS*A;b$?^uR}2^>5{B3uU%1K!qWH%W`7hT~r%Nm8`X4$a*j zaW(x;&?iE?WZ7DL$oAB|Mw&?QmK+*L)L4YfuJ=s`dbWA0NT$HEb%9S#(%SakdWv0h zAol6NFSFo6a$3fFiKXs#e?nGBbtLVfC@IyGuf1wqdIhAdyZG}e1vjz<=#khY3y$@h z72JH+5cN(~`+^pxpx+mbL=5|LjjM&=3h7b7iYmPA*YZi-CQ1PziTVn!y;nr~!0fcr-Ti{+hb$WrgzPAmuch9bDa_YVU@evp2T zVZRgGHMEq)XNJ$>YYR?{mccNl?ghL>I4hoBPGYshKFDa1 zQVUj`M=JB7x0g`VW4KESl#hn-%NhCfG1nDhxe2P!A?J#OggkWFufn*zrF^bnxWc7( z9HgcjZ1uOOPj9LJPKB}qT;7U7NQd9xW)()P%VU%oa#9$Z)CO)H{;LBb^$v_TNkrDN zd0%HNo-)ZqDpwaOcH?{6Wu;cnVW3XCel~m_==ptK3|?P^xRI|A>L(AqV?zxst;h(P zXFIs_#}hV_Nd5%&22|UHziusc{?gRIKYMClAU#7AgCJiG!$n(pX7d-Tq> z#4c%);cJsZzq@-O{5z?)et^A6*Z=1NVDM?4o6h05w=%*)>dpe7*Y}j|T9=^i7QOi; z_zwFwmQN;Aby-%9)D&@NhZgRWRYWc<>b)UkpAXN)i7k+8w|pEx_XnA<(kNdkdFgQk zbOhsaRCn!-285JJSb~VK&la%<`D2xl0QqGqb4ls)bcTPFd?8yDI^jOry@`NSe2-^l z#aj_e1R2Exf;vA9w!)(>>zFy-8gEvX0C9YMsprCy=~zbt!?$&bqR3Ilpm8HK5Ta=& z`OzipbGnS=q)I6cv`7HTfw%f~cIlhzI>jTr{@iD+^f+Kcyz*TcLeutBxznJN7Y4jP zr0sX8S?qGS?=0?nL=%_HuYyFdqYvRV=^a}kpZT6w15bqtdSUeT`6$(O%55J&Ss-fN zd{NxONFCEL_h#eOO#OsH3iX9^|01u9p`X&rXs%BZT~z#R4X=*>(& z8zCrC;@|NVOnw7ACa-AE-J2J^`g)aZzFJ}HJnysyq4YV93#C5pXBpo&ARg~_Iy(Ot zWTA4l{wsha;=C>9IY$APtEkBPN)9_)H89Ugik2St=?o@XcVKD2XcX~`xI$WGnoe_DiS=#{jMP0Dd)Zkj@Lv}`Y< z)Xe6-1v9Jvsqa=+XIA&Mj+O|ewarUveoA9z;psskN^fx6OOvl@TLwZZx)Oyy#C>`d zWPr7R8HC@`a8!3!&(*4I_RtAJ(9HDa|OztGH>3F!b^rsMRWFp|2uFVlHu z&5g8AB%h$IZ#1g$bf^9D&_!8ohGXH6ZT}2`dwIj*t7{S$>~%rB{)X+mTnu@?%vDMt zlq)h!HXlHk#`@GgV%cc!nf$f5a^^j!MGN%+0MZio?j;afq~Iy?pyYWvl~T^zS3~bN zV`{FiV3Iyc@xCGze-YjuV1nfXZtc7 z_mp(ypUy{}c;?l>=@kkDEQ7THvxrOw$F!BTj&eVsqicDxc~q#B8!?4Y;m^69@6V&YPg zfPgxI6x)=5giykBuBGA6viYSVHVGE%w{c$#8EP;GtNsJGkP6)R-&YbCkm=eTrE&#)o zM%475uejQg_#qxqxD;^0KJu2~O7SV5xn}l>w!%=PNcwe7o?sbG4_cf#9J+8wbmw5yicYwt!UWGS>Sx?Z zjI$clZWVwrhT5oA(mjD8L0#hmD;B}V4KCnh|IDNJBG~n-E7EgRh7NAg2mLDgvlQ5o zP+=HJvhzEeOWYE8hWqWQ`gdJRX2d4+v@(j75~k$Fy0Aagjw26a+BhRKOi57+O;V)! zACS;CxewixMFy%V7>jQ%6X2zSJ4KkN*~nGK}%Yn-l7i!HB^*0D~4Dl7`f7a?j5=RZJ3ma5~lm}SGZ zZ^M+@Fu2VfxheF#mt9Rw4DcjOzs3ddSF(AMKomr)AYKBjrr98<|Ajl>lqx^t?BV8X zVjaB1E`aH)$u%Y-C_N_;`{F}ucaRO7@ap;X?cig@jD-x?Pz6)11w2Y75I=zFjILI4 z3KkY=)wam3w6$I-^nzs(Ubiq?K|yn;1NF5s`i#RpE%yTvUFEgKMwbg<^X3M9A(E^dI3;-yQd|DSa7+lz z`VIUBS!`C^kq5Qh{+(<50#>7Di>%^hrd{=^955~fe=g8rm_W3D91FcpK47YK73=gLtah{1ZrTNbR3L4nP<_Rl z2Pw6nbUVa=z}~{@vggM`l8EVLYG#}|hWWpm+=N3tmUx^ed8?a3x9y8sJ^~Nhp_7KF zRVV1vHNxRXnP7#CEO9zWgAiyHYgbcdwv`EX0(}E zn8Z?Nd66Vu%fhFsqP&j z!>DRge6HhpUxMFhN)fzf1G9V+5I&q3h!P9Rf^WR=e$xQ=*8}flY1eX`Vp>n-3){&D zKdgXs;=L9YT|)Wz<~PoB7O+2p1`<%!lWs}dqZtj@6!=B{2;*icb> z>h{LFcgUHZWODfkUQXuHXW7=IEK^^l)>Lg`3J){xPx~Ap)LB$v*Bf^)R~6^@hOo)f zyd|jaU!BpR?4AWjLq|MdrKtSaz~%dnIGt{zbD{^Wan>vri+_@oygohKd8D^@)9cr& zZsn;;xBJ1K4e)Bcex90}hR4URyrQqru>)Hu#atX4;9DML9g!CatAjzniwRAJhdT;&+wQwKB9U{U($n2d!@=FbxMLgp1jBus6|^ zKb{Xl|CW}*BN7#{Oa8XQcM+P{;jfv}ZGP+i(NyV}Ex&I_v-`jE!gR3R<)GtL@+M~y z%!pLc7q)U48=7Wm#bz)X^RWQPZ@y`b{itufGu2usRrqre`U6O|oJcA^KM(>>V_~kq z1q`Y%`tO3`V6$b?s6~|4t$xv=xJg3e7HmHsE8h&xkiWSPEo^WMsmkHQnVrv=-Oqq( zbUMi8$Zo%!FeC~ViOn8(mT$L3ue`~c41Orw`AYhPFl9Au%K)Ghd44cNSTT_zU^ho~uRt^wPImbaaz`Gu$E_yr z((V%i2))@s&psjQVB~Z(z}edMi^l+p-GpZMv6F-4t?UMDY9HEy$7!3ZCtCeAX#QzR z%Y#p+hcC{BVJEOSqWn6O^GlYzH$QJxfRxbpNspsvAlGJE_F5KU;5J6>-}EvlQ**8K zUY^TvG$sD~3fq=xD9_c>hY(Y}$>+1~Oi$&|XA5^{cwHsZytytgUN*DPt5EZC|Ag>O z5emH1gwD0V7u5p{nbJ~U+(kX0g@+%8)IXY;a0?*(>3EqBb8pHvh{mmRs*mf>4K0JmFJf#MQ3(R9HgJ!%B^n)Is<&zLLNKz9qXH(@fM^jPS-4SOi47 zG}=6J4#}7-bcawQa<;$UBk*!UjjT{862|z2^pi02&9$UPcLVJ0T_rr=EHSz*$N4JS zSh_$NSQxqPGb(ol@Kyn&dAcK)s_Sw`70$)#{h9o}B}G^3z(i?Qnw0o$9`)l&h11PG zxjlDfEHPOVXf77~UX`4zlev>w_kT4p$3LD%x&aGvs~~WIF{*b$iCj(h54NBCjYq;P zsp0laVve6esl#VNHvFTYTvv;7`K}dI-a+n7PQHo{Gmm46#|CyFuQo+vi30JZir_ht zW`-g;3;_=~Jb0VT#vzhfkJ&jyIN`E+rN+NbPPQ_AefwJ;Meo*v;ucORMM3X?Fh#zS zJJ)lP(csn}XHs*D^N+f8uZbOW3}!z6w-h41^=cq7C)D#XGrIyOCXF zxX2BT?8ddj0@1*%8>28`2poH~D!ajdPLn6Ag7 zS?9c|a6l0%KNyS){GO!578}k#{W6B08*osWTmUVyNoP3;q*y-g5I)Tid`;?7$WfDs z1qZxZB6KLsx3`@LcCK_Q^&gn#ff#$C{2Xp<ODmzzlJVl4sY} z;mlAVz;oKQ$ss z3KO=z?0#fxpmHFHbp2||tDY1cSOPGf^AReRRBT`Xnvr1~LS4bc(!fPr%AZGYY)&yL z7Fuc5{~o7uC`tzZc!1)msuvm${iSMi=7O}|bhmyw`Y9w)V-@AJ-cAZWgRl%qBXvC(TC?qH=cfq)BCI_s#5dxUOZ+@P%=> z_P5?n+vnM&Y;^SAl%rHt77v$EB2hW`koBs}n4cnJyprVXKd6vNOSn9c>>8|5;&fMZ zs%0nY1*olwY53$-FLdMgm!=zR8w~H2Ijx-GO@ga?3gvdlf%vSMBG};R0QSFtcMxU0 zw - -To configure a Talos you can use the metadata service provide by Equinix Metal. -It is required to add a shebang to the top of the configuration file. -The shebang is arbitrary in the case of Talos, and the convention we use is `#!talos`. - - - -## Creating a Cluster via the Equinix Metal CLI - -### Control Plane Endpoint - -The strategy used for an HA cluster varies and is left as an exercise for the user. -Some of the known ways are: - -- DNS -- Load Balancer -- BGP - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Now add the required shebang (e.g. `#!talos`) at the top of `init.yaml`, `controlplane.yaml`, and `join.yaml` -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -talosctl validate --config init.yaml --mode metal -talosctl validate --config controlplane.yaml --mode metal -talosctl validate --config join.yaml --mode metal -``` - -> Note: Validation of the install disk could potentially fail as the validation -> is performed on you local machine and the specified disk may not exist. - -#### Create the Bootstrap Node - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file init.yaml -``` - -#### Create the Remaining Control Plane Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file controlplane.yaml -``` - -> Note: The above should be invoked at least twice in order for `etcd` to form quorum. - -#### Create the Worker Nodes - -```bash -packet device create \ - --project-id $PROJECT_ID \ - --facility $FACILITY \ - --ipxe-script-url $PXE_SERVER \ - --operating-system "custom_ipxe" \ - --plan $PLAN\ - --hostname $HOSTNAME\ - --userdata-file join.yaml -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.10/bare-metal-platforms/matchbox.md b/website/content/v0.10/bare-metal-platforms/matchbox.md deleted file mode 100644 index 1bff379bf..000000000 --- a/website/content/v0.10/bare-metal-platforms/matchbox.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: "Matchbox" -description: "In this guide we will create an HA Kubernetes cluster with 3 worker nodes using an existing load balancer and matchbox deployment." ---- - -## Creating a Cluster - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing load balancer, matchbox deployment, and some familiarity with iPXE. - -We leave it up to the user to decide if they would like to use static networking, or DHCP. -The setup and configuration of DHCP will not be covered. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the load balancer, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-metal-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode metal -init.yaml is valid for metal mode -$ talosctl validate --config controlplane.yaml --mode metal -controlplane.yaml is valid for metal mode -$ talosctl validate --config join.yaml --mode metal -join.yaml is valid for metal mode -``` - -#### Publishing the Machine Configuration Files - -In bare-metal setups it is up to the user to provide the configuration files over HTTP(S). -A special kernel parameter (`talos.config`) must be used to inform Talos about _where_ it should retreive its' configuration file. -To keep things simple we will place `init.yaml`, `controlplane.yaml`, and `join.yaml` into Matchbox's `assets` directory. -This directory is automatically served by Matchbox. - -### Create the Matchbox Configuration Files - -The profiles we will create will reference `vmlinuz`, and `initramfs.xz`. -Download these files from the [release](https://github.com/talos-systems/talos/releases) of your choice, and place them in `/var/lib/matchbox/assets`. - -#### Profiles - -##### The Bootstrap Node - -```json -{ - "id": "init", - "name": "init", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/init.yaml" - ] - } -} -``` - -> Note: Be sure to change `http://matchbox.talos.dev` to the endpoint of your matchbox server. - -##### Additional Control Plane Nodes - -```json -{ - "id": "control-plane", - "name": "control-plane", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/controlplane.yaml" - ] - } -} -``` - -##### Worker Nodes - -```json -{ - "id": "default", - "name": "default", - "boot": { - "kernel": "/assets/vmlinuz", - "initrd": ["/assets/initramfs.xz"], - "args": [ - "initrd=initramfs.xz", - "init_on_alloc=1", - "slab_nomerge", - "pti=on", - "console=tty0", - "console=ttyS0", - "printk.devkmsg=on", - "talos.platform=metal", - "talos.config=http://matchbox.talos.dev/assets/join.yaml" - ] - } -} -``` - -#### Groups - -Now, create the following groups, and ensure that the `selector`s are accurate for your specific setup. - -```json -{ - "id": "control-plane-1", - "name": "control-plane-1", - "profile": "init", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-2", - "name": "control-plane-2", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "control-plane-3", - "name": "control-plane-3", - "profile": "control-plane", - "selector": { - ... - } -} -``` - -```json -{ - "id": "default", - "name": "default", - "profile": "default" -} -``` - -### Boot the Machines - -Now that we have our configuraton files in place, boot all the machines. -Talos will come up on each machine, grab its' configuration file, and bootstrap itself. - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.10/bare-metal-platforms/sidero.md b/website/content/v0.10/bare-metal-platforms/sidero.md deleted file mode 100644 index bff69c31f..000000000 --- a/website/content/v0.10/bare-metal-platforms/sidero.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -title: "Sidero" -description: "Sidero is a project created by the Talos team that has native support for Talos." ---- - -Sidero is a project created by the Talos team that has native support for Talos. -The best way to get started with Sidero is to visit the [website](https://www.sidero.dev/). diff --git a/website/content/v0.10/cloud-platforms/_index.md b/website/content/v0.10/cloud-platforms/_index.md deleted file mode 100644 index 3307f8f0f..000000000 --- a/website/content/v0.10/cloud-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Cloud Platforms" -weight: 40 ---- diff --git a/website/content/v0.10/cloud-platforms/aws.md b/website/content/v0.10/cloud-platforms/aws.md deleted file mode 100644 index 5ce60f4a7..000000000 --- a/website/content/v0.10/cloud-platforms/aws.md +++ /dev/null @@ -1,261 +0,0 @@ ---- -title: "AWS" -description: "Creating a cluster via the AWS CLI." ---- - -## Creating a Cluster via the AWS CLI - -In this guide we will create an HA Kubernetes cluster with 3 worker nodes. -We assume an existing VPC, and some familiarity with AWS. -If you need more information on AWS specifics, please see the [official AWS documentation](https://docs.aws.amazon.com). - -### Create the Subnet - -```bash -aws ec2 create-subnet \ - --region $REGION \ - --vpc-id $VPC \ - --cidr-block ${CIDR_BLOCK} -``` - -### Create the AMI - -#### Prepare the Import Prerequisites - -##### Create the S3 Bucket - -```bash -aws s3api create-bucket \ - --bucket $BUCKET \ - --create-bucket-configuration LocationConstraint=$REGION \ - --acl private -``` - -##### Create the `vmimport` Role - -In order to create an AMI, ensure that the `vmimport` role exists as described in the [official AWS documentation](https://docs.aws.amazon.com/vm-import/latest/userguide/vmie_prereqs.html#vmimport-role). - -Note that the role should be associated with the S3 bucket we created above. - -##### Create the Image Snapshot - -First, download the AWS image from a Talos release: - -```bash -curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv -``` - -Copy the RAW disk to S3 and import it as a snapshot: - -```bash -aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw -aws ec2 import-snapshot \ - --region $REGION \ - --description "Talos kubernetes tutorial" \ - --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}" -``` - -Save the `SnapshotId`, as we will need it once the import is done. -To check on the status of the import, run: - -```bash -aws ec2 describe-import-snapshot-tasks \ - --region $REGION \ - --import-task-ids -``` - -Once the `SnapshotTaskDetail.Status` indicates `completed`, we can register the image. - -##### Register the Image - -```bash -aws ec2 register-image \ - --region $REGION \ - --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \ - --root-device-name /dev/xvda \ - --virtualization-type hvm \ - --architecture x86_64 \ - --ena-support \ - --name talos-aws-tutorial-ami -``` - -We now have an AMI we can use to create our cluster. -Save the AMI ID, as we will need it when we create EC2 instances. - -### Create a Security Group - -```bash -aws ec2 create-security-group \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --description "Security Group for EC2 instances to allow ports required by Talos" -``` - -Using the security group ID from above, allow all internal traffic within the same security group: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol all \ - --port 0 \ - --source-group $SECURITY_GROUP -``` - -and expose the Talos and Kubernetes APIs: - -```bash -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 6443 \ - --cidr 0.0.0.0/0 - -aws ec2 authorize-security-group-ingress \ - --region $REGION \ - --group-name talos-aws-tutorial-sg \ - --protocol tcp \ - --port 50000-50001 \ - --cidr 0.0.0.0/0 -``` - -### Create a Load Balancer - -```bash -aws elbv2 create-load-balancer \ - --region $REGION \ - --name talos-aws-tutorial-lb \ - --type network --subnets $SUBNET -``` - -Take note of the DNS name and ARN. -We will need these soon. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-aws-tutorial https://: --with-examples=false --with-docs=false -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -Take note that the generated configs are too long for AWS userdata field if the `--with-examples` and `--with-docs` flags are not passed. - -At this point, you can modify the generated configs to your liking. - -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the EC2 Instances - -> Note: There is a known issue that prevents Talos from running on T2 instance types. -> Please use T3 if you need burstable instance types. - -#### Create the Bootstrap Node - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://init.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-0}]" -``` - -#### Create the Remaining Control Plane Nodes - -```bash -CP_COUNT=1 -while [[ "$CP_COUNT" -lt 3 ]]; do - aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 1 \ - --instance-type t3.small \ - --user-data file://controlplane.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP \ - --associate-public-ip-address \ - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]" - ((CP_COUNT++)) -done -``` - -> Make a note of the resulting `PrivateIpAddress` from the init and controlplane nodes for later use. - -#### Create the Worker Nodes - -```bash -aws ec2 run-instances \ - --region $REGION \ - --image-id $AMI \ - --count 3 \ - --instance-type t3.small \ - --user-data file://join.yaml \ - --subnet-id $SUBNET \ - --security-group-ids $SECURITY_GROUP - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]" -``` - -### Configure the Load Balancer - -```bash -aws elbv2 create-target-group \ - --region $REGION \ - --name talos-aws-tutorial-tg \ - --protocol TCP \ - --port 6443 \ - --target-type ip \ - --vpc-id $VPC -``` - -Now, using the target group's ARN, and the **PrivateIpAddress** from the instances that you created : - -```bash -aws elbv2 register-targets \ - --region $REGION \ - --target-group-arn $TARGET_GROUP_ARN \ - --targets Id=$CP_NODE_1_IP Id=$CP_NODE_2_IP Id=$CP_NODE_3_IP -``` - -Using the ARNs of the load balancer and target group from previous steps, create the listener: - -```bash -aws elbv2 create-listener \ - --region $REGION \ - --load-balancer-arn $LOAD_BALANCER_ARN \ - --protocol TCP \ - --port 443 \ - --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN -``` - -### Retrieve the `kubeconfig` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.10/cloud-platforms/azure.md b/website/content/v0.10/cloud-platforms/azure.md deleted file mode 100644 index 12786ad58..000000000 --- a/website/content/v0.10/cloud-platforms/azure.md +++ /dev/null @@ -1,282 +0,0 @@ ---- -title: "Azure" -description: "Creating a cluster via the CLI on Azure." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume existing [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/), and some familiarity with Azure. -If you need more information on Azure specifics, please see the [official Azure documentation](https://docs.microsoft.com/en-us/azure/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_ACCOUNT="StorageAccountName" - -# Storage container to upload to -export STORAGE_CONTAINER="StorageContainerName" - -# Resource group name -export GROUP="ResourceGroupName" - -# Location -export LOCATION="centralus" - -# Get storage account connection string based on info above -export CONNECTION=$(az storage account show-connection-string \ - -n $STORAGE_ACCOUNT \ - -g $GROUP \ - -o tsv) -``` - -### Create the Image - -First, download the Azure image from a [Talos release](https://github.com/talos-systems/talos/releases). -Once downloaded, untar with `tar -xvf /path/to/azure-amd64.tar.gz` - -#### Upload the VHD - -Once you have pulled down the image, you can upload it to blob storage with: - -```bash -az storage blob upload \ - --connection-string $CONNECTION \ - --container-name $STORAGE_CONTAINER \ - -f /path/to/extracted/talos-azure.vhd \ - -n talos-azure.vhd -``` - -#### Register the Image - -Now that the image is present in our blob storage, we'll register it. - -```bash -az image create \ - --name talos \ - --source https://$STORAGE_ACCOUNT.blob.core.windows.net/$STORAGE_CONTAINER/talos-azure.vhd \ - --os-type linux \ - -g $GROUP -``` - -### Network Infrastructure - -#### Virtual Networks and Security Groups - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a network security group and add rules to it. - -```bash -# Create vnet -az network vnet create \ - --resource-group $GROUP \ - --location $LOCATION \ - --name talos-vnet \ - --subnet-name talos-subnet - -# Create network security group -az network nsg create -g $GROUP -n talos-sg - -# Client -> apid -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n apid \ - --priority 1001 \ - --destination-port-ranges 50000 \ - --direction inbound - -# Trustd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n trustd \ - --priority 1002 \ - --destination-port-ranges 50001 \ - --direction inbound - -# etcd -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n etcd \ - --priority 1003 \ - --destination-port-ranges 2379-2380 \ - --direction inbound - -# Kubernetes API Server -az network nsg rule create \ - -g $GROUP \ - --nsg-name talos-sg \ - -n kube \ - --priority 1004 \ - --destination-port-ranges 6443 \ - --direction inbound -``` - -#### Load Balancer - -We will create a public ip, load balancer, and a health check that we will use for our control plane. - -```bash -# Create public ip -az network public-ip create \ - --resource-group $GROUP \ - --name talos-public-ip \ - --allocation-method static - -# Create lb -az network lb create \ - --resource-group $GROUP \ - --name talos-lb \ - --public-ip-address talos-public-ip \ - --frontend-ip-name talos-fe \ - --backend-pool-name talos-be-pool - -# Create health check -az network lb probe create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-lb-health \ - --protocol tcp \ - --port 6443 - -# Create lb rule for 6443 -az network lb rule create \ - --resource-group $GROUP \ - --lb-name talos-lb \ - --name talos-6443 \ - --protocol tcp \ - --frontend-ip-name talos-fe \ - --frontend-port 6443 \ - --backend-pool-name talos-be-pool \ - --backend-port 6443 \ - --probe-name talos-lb-health -``` - -#### Network Interfaces - -In Azure, we have to pre-create the NICs for our control plane so that they can be associated with our load balancer. - -```bash -for i in $( seq 0 1 2 ); do - # Create public IP for each nic - az network public-ip create \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-$i \ - --allocation-method static - - - # Create nic - az network nic create \ - --resource-group $GROUP \ - --name talos-controlplane-nic-$i \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --network-security-group talos-sg \ - --public-ip-address talos-controlplane-public-ip-$i\ - --lb-name talos-lb \ - --lb-address-pools talos-be-pool -done -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-public-ip \ - --query [ipAddress] \ - --output tsv) - -talosctl gen config talos-k8s-azure-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -### Compute Creation - -We are now ready to create our azure nodes. - -```bash -# Create availability set -az vm availability-set create \ - --name talos-controlplane-av-set \ - -g $GROUP - -# Create controlplane 0 -az vm create \ - --name talos-controlplane-0 \ - --image talos \ - --custom-data ./init.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-0 \ - --availability-set talos-controlplane-av-set \ - --no-wait - -# Create 2 more controlplane nodes -for i in $( seq 1 2 ); do - az vm create \ - --name talos-controlplane-$i \ - --image talos \ - --custom-data ./controlplane.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --os-disk-size-gb 20 \ - --nics talos-controlplane-nic-$i \ - --availability-set talos-controlplane-av-set \ - --no-wait -done - -# Create worker node - az vm create \ - --name talos-worker-0 \ - --image talos \ - --vnet-name talos-vnet \ - --subnet talos-subnet \ - --custom-data ./join.yaml \ - -g $GROUP \ - --admin-username talos \ - --generate-ssh-keys \ - --verbose \ - --boot-diagnostics-storage $STORAGE_ACCOUNT \ - --nsg talos-sg \ - --os-disk-size-gb 20 \ - --no-wait - -# NOTES: -# `--admin-username` and `--generate-ssh-keys` are required by the az cli, -# but are not actually used by talos -# `--os-disk-size-gb` is the backing disk for Kubernetes and any workload containers -# `--boot-diagnostics-storage` is to enable console output which may be necessary -# for troubleshooting -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(az network public-ip show \ - --resource-group $GROUP \ - --name talos-controlplane-public-ip-0 \ - --query [ipAddress] \ - --output tsv) -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.10/cloud-platforms/digitalocean.md b/website/content/v0.10/cloud-platforms/digitalocean.md deleted file mode 100644 index a58db8f4d..000000000 --- a/website/content/v0.10/cloud-platforms/digitalocean.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -title: "DigitalOcean" -description: "Creating a cluster via the CLI on DigitalOcean." ---- - -## Creating a Cluster via the CLI - -In this guide we will create an HA Kubernetes cluster with 1 worker node. -We assume an existing [Space](https://www.digitalocean.com/docs/spaces/), and some familiarity with DigitalOcean. -If you need more information on DigitalOcean specifics, please see the [official DigitalOcean documentation](https://www.digitalocean.com/docs/). - -### Create the Image - -First, download the DigitalOcean image from a Talos release. -Extract the archive to get the `disk.raw` file, compress it using `gzip` to `disk.raw.gz`. - -Using an upload method of your choice (`doctl` does not have Spaces support), upload the image to a space. -Now, create an image using the URL of the uploaded image: - -```bash -doctl compute image create \ - --region $REGION \ - --image-description talos-digital-ocean-tutorial \ - --image-url https://talos-tutorial.$REGION.digitaloceanspaces.com/disk.raw.gz \ - Talos -``` - -Save the image ID. -We will need it when creating droplets. - -### Create a Load Balancer - -```bash -doctl compute load-balancer create \ - --region $REGION \ - --name talos-digital-ocean-tutorial-lb \ - --tag-name talos-digital-ocean-tutorial-control-plane \ - --health-check protocol:tcp,port:6443,check_interval_seconds:10,response_timeout_seconds:5,healthy_threshold:5,unhealthy_threshold:3 \ - --forwarding-rules entry_protocol:tcp,entry_port:443,target_protocol:tcp,target_port:6443 -``` - -We will need the IP of the load balancer. -Using the ID of the load balancer, run: - -```bash -doctl compute load-balancer get --format IP -``` - -Save it, as we will need it in the next step. - -### Create the Machine Configuration Files - -#### Generating Base Configurations - -Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines: - -```bash -$ talosctl gen config talos-k8s-digital-ocean-tutorial https://: -created init.yaml -created controlplane.yaml -created join.yaml -created talosconfig -``` - -At this point, you can modify the generated configs to your liking. -Optionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -#### Validate the Configuration Files - -```bash -$ talosctl validate --config init.yaml --mode cloud -init.yaml is valid for cloud mode -$ talosctl validate --config controlplane.yaml --mode cloud -controlplane.yaml is valid for cloud mode -$ talosctl validate --config join.yaml --mode cloud -join.yaml is valid for cloud mode -``` - -### Create the Droplets - -#### Create the Bootstrap Node - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file init.yaml \ - --ssh-keys \ - talos-control-plane-1 -``` - -> Note: Although SSH is not used by Talos, DigitalOcean still requires that an SSH key be associated with the droplet. -> Create a dummy key that can be used to satisfy this requirement. - -#### Create the Remaining Control Plane Nodes - -Run the following twice, to give ourselves three total control plane nodes: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-2 -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --tag-names talos-digital-ocean-tutorial-control-plane \ - --user-data-file controlplane.yaml \ - --ssh-keys \ - talos-control-plane-3 -``` - -#### Create the Worker Nodes - -Run the following to create a worker node: - -```bash -doctl compute droplet create \ - --region $REGION \ - --image \ - --size s-2vcpu-4gb \ - --enable-private-networking \ - --user-data-file join.yaml \ - --ssh-keys \ - talos-worker-1 -``` - -### Retrieve the `kubeconfig` - -To configure `talosctl` we will need the first control plane node's IP: - -```bash -doctl compute droplet get --format PublicIPv4 -``` - -At this point we can retrieve the admin `kubeconfig` by running: - -```bash -talosctl --talosconfig talosconfig config endpoint -talosctl --talosconfig talosconfig config node -talosctl --talosconfig talosconfig kubeconfig . -``` diff --git a/website/content/v0.10/cloud-platforms/gcp.md b/website/content/v0.10/cloud-platforms/gcp.md deleted file mode 100644 index 02ba857c4..000000000 --- a/website/content/v0.10/cloud-platforms/gcp.md +++ /dev/null @@ -1,177 +0,0 @@ ---- -title: "GCP" -description: "Creating a cluster via the CLI on Google Cloud Platform." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in GCP with 1 worker node. -We will assume an existing [Cloud Storage bucket](https://cloud.google.com/storage/docs/creating-buckets), and some familiarity with Google Cloud. -If you need more information on Google Cloud specifics, please see the [official Google documentation](https://cloud.google.com/docs/). - -### Environment Setup - -We'll make use of the following environment variables throughout the setup. -Edit the variables below with your correct information. - -```bash -# Storage account to use -export STORAGE_BUCKET="StorageBucketName" -# Region -export REGION="us-central1" -``` - -### Create the Image - -First, download the Google Cloud image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `gcp-$ARCH.tar.gz`. - -#### Upload the Image - -Once you have downloaded the image, you can upload it to your storage bucket with: - -```bash -gsutil cp /path/to/gcp-amd64.tar.gz gs://$STORAGE_BUCKET -``` - -#### Register the image - -Now that the image is present in our bucket, we'll register it. - -```bash -gcloud compute images create talos \ - --source-uri=gs://$STORAGE_BUCKET/gcp-amd64.tar.gz \ - --guest-os-features=VIRTIO_SCSI_MULTIQUEUE -``` - -### Network Infrastructure - -#### Load Balancers and Firewalls - -Once the image is prepared, we'll want to work through setting up the network. -Issue the following to create a firewall, load balancer, and their required components. - -```bash -# Create Instance Group -gcloud compute instance-groups unmanaged create talos-ig \ - --zone $REGION-b - -# Create port for IG -gcloud compute instance-groups set-named-ports talos-ig \ - --named-ports tcp6443:6443 \ - --zone $REGION-b - -# Create health check -gcloud compute health-checks create tcp talos-health-check --port 6443 - -# Create backend -gcloud compute backend-services create talos-be \ - --global \ - --protocol TCP \ - --health-checks talos-health-check \ - --timeout 5m \ - --port-name tcp6443 - -# Add instance group to backend -gcloud compute backend-services add-backend talos-be \ - --global \ - --instance-group talos-ig \ - --instance-group-zone $REGION-b - -# Create tcp proxy -gcloud compute target-tcp-proxies create talos-tcp-proxy \ - --backend-service talos-be \ - --proxy-header NONE - -# Create LB IP -gcloud compute addresses create talos-lb-ip --global - -# Forward 443 from LB IP to tcp proxy -gcloud compute forwarding-rules create talos-fwd-rule \ - --global \ - --ports 443 \ - --address talos-lb-ip \ - --target-tcp-proxy talos-tcp-proxy - -# Create firewall rule for health checks -gcloud compute firewall-rules create talos-controlplane-firewall \ - --source-ranges 130.211.0.0/22,35.191.0.0/16 \ - --target-tags talos-controlplane \ - --allow tcp:6443 - -# Create firewall rule to allow talosctl access -gcloud compute firewall-rules create talos-controlplane-talosctl \ - --source-ranges 0.0.0.0/0 \ - --target-tags talos-controlplane \ - --allow tcp:50000 -``` - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(gcloud compute forwarding-rules describe talos-fwd-rule \ - --global \ - --format json \ - | jq -r .IPAddress) - -talosctl gen config talos-k8s-gcp-tutorial https://${LB_PUBLIC_IP}:443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our GCP nodes. - -```bash -# Create control plane 0 -gcloud compute instances create talos-controlplane-0 \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./init.yaml - -# Create control plane 1/2 -for i in $( seq 1 2 ); do - gcloud compute instances create talos-controlplane-$i \ - --image talos \ - --zone $REGION-b \ - --tags talos-controlplane \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./controlplane.yaml -done - -# Add control plane nodes to instance group -for i in $( seq 0 1 2 ); do - gcloud compute instance-groups unmanaged add-instances talos-ig \ - --zone $REGION-b \ - --instances talos-controlplane-$i -done - -# Create worker -gcloud compute instances create talos-worker-0 \ - --image talos \ - --zone $REGION-b \ - --boot-disk-size 20GB \ - --metadata-from-file=user-data=./join.yaml -``` - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will need to discover the public IP for our first control plane node first. - -```bash -CONTROL_PLANE_0_IP=$(gcloud compute instances describe talos-controlplane-0 \ - --zone $REGION-b \ - --format json \ - | jq -r '.networkInterfaces[0].accessConfigs[0].natIP') - -talosctl --talosconfig ./talosconfig config endpoint $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig config node $CONTROL_PLANE_0_IP -talosctl --talosconfig ./talosconfig kubeconfig . -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.10/cloud-platforms/openstack.md b/website/content/v0.10/cloud-platforms/openstack.md deleted file mode 100644 index 3c7ac70e8..000000000 --- a/website/content/v0.10/cloud-platforms/openstack.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: "OpenStack" -description: "Creating a cluster via the CLI on OpenStack." ---- - -## Creating a Cluster via the CLI - -In this guide, we will create an HA Kubernetes cluster in OpenStack with 1 worker node. -We will assume an existing some familiarity with OpenStack. -If you need more information on OpenStack specifics, please see the [official OpenStack documentation](https://docs.openstack.org). - -### Environment Setup - -You should have an existing openrc file. -This file will provide environment variables necessary to talk to your OpenStack cloud. -See [here](https://docs.openstack.org/newton/user-guide/common/cli-set-environment-variables-using-openstack-rc.html) for instructions on fetching this file. - -### Create the Image - -First, download the OpenStack image from a Talos [release](https://github.com/talos-systems/talos/releases). -These images are called `openstack-$ARCH.tar.gz`. -Untar this file with `tar -xvf openstack-$ARCH.tar.gz`. -The resulting file will be called `disk.raw`. - -#### Upload the Image - -Once you have the image, you can upload to OpenStack with: - -```bash -openstack image create --public --disk-format raw --file disk.raw talos -``` - -### Network Infrastructure - -#### Load Balancer and Network Ports - -Once the image is prepared, you will need to work through setting up the network. -Issue the following to create a load balancer, the necessary network ports for each control plane node, and associations between the two. - -Creating loadbalancer: - -```bash -# Create load balancer, updating vip-subnet-id if necessary -openstack loadbalancer create --name talos-control-plane --vip-subnet-id public - -# Create listener -openstack loadbalancer listener create --name talos-control-plane-listener --protocol TCP --protocol-port 6443 talos-control-plane - -# Pool and health monitoring -openstack loadbalancer pool create --name talos-control-plane-pool --lb-algorithm ROUND_ROBIN --listener talos-control-plane-listener --protocol TCP -openstack loadbalancer healthmonitor create --delay 5 --max-retries 4 --timeout 10 --type TCP talos-control-plane-pool -``` - -Creating ports: - -```bash -# Create ports for control plane nodes, updating network name if necessary -openstack port create --network shared talos-control-plane-1 -openstack port create --network shared talos-control-plane-2 -openstack port create --network shared talos-control-plane-3 - -# Create floating IPs for the ports, so that you will have talosctl connectivity to each control plane -openstack floating ip create --port talos-control-plane-1 public -openstack floating ip create --port talos-control-plane-2 public -openstack floating ip create --port talos-control-plane-3 public -``` - -> Note: Take notice of the private and public IPs associated with each of these ports, as they will be used in the next step. -> Additionally, take node of the port ID, as it will be used in server creation. - -Associate port's private IPs to loadbalancer: - -```bash -# Create members for each port IP, updating subnet-id and address as necessary. -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -openstack loadbalancer member create --subnet-id shared-subnet --address --protocol-port 6443 talos-control-plane-pool -``` - -#### Security Groups - -This example uses the default security group in OpenStack. -Ports have been opened to ensure that connectivity from both inside and outside the group is possible. -You will want to allow, at a minimum, ports 6443 (Kubernetes API server) and 50000 (Talos API) from external sources. -It is also recommended to allow communication over all ports from within the subnet. - -### Cluster Configuration - -With our networking bits setup, we'll fetch the IP for our load balancer and create our configuration files. - -```bash -LB_PUBLIC_IP=$(openstack loadbalancer show talos-control-plane -f json | jq -r .vip_address) - -talosctl gen config talos-k8s-openstack-tutorial https://${LB_PUBLIC_IP}:6443 -``` - -Additionally, you can specify `--config-patch` with RFC6902 jsonpatch which will be applied during the config generation. - -### Compute Creation - -We are now ready to create our OpenStack nodes. - -Create control plane: - -```bash -# Create control plane 1. Substitute the correct path to configuration files and the desired flavor. -openstack server create talos-control-plane-1 --flavor m1.small --nic port-id=talos-control-plane-1 --image talos --user-data /path/to/init.yaml - -# Create control planes 2 and 3, substituting the same info. -for i in $( seq 2 3 ); do - openstack server create talos-control-plane-$i --flavor m1.small --nic port-id=talos-control-plane-$i --image talos --user-data /path/to/controlplane.yaml -done -``` - -Create worker: - -```bash -# Update network name as necessary. -openstack server create talos-worker-1 --flavor m1.small --network shared --image talos --user-data /path/to/join.yaml -``` - -> Note: This step can be repeated to add more workers. - -### Retrieve the `kubeconfig` - -You should now be able to interact with your cluster with `talosctl`. -We will use one of the floating IPs we allocated earlier. -It does not matter which one. - -```bash -talosctl --talosconfig ./talosconfig config endpoint -talosctl --talosconfig ./talosconfig config node -talosctl --talosconfig ./talosconfig kubeconfig -kubectl --kubeconfig ./kubeconfig get nodes -``` diff --git a/website/content/v0.10/guides/_index.md b/website/content/v0.10/guides/_index.md deleted file mode 100644 index 4294954ba..000000000 --- a/website/content/v0.10/guides/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Guides" -weight: 60 ---- diff --git a/website/content/v0.10/guides/advanced-networking.md b/website/content/v0.10/guides/advanced-networking.md deleted file mode 100644 index c1d95e68b..000000000 --- a/website/content/v0.10/guides/advanced-networking.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: "Advanced Networking" ---- - -## Static Addressing - -Static addressing is comprised of specifying `cidr`, `routes` ( remember to add your default gateway ), and `interface`. -Most likely you'll also want to define the `nameservers` so you have properly functioning DNS. - -```yaml -machine: - network: - hostname: talos - nameservers: - - 10.0.0.1 - interfaces: - - interface: eth0 - cidr: 10.0.0.201/8 - mtu: 8765 - routes: - - network: 0.0.0.0/0 - gateway: 10.0.0.1 - - interface: eth1 - ignore: true - time: - servers: - - time.cloudflare.com -``` - -## Additional Addresses for an Interface - -In some environments you may need to set additional addresses on an interface. -In the following example, we set two additional addresses on the loopback interface. - -```yaml -machine: - network: - interfaces: - - interface: lo0 - cidr: 192.168.0.21/24 - - interface: lo0 - cidr: 10.2.2.2/24 -``` - -## Bonding - -The following example shows how to create a bonded interface. - -```yaml -machine: - network: - interfaces: - - interface: bond0 - dhcp: true - bond: - mode: 802.3ad - lacpRate: fast - xmitHashPolicy: layer3+4 - miimon: 100 - updelay: 200 - downdelay: 200 - interfaces: - - eth0 - - eth1 -``` - -## VLANs - -To setup vlans on a specific device use an array of VLANs to add. -The master device may be configured without addressing by setting dhcp to false. - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: false - vlans: - - vlanId: 100 - cidr: "192.168.2.10/28" - routes: - - network: 0.0.0.0/0 - gateway: 192.168.2.1 -``` diff --git a/website/content/v0.10/guides/air-gapped.md b/website/content/v0.10/guides/air-gapped.md deleted file mode 100644 index 73a138784..000000000 --- a/website/content/v0.10/guides/air-gapped.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Air-gapped Environments ---- - -In this guide we will create a Talos cluster running in an air-gapped environment with all the required images being pulled from an internal registry. -We will use the [QEMU](../../local-platforms/qemu/) provisioner available in `talosctl` to create a local cluster, but the same approach could be used to deploy Talos in bigger air-gapped networks. - -## Requirements - -The follow are requirements for this guide: - -- Docker 18.03 or greater -- Requirements for the Talos [QEMU](../../local-platforms/qemu/) cluster - -## Identifying Images - -In air-gapped environments, access to the public Internet is restricted, so Talos can't pull images from public Docker registries (`docker.io`, `ghcr.io`, etc.) -We need to identify the images required to install and run Talos. -The same strategy can be used for images required by custom workloads running on the cluster. - -The `talosctl images` command provides a list of default images used by the Talos cluster (with default configuration -settings). -To print the list of images, run: - -```bash -talosctl images -``` - -This list contains images required by a default deployment of Talos. -There might be additional images required for the workloads running on this cluster, and those should be added to this list. - -## Preparing the Internal Registry - -As access to the public registries is restricted, we have to run an internal Docker registry. -In this guide, we will launch the registry on the same machine using Docker: - -```bash -$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2 -1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5 -``` - -This registry will be accepting connections on port 6000 on the host IPs. -The registry is empty by default, so we have fill it with the images required by Talos. - -First, we pull all the images to our local Docker daemon: - -```bash -$ for image in `talosctl images`; do docker pull $image; done -v0.12.0-amd64: Pulling from coreos/flannel -Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10 -... -``` - -All images are now stored in the Docker daemon store: - -```bash -$ docker images -ghcr.io/talos-systems/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB -k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB -... -``` - -Now we need to re-tag them so that we can push them to our local registry. -We are going to replace the first component of the image name (before the first slash) with our registry endpoint `127.0.0.1:6000`: - -```bash -$ for image in `talosctl images`; do \ - docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -As the next step, we push images to the internal registry: - -```bash -$ for image in `talosctl images`; do \ - docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \ - done -``` - -We can now verify that the images are pushed to the registry: - -```bash -$ curl http://127.0.0.1:6000/v2/_catalog -{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]} -``` - -> Note: images in the registry don't have the registry endpoint prefix anymore. - -## Launching Talos in an Air-gapped Environment - -For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry. -This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint. - -We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well. -As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment. - -The `talosctl cluster create` command provides conveniences for common configuration options. -The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry. -The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself). - -```bash -$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/talos-systems/installer:v0.10.0 -validating CIDR and reserving IPs -generating PKI and tokens -creating state directory in "/home/smira/.talos/clusters/talos-default" -creating network talos-default -creating load balancer -creating dhcpd -creating master nodes -creating worker nodes -waiting for API -... -``` - -> Note: `--install-image` should match the image which was copied into the internal registry in the previous step. - -You can be verify that the cluster is air-gapped by inspecting the registry logs: `docker logs -f registry-airgapped`. - -## Closing Notes - -Running in an air-gapped environment might require additional configuration changes, for example using custom settings for DNS and NTP servers. - -When scaling this guide to the bare-metal environment, following Talos config snippet could be used as an equivalent of the `--registry-mirror` flag above: - -```bash -machine: - ... - registries: - mirrors: - '*': - endpoints: - - http://10.5.0.1:6000/ -... -``` - -Other implementations of Docker registry can be used in place of the Docker `registry` image used above to run the registry. -If required, auth can be configured for the internal registry (and custom TLS certificates if needed). diff --git a/website/content/v0.10/guides/configuring-certificate-authorities.md b/website/content/v0.10/guides/configuring-certificate-authorities.md deleted file mode 100644 index e759c5054..000000000 --- a/website/content/v0.10/guides/configuring-certificate-authorities.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Configuring Certificate Authorities" -description: "" ---- - -## Appending the Certificate Authority - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` diff --git a/website/content/v0.10/guides/configuring-containerd.md b/website/content/v0.10/guides/configuring-containerd.md deleted file mode 100644 index 192a2303d..000000000 --- a/website/content/v0.10/guides/configuring-containerd.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "Configuring Containerd" -description: "" ---- - -The base containerd configuration expects to merge in any additional configs present in `/var/cri/conf.d/*.toml`. - -## An example of exposing metrics - -Into each machine config, add the following: - -```yaml -machine: - ... - files: - - content: | - [metrics] - address = "0.0.0.0:11234" - path: /var/cri/conf.d/metrics.toml - op: create -``` - -Create cluster like normal and see that metrics are now present on this port: - -```bash -$ curl 127.0.0.1:11234/v1/metrics -# HELP container_blkio_io_service_bytes_recursive_bytes The blkio io service bytes recursive -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="0677d73196f5f4be1d408aab1c4125cf9e6c458a4bea39e590ac779709ffbe14",device="/dev/dm-0",major="253",minor="0",namespace="k8s.io",op="Discard"} 0 -... -... -``` diff --git a/website/content/v0.10/guides/configuring-corporate-proxies.md b/website/content/v0.10/guides/configuring-corporate-proxies.md deleted file mode 100644 index 8cc13ba45..000000000 --- a/website/content/v0.10/guides/configuring-corporate-proxies.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: "Configuring Corporate Proxies" -description: "" ---- - -## Appending the Certificate Authority of MITM Proxies - -Put into each machine the PEM encoded certificate: - -```yaml -machine: - ... - files: - - content: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - permissions: 0644 - path: /etc/ssl/certs/ca-certificates - op: append -``` - -## Configuring a Machine to Use the Proxy - -To make use of a proxy: - -```yaml -machine: - env: - http_proxy: - https_proxy: - no_proxy: -``` - -Additionally, configure the DNS `nameservers`, and NTP `servers`: - -```yaml -machine: - env: - ... - time: - servers: - - - - - - - ... - network: - nameservers: - - - - - - -``` diff --git a/website/content/v0.10/guides/configuring-network-connectivity.md b/website/content/v0.10/guides/configuring-network-connectivity.md deleted file mode 100644 index 3a349ab66..000000000 --- a/website/content/v0.10/guides/configuring-network-connectivity.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: "Configuring Network Connectivity" -description: "" ---- - -## Configuring Network Connectivity - -The simplest way to deploy Talos is by ensuring that all the remote components of the system (`talosctl`, the control plane nodes, and worker nodes) all have layer 2 connectivity. -This is not always possible, however, so this page lays out the minimal network access that is required to configure and operate a talos cluster. - -> Note: These are the ports required for Talos specifically, and should be configured _in addition_ to the ports required by kubernetes. -> See the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#check-required-ports) for information on the ports used by kubernetes itself. - -### Control plane node(s) - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50000*apidtalosctl
TCPInbound50001*trustdControl plane nodes, worker nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). - -### Worker node(s) - - - - - - - - - - - - - - - - - - - - -
ProtocolDirectionPort RangePurposeUsed By
TCPInbound50001*trustdControl plane nodes
- -> Ports marked with a `*` are not currently configurable, but that may change in the future. -> [Follow along here](https://github.com/talos-systems/talos/issues/1836). diff --git a/website/content/v0.10/guides/configuring-pull-through-cache.md b/website/content/v0.10/guides/configuring-pull-through-cache.md deleted file mode 100644 index 5502f20f7..000000000 --- a/website/content/v0.10/guides/configuring-pull-through-cache.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configuring Pull Through Cache ---- - -In this guide we will create a set of local caching Docker registry proxies to minimize local cluster startup time. - -When running Talos locally, pulling images from Docker registries might take a significant amount of time. -We spin up local caching pass-through registries to cache images and configure a local Talos cluster to use those proxies. -A similar approach might be used to run Talos in production in air-gapped environments. -It can be also used to verify that all the images are available in local registries. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -The follow are requirements for creating the set of caching proxies: - -- Docker 18.03 or greater -- Local cluster requirements for either [docker](../../local-platforms/docker/) or [QEMU](../../local-platforms/qemu/). - -## Launch the Caching Docker Registry Proxies - -Talos pulls from `docker.io`, `k8s.gcr.io`, `gcr.io`, `ghcr.io` and `quay.io` by default. -If your configuration is different, you might need to modify the commands below: - -```bash -docker run -d -p 5000:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \ - --restart always \ - --name registry-docker.io registry:2 - -docker run -d -p 5001:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://k8s.gcr.io \ - --restart always \ - --name registry-k8s.gcr.io registry:2 - -docker run -d -p 5002:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://quay.io \ - --restart always \ - --name registry-quay.io registry:2.5 - -docker run -d -p 5003:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://gcr.io \ - --restart always \ - --name registry-gcr.io registry:2 - -docker run -d -p 5004:5000 \ - -e REGISTRY_PROXY_REMOTEURL=https://ghcr.io \ - --restart always \ - --name registry-ghcr.io registry:2 -``` - -> Note: Proxies are started as docker containers, and they're automatically configured to start with Docker daemon. -> Please note that `quay.io` proxy doesn't support recent Docker image schema, so we run older registry image version (2.5). - -As a registry container can only handle a single upstream Docker registry, we launch a container per upstream, each on its own -host port (5000, 5001, 5002, 5003 and 5004). - -## Using Caching Registries with `QEMU` Local Cluster - -With a [QEMU](../../local-platforms/qemu/) local cluster, a bridge interface is created on the host. -As registry containers expose their ports on the host, we can use bridge IP to direct proxy requests. - -```bash -sudo talosctl cluster create --provisioner qemu \ - --registry-mirror docker.io=http://10.5.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://10.5.0.1:5001 \ - --registry-mirror quay.io=http://10.5.0.1:5002 \ - --registry-mirror gcr.io=http://10.5.0.1:5003 \ - --registry-mirror ghcr.io=http://10.5.0.1:5004 -``` - -The Talos local cluster should now start pulling via caching registries. -This can be verified via registry logs, e.g. `docker logs -f registry-docker.io`. -The first time cluster boots, images are pulled and cached, so next cluster boot should be much faster. - -> Note: `10.5.0.1` is a bridge IP with default network (`10.5.0.0/24`), if using custom `--cidr`, value should be adjusted accordingly. - -## Using Caching Registries with `docker` Local Cluster - -With a [docker](../../local-platforms/docker/) local cluster we can use docker bridge IP, default value for that IP is `172.17.0.1`. -On Linux, the docker bridge address can be inspected with `ip addr show docker0`. - -```bash -talosctl cluster create --provisioner docker \ - --registry-mirror docker.io=http://172.17.0.1:5000 \ - --registry-mirror k8s.gcr.io=http://172.17.0.1:5001 \ - --registry-mirror quay.io=http://172.17.0.1:5002 \ - --registry-mirror gcr.io=http://172.17.0.1:5003 \ - --registry-mirror ghcr.io=http://172.17.0.1:5004 -``` - -## Cleaning Up - -To cleanup, run: - -```bash -docker rm -f registry-docker.io -docker rm -f registry-k8s.gcr.io -docker rm -f registry-quay.io -docker rm -f registry-gcr.io -docker rm -f registry-ghcr.io -``` - -> Note: Removing docker registry containers also removes the image cache. -> So if you plan to use caching registries, keep the containers running. diff --git a/website/content/v0.10/guides/configuring-the-cluster-endpoint.md b/website/content/v0.10/guides/configuring-the-cluster-endpoint.md deleted file mode 100644 index 2e1343b55..000000000 --- a/website/content/v0.10/guides/configuring-the-cluster-endpoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Configuring the Cluster Endpoint" -description: "" ---- - -In this section, we will step through the configuration of a Talos based Kubernetes cluster. -There are three major components we will configure: - -- `apid` and `talosctl` -- the master nodes -- the worker nodes - -Talos enforces a high level of security by using mutual TLS for authentication and authorization. - -We recommend that the configuration of Talos be performed by a cluster owner. -A cluster owner should be a person of authority within an organization, perhaps a director, manager, or senior member of a team. -They are responsible for storing the root CA, and distributing the PKI for authorized cluster administrators. - -### Recommended settings - -Talos runs great out of the box, but if you tweak some minor settings it will make your life -a lot easier in the future. -This is not a requirement, but rather a document to explain some key settings. - -#### Endpoint - -To configure the `talosctl` endpoint, it is recommended you use a resolvable DNS name. -This way, if you decide to upgrade to a multi-controlplane cluster you only have to add the ip adres to the hostname configuration. -The configuration can either be done on a Loadbalancer, or simply trough DNS. - -For example: - -> This is in the config file for the cluster e.g. init.yaml, controlplane.yaml and join.yaml. -> for more details, please see: [v1alpha1 endpoint configuration](../../reference/configuration/#controlplaneconfig) - -```yaml -..... -cluster: - controlPlane: - endpoint: https://endpoint.example.local:6443 -..... -``` - -If you have a DNS name as the endpoint, you can upgrade your talos cluster with multiple controlplanes in the future (if you don't have a multi-controlplane setup from the start) -Using a DNS name generates the corresponding Certificates (Kubernetes and Talos) for the correct hostname. diff --git a/website/content/v0.10/guides/configuring-wireguard-network.md b/website/content/v0.10/guides/configuring-wireguard-network.md deleted file mode 100644 index 27dc41aa3..000000000 --- a/website/content/v0.10/guides/configuring-wireguard-network.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: "Configuring Wireguard Network" -description: "In this guide you will learn how to set up Wireguard network using Kernel module." ---- - -## Configuring Wireguard Network - -### Quick Start - -The quickest way to try out Wireguard is to use `talosctl cluster create` command: - -```bash -talosctl cluster create --wireguard-cidr 10.1.0.0/24 -``` - -It will automatically generate Wireguard network configuration for each node with the following network topology: - - - -Where all controlplane nodes will be used as Wireguard servers which listen on port 51111. -All controlplanes and workers will connect to all controlplanes. -It also sets `PersistentKeepalive` to 5 seconds to establish controlplanes to workers connection. - -After the cluster is deployed it should be possible to verify Wireguard network connectivity. -It is possible to deploy a container with `hostNetwork` enabled, then do `kubectl exec /bin/bash` and either do: - -```bash -ping 10.1.0.2 -``` - -Or install `wireguard-tools` package and run: - -```bash -wg show -``` - -Wireguard show should output something like this: - -```bash -interface: wg0 - public key: OMhgEvNIaEN7zeCLijRh4c+0Hwh3erjknzdyvVlrkGM= - private key: (hidden) - listening port: 47946 - -peer: 1EsxUygZo8/URWs18tqB5FW2cLVlaTA+lUisKIf8nh4= - endpoint: 10.5.0.2:51111 - allowed ips: 10.1.0.0/24 - latest handshake: 1 minute, 55 seconds ago - transfer: 3.17 KiB received, 3.55 KiB sent - persistent keepalive: every 5 seconds -``` - -It is also possible to use generated configuration as a reference by pulling generated config files using: - -```bash -talosctl read -n 10.5.0.2 /system/state/config.yaml > controlplane.yaml -talosctl read -n 10.5.0.3 /system/state/config.yaml > join.yaml -``` - -### Manual Configuration - -All Wireguard configuration can be done by changing Talos machine config files. -As an example we will use this official Wireguard [quick start tutorial](https://www.wireguard.com/quickstart/). - -### Key Generation - -This part is exactly the same: - -```bash -wg genkey | tee privatekey | wg pubkey > publickey -``` - -### Setting up Device - -Inline comments show relations between configs and `wg` quickstart tutorial commands: - -```yaml -... -network: - interfaces: - ... - # ip link add dev wg0 type wireguard - - interface: wg0 - mtu: 1500 - # ip address add dev wg0 192.168.2.1/24 - cidr: 192.168.2.1/24 - # wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 - wireguard: - privateKey: - listenPort: 51820 - peers: - allowedIPs: - - 192.168.88.0/24 - endpoint: 209.202.254.14.8172 - publicKey: ABCDEF... -... -``` - -When `networkd` gets this configuration it will create the device, configure it and will bring it up (equivalent to `ip link set up dev wg0`). - -All supported config parameters are described in the [Machine Config Reference](../../reference/configuration/#devicewireguardconfig). diff --git a/website/content/v0.10/guides/converting-control-plane.md b/website/content/v0.10/guides/converting-control-plane.md deleted file mode 100644 index d7ec2ead6..000000000 --- a/website/content/v0.10/guides/converting-control-plane.md +++ /dev/null @@ -1,257 +0,0 @@ ---- -title: "Converting Control Plane" -description: "How to convert Talos self-hosted Kubernetes control plane (pre-0.9) to static pods based one." ---- - -Talos version 0.9 runs Kubernetes control plane in a new way: static pods managed by Talos. -Talos version 0.8 and below runs self-hosted control plane. -After Talos OS upgrade to version 0.9 Kubernetes control plane should be converted to run as static pods. - -This guide describes automated conversion script and also shows detailed manual conversion process. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Conversion - -First, make sure all nodes are updated to Talos 0.9: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready control-plane,master 58m v1.20.4 172.20.0.2 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-2 Ready control-plane,master 58m v1.20.4 172.20.0.3 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-master-3 Ready control-plane,master 58m v1.20.4 172.20.0.4 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -talos-default-worker-1 Ready 58m v1.20.4 172.20.0.5 Talos (v0.9.0) 5.10.19-talos containerd://1.4.4 -``` - -Start the conversion script: - -```bash -$ talosctl -n convert-k8s -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -current self-hosted status: true -gathering control plane configuration -aggregator CA key can't be recovered from bootkube-boostrapped control plane, generating new CA -patching master node "172.20.0.2" configuration -patching master node "172.20.0.3" configuration -patching master node "172.20.0.4" configuration -waiting for static pod definitions to be generated -waiting for manifests to be generated -Talos generated control plane static pod definitions and bootstrap manifests, please verify them with commands: - talosctl -n get StaticPods.kubernetes.talos.dev - talosctl -n get Manifests.kubernetes.talos.dev - -in order to remove self-hosted control plane, pod-checkpointer component needs to be disabled -once pod-checkpointer is disabled, the cluster shouldn't be rebooted until the entire conversion process is complete -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: -``` - -Script stops at this point waiting for confirmation. -Talos still runs self-hosted control plane, and static pods were not rendered yet. - -As instructed by the script, please verify that static pod definitions are correct: - -```bash -$ talosctl -n get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 1 - phase: running -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "2" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system - spec: - containers: - - command: -... -``` - -Static pod definitions are generated from the machine configuration and should match pod template as generated by Talos on bootstrap of self-hosted control plane unless there were some manual changes applied to the daemonset specs after bootstrap. -Talos patches the machine configuration with the container image versions scraped from the daemonset definition, fetches the service account key from Kubernetes secrets. - -Aggregator CA can't be recovered from the self-hosted control plane, so new CA gets generated. -This is generally harmless and not visible from outside the cluster. -The Aggregator CA is _not_ the same CA as is used by Talos or Kubernetes standard API. -It is a special PKI used for aggregating API extension services inside your cluster. -If you have non-standard apiserver aggregations (fairly rare, and you should know if you do), then you may need to restart these services after the new CA is in place. - -Verify that bootstrap manifests are correct: - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Make sure that manifests and static pods are correct across all control plane nodes, as each node reconciles -control plane state on its own. -For example, CNI configuration in machine config should be in sync across all the nodes. -Talos nodes try to create any missing Kubernetes resources from the manifests, but it never -updates or deletes existing resources. - -If something looks wrong, script can be aborted and machine configuration should be updated to fix the problem. -Once configuration is updated, the script can be restarted. - -If static pod definitions and manifests look good, confirm next step to disable `pod-checkpointer`: - -```bash -$ talosctl -n convert-k8s -... -confirm disabling pod-checkpointer to proceed with control plane update [yes/no]: yes -disabling pod-checkpointer -deleting daemonset "pod-checkpointer" -checking for active pod checkpoints -2021/03/09 23:37:25 retrying error: found 3 active pod checkpoints: [pod-checkpointer-655gc-talos-default-master-3 pod-checkpointer-pw6mv-talos-default-master-1 pod-checkpointer-zdw9z-talos-default-master-2] -2021/03/09 23:42:25 retrying error: found 1 active pod checkpoints: [pod-checkpointer-pw6mv-talos-default-master-1] -confirm applying static pod definitions and manifests [yes/no]: -``` - -Self-hosted control plane runs `pod-checkpointer` to work around issues with control plane availability. -It should be disabled before conversion starts to allow self-hosted control plane to be removed. -It takes around 5 minutes for the `pod-checkpointer` to be fully disabled. -Script verifies that all checkpoints are removed before proceeding. - -This last confirmation before proceeding is at the point when there is no way to keep running self-hosted control plane: -static pods are released, bootstrap manifests are applied, self-hosted control plane is removed. - -```bash -$ talosctl -n convert-k8s -... -confirm applying static pod definitions and manifests [yes/no]: yes -removing self-hosted initialized key -waiting for static pods for "kube-apiserver" to be present in the API server state -waiting for static pods for "kube-controller-manager" to be present in the API server state -waiting for static pods for "kube-scheduler" to be present in the API server state -deleting daemonset "kube-apiserver" -waiting for static pods for "kube-apiserver" to be present in the API server state -deleting daemonset "kube-controller-manager" -waiting for static pods for "kube-controller-manager" to be present in the API server state -deleting daemonset "kube-scheduler" -waiting for static pods for "kube-scheduler" to be present in the API server state -conversion process completed successfully -``` - -As soon as the control plane static pods are rendered, the kubelet starts the control plane static pods. -It is expected that the pods for `kube-apiserver` will crash initially. -Only one `kube-apiserver` can be bound to the host `Node`'s port 6443 at a time. -Eventually, the old `kube-apiserver` will be killed, and the new one will be able to start. -This is all handled automatically. -The script will continue by removing each self-hosted daemonset and verifying that static pods are ready and healthy. - -## Manual Conversion - -Check that Talos runs self-hosted control plane: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 2 true -``` - -Talos machine configuration need to be updated to the 0.9 format; there are two new required machine configuration settings: - -* `.cluster.serviceAccount` is the service account PEM-encoded private key. -* `.cluster.aggregatorCA` is the aggregator CA for `kube-apiserver` (certficiate and private key). - -Current service account can be fetched from the Kubernetes secrets: - -```bash -$ kubectl -n kube-system get secrets kube-controller-manager -o jsonpath='{.data.service\-account\.key}' -LS0tLS1CRUdJTiBSU0EgUFJJVkFURS... -``` - -All control plane node machine configurations should be patched with the service account key: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/serviceAccount", "value": {"key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURS..."}}]' -patched mc at the node 172.20.0.2 -``` - -Aggregator CA can be generated using OpenSSL or any other certificate generation tools: RSA or ECDSA certificate with CN `front-proxy` valid for 10 years. -PEM-encoded CA certificate and key should be base64-encoded and patched into the machine config at path `/cluster/aggregatorCA`: - -```bash -$ talosctl -n ,,... patch mc --immediate -p '[{"op": "add", "path": "/cluster/aggregatorCA", "value": {"crt": "S0tLS1CRUdJTiBDRVJUSUZJQ...", "key": "LS0tLS1CRUdJTiBFQy..."}}]' -patched mc at the node 172.20.0.2 -``` - -At this point static pod definitions and bootstrap manifests should be rendered, please see "Automated Conversion" on how to verify generated objects. -Feel free to continue to refine your machine configuration until the generated static pod definitions and bootstrap manifests look good. - -If static pod definitions are not generated, check logs with `talosctl -n logs controller-runtime`. - -Disable `pod-checkpointer` with: - -```bash -$ kubectl -n kube-system delete ds pod-checkpointer -daemonset.apps "pod-checkpointer" deleted -``` - -Wait for all pod checkpoints to be removed: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -pod-checkpointer-8q2lh-talos-default-master-2 1/1 Running 0 3m34s -pod-checkpointer-nnm5w-talos-default-master-3 1/1 Running 0 3m24s -pod-checkpointer-qnmdt-talos-default-master-1 1/1 Running 0 2m21s -``` - -Pod checkpoints have annotation `checkpointer.alpha.coreos.com/checkpoint-of`. - -Once all the pod checkpoints are removed (it takes 5 minutes for the checkpoints to be removed), proceed by removing self-hosted initialized key: - -```bash -talosctl -n convert-k8s --remove-initialized-key -``` - -Talos controllers will now render static pod definitions, and the kubelet will launch any resulting static pods. - -Once static pods are visible in `kubectl get pods -n kube-system` output, proceed by removing each of the self-hosted daemonsets: - -```bash -$ kubectl -n kube-system delete daemonset kube-apiserver -daemonset.apps "kube-apiserver" deleted -``` - -Make sure static pods for `kube-apiserver` got started successfully, pods are running and ready. - -Proceed by deleting `kube-controller-manager` and `kube-scheduler` daemonsets, verifying that static pods are running between each step: - -```bash -$ kubectl -n kube-system delete daemonset kube-controller-manager -daemonset.apps "kube-controller-manager" deleted -``` - -```bash -$ kubectl -n kube-system delete daemonset kube-scheduler -daemonset.apps "kube-scheduler" deleted -``` diff --git a/website/content/v0.10/guides/customizing-the-kernel.md b/website/content/v0.10/guides/customizing-the-kernel.md deleted file mode 100644 index 74086bd8f..000000000 --- a/website/content/v0.10/guides/customizing-the-kernel.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: "Customizing the Kernel" -description: "" ---- - -```docker -FROM scratch AS customization -COPY --from= /lib/modules /lib/modules - -FROM docker.io/andrewrynhard/installer:latest -COPY --from= /boot/vmlinuz /usr/install/vmlinuz -``` - -```bash -docker build --build-arg RM="/lib/modules" -t talos-installer . -``` - -> Note: You can use the `--squash` flag to create smaller images. - -Now that we have a custom installer we can build Talos for the specific platform we wish to deploy to. diff --git a/website/content/v0.10/guides/customizing-the-root-filesystem.md b/website/content/v0.10/guides/customizing-the-root-filesystem.md deleted file mode 100644 index a543c372e..000000000 --- a/website/content/v0.10/guides/customizing-the-root-filesystem.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: "Customizing the Root Filesystem" -description: "" ---- - -The installer image contains [`ONBUILD`](https://docs.docker.com/engine/reference/builder/#onbuild) instructions that handle the following: - -- the decompression, and unpacking of the `initramfs.xz` -- the unsquashing of the rootfs -- the copying of new rootfs files -- the squashing of the new rootfs -- and the packing, and compression of the new `initramfs.xz` - -When used as a base image, the installer will perform the above steps automatically with the requirement that a `customization` stage be defined in the `Dockerfile`. - -For example, say we have an image that contains the contents of a library we wish to add to the Talos rootfs. -We need to define a stage with the name `customization`: - -```docker -FROM scratch AS customization -COPY --from= -``` - -Using a multi-stage `Dockerfile` we can define the `customization` stage and build `FROM` the installer image: - -```docker -FROM scratch AS customization -COPY --from= - -FROM ghcr.io/talos-systems/installer:latest -``` - -When building the image, the `customization` stage will automatically be copied into the rootfs. -The `customization` stage is not limited to a single `COPY` instruction. -In fact, you can do whatever you would like in this stage, but keep in mind that everything in `/` will be copied into the rootfs. - -> Note: `` is the path relative to the rootfs that you wish to place the contents of ``. - -To build the image, run: - -```bash -docker build --squash -t /installer:latest . -``` - -In the case that you need to perform some cleanup _before_ adding additional files to the rootfs, you can specify the `RM` [build-time variable](https://docs.docker.com/engine/reference/commandline/build/#set-build-time-variables---build-arg): - -```bash -docker build --squash --build-arg RM="[ ...]" -t /installer:latest . -``` - -This will perform a `rm -rf` on the specified paths relative to the rootfs. - -> Note: `RM` must be a whitespace delimited list. - -The resulting image can be used to: - -- generate an image for any of the supported providers -- perform bare-metall installs -- perform upgrades - -We will step through common customizations in the remainder of this section. diff --git a/website/content/v0.10/guides/deploy-metrics-server.md b/website/content/v0.10/guides/deploy-metrics-server.md deleted file mode 100644 index 0471cdbfc..000000000 --- a/website/content/v0.10/guides/deploy-metrics-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Deploying Metrics Server" -description: "In this guide you will learn how to set up metrics-server." ---- - -Metrics Server enables use of the [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) and [Vertical Pod Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler). -It does this by gathering metrics data from the kubelets in a cluster. -By default, the certificates in use by the kubelets will not be recognized by metrics-server. -This can be solved by either configuring metrics-server to do no validation of the TLS certificates, or by modifying the kubelet configuration to rotate its certificates and use ones that will be recognized by metrics-server. - -## Node Configuration - -To enable kubelet certificate rotation, all nodes should have the following Machine Config snippet: - -```yaml -machine: - kubelet: - extraArgs: - rotate-server-certificates: true -``` - -## Install During Bootstrap - -We will want to ensure that new certificates for the kubelets are approved automatically. -This can easily be done with the [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver), which will automatically approve the Certificate Signing Requests generated by the kubelets. - -We can have Kubelet Serving Certificate Approver and metrics-server installed on the cluster automatically during bootstrap by adding the following snippet to the Cluster Config of the node that will be handling the bootstrap process: - -```yaml -cluster: - extraManifests: - - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml - - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` - -## Install After Bootstrap - -If you choose not to use `extraManifests` to install Kubelet Serving Certificate Approver and metrics-server during bootstrap, you can install them once the cluster is online using `kubectl`: - -```sh -kubectl apply -f https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml -kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml -``` diff --git a/website/content/v0.10/guides/disaster-recovery.md b/website/content/v0.10/guides/disaster-recovery.md deleted file mode 100644 index 286b70080..000000000 --- a/website/content/v0.10/guides/disaster-recovery.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: "Disaster Recovery" -description: "Procedure for snapshotting etcd database and recovering from catastrophic control plane failure." ---- - -`etcd` database backs Kubernetes control plane state, so if the `etcd` service is unavailable -Kubernetes control plane goes down, and the cluster is not recoverable until `etcd` is recovered with contents. -The `etcd` consistency model builds around the consensus protocol Raft, so for highly-available control plane clusters, -loss of one control plane node doesn't impact cluster health. -In general, `etcd` stays up as long as a sufficient number of nodes to maintain quorum are up. -For a three control plane node Talos cluster, this means that the cluster tolerates a failure of any single node, -but losing more than one node at the same time leads to complete loss of service. -Because of that, it is important to take routine backups of `etcd` state to have a snapshot to recover cluster from -in case of catastrophic failure. - -## Backup - -### Snapshotting `etcd` Database - -Create a consistent snapshot of `etcd` database with `talosctl etcd snapshot` command: - -```bash -$ talosctl -n etcd snapshot db.snapshot -etcd snapshot saved to "db.snapshot" (2015264 bytes) -snapshot info: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: filename `db.snapshot` is arbitrary. - -This database snapshot can be taken on any healthy control plane node (with IP address `` in the example above), -as all `etcd` instances contain exactly same data. -It is recommended to configure `etcd` snapshots to be created on some schedule to allow point-in-time recovery using the latest snapshot. - -### Disaster Database Snapshot - -If `etcd` cluster is not healthy, the `talosctl etcd snapshot` command might fail. -In that case, copy the database snapshot directly from the control plane node: - -```bash -talosctl -n cp /var/lib/etcd/member/snap/db . -``` - -This snapshot might not be fully consistent (if the `etcd` process is running), but it allows -for disaster recovery when latest regular snapshot is not available. - -### Machine Configuration - -Machine configuration might be required to recover the node after hardware failure. -Backup Talos node machine configuration with the command: - -```bash -talosctl -n IP get mc v1alpha1 -o yaml | yq eval '.spec' - -``` - -## Recovery - -Before starting a disaster recovery procedure, make sure that `etcd` cluster can't be recovered: - -* get `etcd` cluster member list on all healthy control plane nodes with `talosctl -n IP etcd members` command and compare across all members. -* query `etcd` health across control plane nodes with `talosctl -n IP service etcd`. - -If the quorum can be restored, restoring quorum might be a better strategy than performing full disaster recovery -procedure. - -### Latest Etcd Snapshot - -Get hold of the latest `etcd` database snapshot. -If a snapshot is not fresh enough, create a database snapshot (see above), even if the `etcd` cluster is unhealthy. - -### Init Node - -Make sure that there are no control plane nodes with machine type `init`: - -```bash -$ talosctl -n ,,... get machinetype -NODE NAMESPACE TYPE ID VERSION TYPE -172.20.0.2 config MachineType machine-type 2 controlplane -172.20.0.4 config MachineType machine-type 2 controlplane -172.20.0.3 config MachineType machine-type 2 controlplane -``` - -Nodes with `init` type are incompatible with `etcd` recovery procedure. -`init` node can be converted to `controlplane` type with `talosctl edit mc --on-reboot` command followed -by node reboot with `talosctl reboot` command. - -### Preparing Control Plane Nodes - -If some control plane nodes experienced hardware failure, replace them with new nodes. -Use machine configuration backup to re-create the nodes with the same secret material and control plane settings -to allow workers to join the recovered control plane. - -If a control plane node is healthy but `etcd` isn't, wipe the node's `EPHEMERAL` partition to remove the `etcd` -data directory (make sure a database snapshot is taken before doing this): - -```bash -talosctl -n reset --graceful=false --reboot --system-labels-to-wipe=EPHEMERAL -``` - -At this point, all control plane nodes should boot up, and `etcd` service should be in the `Preparing` state. - -Kubernetes control plane endpoint should be pointed to the new control plane nodes if there were -any changes to the node addresses. - -### Recovering from the Backup - -Make sure all `etcd` service instances are in `Preparing` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Preparing -HEALTH ? -EVENTS [Preparing]: Running pre state (17s ago) - [Waiting]: Waiting for service "cri" to be "up", time sync (18s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", time sync (20s ago) -``` - -Execute the bootstrap command against any control plane node passing the path to the `etcd` database snapshot: - -```bash -$ talosctl -n bootstrap --recover-from=./db.snapshot -recovering from snapshot "./db.snapshot": hash c25fd181, revision 4193, total keys 1287, total size 3035136 -``` - -> Note: if database snapshot was copied out directly from the `etcd` data directory using `talosctl cp`, -> add flag `--recover-skip-hash-check` to skip integrity check on restore. - -Talos node should print matching information in the kernel log: - -```log -recovering etcd from snapshot: hash c25fd181, revision 4193, total keys 1287, total size 3035136 -{"level":"info","msg":"restoring snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/li} -{"level":"info","msg":"restored last compact revision","meta-bucket-name":"meta","meta-bucket-name-key":"finishedCompactRev","restored-compact-revision":3360} -{"level":"info","msg":"added member","cluster-id":"a3390e43eb5274e2","local-member-id":"0","added-peer-id":"eb4f6f534361855e","added-peer-peer-urls":["https:/} -{"level":"info","msg":"restored snapshot","path":"/var/lib/etcd.snapshot","wal-dir":"/var/lib/etcd/member/wal","data-dir":"/var/lib/etcd","snap-dir":"/var/lib/etcd/member/snap"} -``` - -Now `etcd` service should become healthy on the bootstrap node, Kubernetes control plane components -should start and control plane endpoint should become available. -Remaining control plane nodes join `etcd` cluster once control plane endpoint is up. - -## Single Control Plane Node Cluster - -This guide applies to the single control plane clusters as well. -In fact, it is much more important to take regular snapshots of the `etcd` database in single control plane node -case, as loss of the control plane node might render the whole cluster irrecoverable without a backup. diff --git a/website/content/v0.10/guides/disk-encryption.md b/website/content/v0.10/guides/disk-encryption.md deleted file mode 100644 index 04b3fbfd8..000000000 --- a/website/content/v0.10/guides/disk-encryption.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: "Disk Encryption" -description: "Guide on using system disk encryption" ---- - -It is possible to enable encryption for system disks at the OS level. -As of this writing, only STATE and EPHEMERAL partitions can be encrypted. -STATE contains the most sensitive node data: secrets and certs. -EPHEMERAL partition may contain some sensitive workload data. -Data is encrypted using LUKS2, which is provided by the Linux kernel modules and `cryptsetup` utility. -The operating system will run additional setup steps when encryption is enabled. - -If the disk encryption is enabled for the STATE partition, the system will: - -- Save STATE encryption config as JSON in the META partition. -- Before mounting the STATE partition, load encryption configs either from the machine config or from the META partition. - Note that the machine config is always preferred over the META one. -- Before mounting the STATE partition, format and encrypt it. - This occurs only if the STATE partition is empty and has no filesystem. - -If the disk encryption is enabled for the EPHEMERAL partition, the system will: - -- Get the encryption config from the machine config. -- Before mounting the EPHEMERAL partition, encrypt and format it. - This occurs only if the EPHEMERAL partition is empty and has no filesystem. - -## Configuration - -Right now this encryption is disabled by default. -To enable disk encryption you should modify the machine configuration with the following options: - -```yaml -machine: - ... - systemDiskEncryption: - ephemeral: - keys: - - nodeID: {} - slot: 0 - state: - keys: - - nodeID: {} - slot: 0 -``` - -### Encryption Keys - -> Note: What the LUKS2 docs call "keys" are, in reality, a passphrase. -> When this passphrase is added, LUKS2 runs argon2 to create an actual key from that passphrase. - -LUKS2 supports up to 32 encryption keys and it is possible to specify all of them in the machine configuration. -Talos always tries to sync the keys list defined in the machine config with the actual keys defined for the LUKS2 partition. -So if you update the keys list you should have at least one key that is not changed to be used for keys management. - -When you define a key you should specify the key kind and the `slot`: - -```yaml -machine: - ... - state: - keys: - - nodeID: {} # key kind - slot: 1 - - ephemeral: - keys: - - static: - passphrase: supersecret - slot: 0 -``` - -Take a note that key order does not play any role on which key slot is used. -Every key must always have a slot defined. - -### Encryption Key Kinds - -Talos supports two kinds of keys: - -- `nodeID` which is generated using the node UUID and the partition label (note that if the node UUID is not really random it will fail the entropy check). -- `static` which you define right in the configuration. - -> Note: Use static keys only if your STATE partition is encrypted and only for the EPHEMERAL partition. -> For the STATE partition it will be stored in the META partition, which is not encrypted. - -### Key Rotation - -It is necessary to do `talosctl apply-config` a couple of times to rotate keys, since there is a need to always maintain a single working key while changing the other keys around it. - -So, for example, first add a new key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: oldkey - slot: 0 - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -Then remove the old key: - -```yaml -machine: - ... - ephemeral: - keys: - - static: - passphrase: newkey - slot: 1 - ... -``` - -Run: - -```bash -talosctl apply-config -n -f config.yaml -``` - -## Going from Unencrypted to Encrypted and Vice Versa - -### Ephemeral Partition - -There is no in-place encryption support for the partitions right now, so to avoid losing any data only empty partitions can be encrypted. - -As such, migration from unencrypted to encrypted needs some additional handling, especially around explicitly wiping partitions. - -- `apply-config` should be called with `--on-reboot` flag. -- Partition should be wiped after `apply-config`, but before the reboot. - -Edit your machine config and add the encryption configuration: - -```bash -vim config.yaml -``` - -Apply the configuration with `--on-reboot` flag: - -```bash -talosctl apply-config -f config.yaml -n --on-reboot -``` - -Wipe the partition you're going to encrypt: - -```bash -talosctl reset --system-labels-to-wipe EPHEMERAL -n --reboot=true -``` - -That's it! -After you run the last command, the partition will be wiped and the node will reboot. -During the next boot the system will encrypt the partition. - -### State Partition - -Calling wipe against the STATE partition will make the node lose the config, so the previous flow is not going to work. - -The flow should be to first wipe the STATE partition: - -```bash -talosctl reset --system-labels-to-wipe STATE -n --reboot=true -``` - -Node will enter into maintenance mode, then run `apply-config` with `--insecure` flag: - -```bash -talosctl apply-config --insecure -n -f config.yaml -``` - -After installation is complete the node should encrypt the STATE partition. diff --git a/website/content/v0.10/guides/editing-machine-configuration.md b/website/content/v0.10/guides/editing-machine-configuration.md deleted file mode 100644 index 4eeba07c5..000000000 --- a/website/content/v0.10/guides/editing-machine-configuration.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: "Editing Machine Configuration" -description: "How to edit and patch Talos machine configuration, with reboot, immediately, or stage update on reboot." ---- - -Talos node state is fully defined by [machine configuration](../../reference/configuration/). -Initial configuration is delivered to the node at bootstrap time, but configuration can be updated while the node is running. - -> Note: Be sure that config is persisted so that configuration updates are not overwritten on reboots. -> Configuration persistence was enabled by default since Talos 0.5 (`persist: true` in machine configuration). - -There are three `talosctl` commands which facilitate machine configuration updates: - -* `talosctl apply-config` to apply configuration from the file -* `talosctl edit machineconfig` to launch an editor with existing node configuration, make changes and apply configuration back -* `talosctl patch machineconfig` to apply automated machine configuration via JSON patch - -Each of these commands can operate in one of three modes: - -* apply change with a reboot (default): update configuration, reboot Talos node to apply configuration change -* apply change immediately (`--immediate` flag): change is applied immediately without a reboot, only `.cluster` sub-tree of the machine configuration can be updated in Talos 0.9 -* apply change on next reboot (`--on-reboot`): change is staged to be applied after a reboot, but node is not rebooted - -> Note: applying change on next reboot (`--on-reboot`) doesn't modify current node configuration, so next call to -> `talosctl edit machineconfig --on-reboot` will not see changes - -### `talosctl apply-config` - -This command is mostly used to submit initial machine configuration to the node (generated by `talosctl gen config`). -It can be used to apply new configuration from the file to the running node as well, but most of the time it's not convenient, as it doesn't operate on the current node machine configuration. - -Example: - -```bash -talosctl -n apply-config -f config.yaml -``` - -Command `apply-config` can also be invoked as `apply machineconfig`: - -```bash -talosctl -n apply machineconfig -f config.yaml -``` - -Applying machine configuration immediately (without a reboot): - -```bash -talosctl -n IP apply machineconfig -f config.yaml --immediate -``` - -### `taloctl edit machineconfig` - -Command `talosctl edit` loads current machine configuration from the node and launches configured editor to modify the config. -If config hasn't been changed in the editor (or if updated config is empty), update is not applied. - -> Note: Talos uses environment variables `TALOS_EDITOR`, `EDITOR` to pick up the editor preference. -> If environment variables are missing, `vi` editor is used by default. - -Example: - -```bash -talosctl -n edit machineconfig -``` - -Configuration can be edited for multiple nodes if multiple IP addresses are specified: - -```bash -talosctl -n ,,... edit machineconfig -``` - -Applying machine configuration change immediately (without a reboot): - -```bash -talosctl -n edit machineconfig --immediate -``` - -### `talosctl patch machineconfig` - -Command `talosctl patch` works similar to `talosctl edit` command - it loads current machine configuration, but instead of launching configured editor it applies [JSON patch](http://jsonpatch.com/) to the configuration and writes result back to the node. - -Example, updating kubelet version (with a reboot): - -```bash -$ talosctl -n patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.5"}]' -patched mc at the node -``` - -Updating kube-apiserver version in immediate mode (without a reboot): - -```bash -$ talosctl -n patch machineconfig --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.5"}]' -patched mc at the node -``` - -Patch might be applied to multiple nodes when multiple IPs are specified: - -```bash -taloctl -n ,,... patch machineconfig --immediate -p '[{...}]' -``` - -### Recovering from Node Boot Failures - -If a Talos node fails to boot because of wrong configuration (for example, control plane endpoint is incorrect), configuration can be updated to fix the issue. -If the boot sequence is still running, Talos might refuse applying config in default mode. -In that case `--on-reboot` mode can be used coupled with `talosctl reboot` command to trigger a reboot and apply configuration update. diff --git a/website/content/v0.10/guides/managing-pki.md b/website/content/v0.10/guides/managing-pki.md deleted file mode 100644 index 8500be6a9..000000000 --- a/website/content/v0.10/guides/managing-pki.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: "Managing PKI" -description: "" ---- - -## Generating an Administrator Key Pair - -In order to create a key pair, you will need the root CA. - -Save the CA public key, and CA private key as `ca.crt`, and `ca.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen key --name admin -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -Now, base64 encode `admin.crt`, and `admin.key`: - -```bash -cat admin.crt | base64 -cat admin.key | base64 -``` - -You can now set the `crt` and `key` fields in the `talosconfig` to the base64 encoded strings. - -## Renewing an Expired Administrator Certificate - -In order to renew the certificate, you will need the root CA, and the admin private key. -The base64 encoded key can be found in any one of the control plane node's configuration file. -Where it is exactly will depend on the specific version of the configuration file you are using. - -Save the CA public key, CA private key, and admin private key as `ca.crt`, `ca.key`, and `admin.key` respectively. -Now, run the following commands to generate a certificate: - -```bash -talosctl gen csr --key admin.key --ip 127.0.0.1 -talosctl gen crt --ca ca --csr admin.csr --name admin -``` - -You should see `admin.crt` in your current directory. -Now, base64 encode `admin.crt`: - -```bash -cat admin.crt | base64 -``` - -You can now set the certificate in the `talosconfig` to the base64 encoded string. diff --git a/website/content/v0.10/guides/resetting-a-machine.md b/website/content/v0.10/guides/resetting-a-machine.md deleted file mode 100644 index 41f0f8230..000000000 --- a/website/content/v0.10/guides/resetting-a-machine.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: "Resetting a Machine" -description: "" ---- - -From time to time, it may be beneficial to reset a Talos machine to its "original" state. -Bear in mind that this is a destructive action for the given machine. -Doing this means removing the machine from Kubernetes, Etcd (if applicable), and clears any data on the machine that would normally persist a reboot. - -The API command for doing this is `talosctl reset`. -There are a couple of flags as part of this command: - -```bash -Flags: - --graceful if true, attempt to cordon/drain node and leave etcd (if applicable) (default true) - --reboot if true, reboot the node after resetting instead of shutting down -``` - -The `graceful` flag is especially important when considering HA vs. non-HA Talos clusters. -If the machine is part of an HA cluster, a normal, graceful reset should work just fine right out of the box as long as the cluster is in a good state. -However, if this is a single node cluster being used for testing purposes, a graceful reset is not an option since Etcd cannot be "left" if there is only a single member. -In this case, reset should be used with `--graceful=false` to skip performing checks that would normally block the reset. diff --git a/website/content/v0.10/guides/storage.md b/website/content/v0.10/guides/storage.md deleted file mode 100644 index 62c993f71..000000000 --- a/website/content/v0.10/guides/storage.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: "Storage" -description: "" ---- - -Talos is known to work with Rook, Mayastor (OpenEBS) and NFS. - -## Rook - -We recommend at least Rook v1.5. - -## NFS - -The NFS client is part of the [`kubelet` image](https://github.com/talos-systems/kubelet) maintained by the Talos team. -This means that the version installed in your running `kubelet` is the version of NFS supported by Talos. - -## Mayastor (OpenEBS) - -### Video Walkthrough - -To see a live demo of this section, see the video below: - - - -### Prep Nodes - -Either during initial cluster creation or on running worker nodes, several machine config values should be edited. -This can be done with `talosctl edit machineconfig` or via config patches during `talosctl gen config`. - -- Under `/machine/sysctls`, add `vm.nr_hugepages: "512"` -- Under `/machine/kubelet/extraMounts`, add `/var/local` like so: - -```yaml -... -extraMounts: - - destination: /var/local - type: bind - source: /var/local - options: - - rbind - - rshared - - rw -... -``` - -- Either using `kubectl taint node` in a pre-existing cluster or by updating `/machine/kubelet/extraArgs` in machine config, add `openebs.io/engine=mayastor` as a node label. -If being done via machine config, `extraArgs` may look like: - -```yaml -... -extraArgs: - node-labels: openebs.io/engine=mayastor -... -``` - -### Deploy Mayastor - -Using the [Mayastor docs](https://mayastor.gitbook.io/introduction/quickstart/deploy-mayastor) as a reference, apply all YAML files necessary. -At the time of writing this looked like: - -```bash -kubectl create namespace mayastor - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-rbac.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/nats-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/csi/moac/crds/mayastorpool.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/csi-daemonset.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/moac-deployment.yaml - -kubectl apply -f https://raw.githubusercontent.com/openebs/Mayastor/master/deploy/mayastor-daemonset.yaml -``` - -### Create Pools - -Each "storage" node should have a "MayastorPool" that defines the local disks to use for storage. -These are later considered during scheduling and replication of data. -Create the pool by issuing the following, updating as necessary: - -```bash -cat < - -This guide is written as series of topics and detailed answers for each topic. -It starts with basics of control plane and goes into Talos specifics. - -This document mostly applies only to Talos 0.9 control plane based on static pods. -If Talos was upgraded from version 0.8, it might be still running self-hosted control plane, current status can -be checked with the command `talosctl get bootstrapstatus`: - -```bash -$ talosctl -n get bs -NODE NAMESPACE TYPE ID VERSION SELF HOSTED -172.20.0.2 runtime BootstrapStatus control-plane 1 false -``` - -In this guide we assume that Talos client config is available and Talos API access is available. -Kubernetes client configuration can be pulled from control plane nodes with `talosctl -n kubeconfig` -(this command works before Kubernetes is fully booted). - -### What is a control plane node? - -Talos nodes which have `.machine.type` of `init` and `controlplane` are control plane nodes. - -The only difference between `init` and `controlplane` nodes is that `init` node automatically -bootstraps a single-node `etcd` cluster on a first boot if the etcd data directory is empty. -A node with type `init` can be replaced with a `controlplane` node which is triggered to run etcd bootstrap -with `talosctl --nodes bootstrap` command. - -Use of `init` type nodes is discouraged, as it might lead to split-brain scenario if one node in -existing cluster is reinstalled while config type is still `init`. - -It is critical to make sure only one control plane runs in bootstrap mode (either with node type `init` or -via bootstrap API/`talosctl bootstrap`), as having more than node in bootstrap mode leads to split-brain -scenario (multiple etcd clusters are built instead of a single cluster). - -### What is special about control plane node? - -Control plane nodes in Talos run `etcd` which provides data store for Kubernetes and Kubernetes control plane -components (`kube-apiserver`, `kube-controller-manager` and `kube-scheduler`). - -Control plane nodes are tainted by default to prevent workloads from being scheduled to control plane nodes. - -### How many control plane nodes should be deployed? - -With a single control plane node, cluster is not HA: if that single node experiences hardware failure, cluster -control plane is broken and can't be recovered. -Single control plane node clusters are still used as test clusters and in edge deployments, but it should be noted that this setup is not HA. - -Number of control plane should be odd (1, 3, 5, ...), as with even number of nodes, etcd quorum doesn't tolerate -failures correctly: e.g. with 2 control plane nodes quorum is 2, so failure of any node breaks quorum, so this -setup is almost equivalent to single control plane node cluster. - -With three control plane nodes cluster can tolerate a failure of any single control plane node. -With five control plane nodes cluster can tolerate failure of any two control plane nodes. - -### What is control plane endpoint? - -Kubernetes requires having a control plane endpoint which points to any healthy API server running on a control plane node. -Control plane endpoint is specified as URL like `https://endpoint:6443/`. -At any point in time, even during failures control plane endpoint should point to a healthy API server instance. -As `kube-apiserver` runs with host network, control plane endpoint should point to one of the control plane node IPs: `node1:6443`, `node2:6443`, ... - -For single control plane node clusters, control plane endpoint might be `https://IP:6443/` or `https://DNS:6443/`, where `IP` is the IP of the control plane node and `DNS` points to `IP`. -DNS form of the endpoint allows to change the IP address of the control plane if that IP changes over time. - -For HA clusters, control plane can be implemented as: - -* TCP L7 loadbalancer with active health checks against port 6443 -* round-robin DNS with active health checks against port 6443 -* BGP anycast IP with health checks -* virtual shared L2 IP - - -It is critical that control plane endpoint works correctly during cluster bootstrap phase, as nodes discover -each other using control plane endpoint. - -### kubelet is not running on control plane node - -Service `kubelet` should be running on control plane node as soon as networking is configured: - -```bash -$ talosctl -n service kubelet -NODE 172.20.0.2 -ID kubelet -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (2m54s ago) - [Running]: Health check failed: Get "http://127.0.0.1:10248/healthz": dial tcp 127.0.0.1:10248: connect: connection refused (3m4s ago) - [Running]: Started task kubelet (PID 2334) for container kubelet (3m6s ago) - [Preparing]: Creating service runner (3m6s ago) - [Preparing]: Running pre state (3m15s ago) - [Waiting]: Waiting for service "timed" to be "up" (3m15s ago) - [Waiting]: Waiting for service "cri" to be "up", service "timed" to be "up" (3m16s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m18s ago) -``` - -If `kubelet` is not running, it might be caused by wrong configuration, check `kubelet` logs -with `talosctl logs`: - -```bash -$ talosctl -n logs kubelet -172.20.0.2: I0305 20:45:07.756948 2334 controller.go:101] kubelet config controller: starting controller -172.20.0.2: I0305 20:45:07.756995 2334 controller.go:267] kubelet config controller: ensuring filesystem is set up correctly -172.20.0.2: I0305 20:45:07.757000 2334 fsstore.go:59] kubelet config controller: initializing config checkpoints directory "/etc/kubernetes/kubelet/store" -``` - -### etcd is not running on bootstrap node - -`etcd` should be running on bootstrap node immediately (bootstrap node is either `init` node or `controlplane` node -after `talosctl bootstrap` command was issued). -When node boots for the first time, `etcd` data directory `/var/lib/etcd` directory is empty and Talos launches `etcd` in a mode to build the initial cluster of a single node. -At this time `/var/lib/etcd` directory becomes non-empty and `etcd` runs as usual. - -If `etcd` is not running, check service `etcd` state: - -```bash -$ talosctl -n service etcd -NODE 172.20.0.2 -ID etcd -STATE Running -HEALTH OK -EVENTS [Running]: Health check successful (3m21s ago) - [Running]: Started task etcd (PID 2343) for container etcd (3m26s ago) - [Preparing]: Creating service runner (3m26s ago) - [Preparing]: Running pre state (3m26s ago) - [Waiting]: Waiting for service "cri" to be "up", service "networkd" to be "up", service "timed" to be "up" (3m26s ago) -``` - -If service is stuck in `Preparing` state for bootstrap node, it might be related to slow network - at this stage -Talos pulls `etcd` image from the container registry. - -If `etcd` service is crashing and restarting, check service logs with `talosctl -n logs etcd`. -Most common reasons for crashes are: - -* wrong arguments passed via `extraArgs` in the configuration; -* booting Talos on non-empty disk with previous Talos installation, `/var/lib/etcd` contains data from old cluster. - -### etcd is not running on non-bootstrap control plane node - -Service `etcd` on non-bootstrap control plane node waits for Kubernetes to boot successfully on bootstrap node to find -other peers to build a cluster. -As soon as bootstrap node boots Kubernetes control plane components, and `kubectl get endpoints` returns IP of bootstrap control plane node, other control plane nodes will start joining the cluster followed by Kubernetes control plane components on each control plane node. - -### Kubernetes static pod definitions are not generated - -Talos should write down static pod definitions for the Kubernetes control plane: - -```bash -$ talosctl -n ls /etc/kubernetes/manifests -NODE NAME -172.20.0.2 . -172.20.0.2 talos-kube-apiserver.yaml -172.20.0.2 talos-kube-controller-manager.yaml -172.20.0.2 talos-kube-scheduler.yaml -``` - -If static pod definitions are not rendered, check `etcd` and `kubelet` service health (see above), -and controller runtime logs (`talosctl logs controller-runtime`). - -### Talos prints error `an error on the server ("") has prevented the request from succeeding` - -This is expected during initial cluster bootstrap and sometimes after a reboot: - -```bash -[ 70.093289] [talos] task labelNodeAsMaster (1/1): starting -[ 80.094038] [talos] retrying error: an error on the server ("") has prevented the request from succeeding (get nodes talos-default-master-1) -``` - -Initially `kube-apiserver` component is not running yet, and it takes some time before it becomes fully up -during bootstrap (image should be pulled from the Internet, etc.) -Once control plane endpoint is up Talos should proceed. - -If Talos doesn't proceed further, it might be a configuration issue. - -In any case, status of control plane components can be checked with `talosctl containers -k`: - -```bash -$ talosctl -n containers --kubernetes -NODE NAMESPACE ID IMAGE PID STATUS -172.20.0.2 k8s.io kube-system/kube-apiserver-talos-default-master-1 k8s.gcr.io/pause:3.2 2539 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-apiserver-talos-default-master-1:kube-apiserver k8s.gcr.io/kube-apiserver:v1.20.4 2572 CONTAINER_RUNNING -``` - -If `kube-apiserver` shows as `CONTAINER_EXITED`, it might have exited due to configuration error. -Logs can be checked with `taloctl logs --kubernetes` (or with `-k` as a shorthand): - -```bash -$ talosctl -n logs -k kube-system/kube-apiserver-talos-default-master-1:kube-apiserver -172.20.0.2: 2021-03-05T20:46:13.133902064Z stderr F 2021/03/05 20:46:13 Running command: -172.20.0.2: 2021-03-05T20:46:13.133933824Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.2: 2021-03-05T20:46:13.133938524Z stderr F Run from directory: -172.20.0.2: 2021-03-05T20:46:13.13394154Z stderr F Executable path: /usr/local/bin/kube-apiserver -... -``` - -### Talos prints error `nodes "talos-default-master-1" not found` - -This error means that `kube-apiserver` is up, and control plane endpoint is healthy, but `kubelet` hasn't got -its client certificate yet and wasn't able to register itself. - -For the `kubelet` to get its client certificate, following conditions should apply: - -* control plane endpoint is healthy (`kube-apiserver` is running) -* bootstrap manifests got successfully deployed (for CSR auto-approval) -* `kube-controller-manager` is running - -CSR state can be checked with `kubectl get csr`: - -```bash -$ kubectl get csr -NAME AGE SIGNERNAME REQUESTOR CONDITION -csr-jcn9j 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-p6b9q 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-sw6rm 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -csr-vlghg 14m kubernetes.io/kube-apiserver-client-kubelet system:bootstrap:q9pyzr Approved,Issued -``` - -### Talos prints error `node not ready` - -Node in Kubernetes is marked as `Ready` once CNI is up. -It takes a minute or two for the CNI images to be pulled and for the CNI to start. -If the node is stuck in this state for too long, check CNI pods and logs with `kubectl`, usually -CNI resources are created in `kube-system` namespace. -For example, for Talos default Flannel CNI: - -```bash -$ kubectl -n kube-system get pods -NAME READY STATUS RESTARTS AGE -... -kube-flannel-25drx 1/1 Running 0 23m -kube-flannel-8lmb6 1/1 Running 0 23m -kube-flannel-gl7nx 1/1 Running 0 23m -kube-flannel-jknt9 1/1 Running 0 23m -... -``` - -### Talos prints error `x509: certificate signed by unknown authority` - -Full error might look like: - -```bash -x509: certificate signed by unknown authority (possiby because of crypto/rsa: verification error" while trying to verify candidate authority certificate "kubernetes" -``` - -Commonly, the control plane endpoint points to a different cluster, as the client certificate -generated by Talos doesn't match CA of the cluster at control plane endpoint. - -### etcd is running on bootstrap node, but stuck in `pre` state on non-bootstrap nodes - -Please see question `etcd is not running on non-bootstrap control plane node`. - -### Checking `kube-controller-manager` and `kube-scheduler` - -If control plane endpoint is up, status of the pods can be performed with `kubectl`: - -```bash -$ kubectl get pods -n kube-system -l k8s-app=kube-controller-manager -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 28m -kube-controller-manager-talos-default-master-2 1/1 Running 0 28m -kube-controller-manager-talos-default-master-3 1/1 Running 0 28m -``` - -If control plane endpoint is not up yet, container status can be queried with -`talosctl containers --kubernetes`: - -```bash -$ talosctl -n c -k -NODE NAMESPACE ID IMAGE PID STATUS -... -172.20.0.2 k8s.io kube-system/kube-controller-manager-talos-default-master-1 k8s.gcr.io/pause:3.2 2547 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager k8s.gcr.io/kube-controller-manager:v1.20.4 2580 CONTAINER_RUNNING -172.20.0.2 k8s.io kube-system/kube-scheduler-talos-default-master-1 k8s.gcr.io/pause:3.2 2638 SANDBOX_READY -172.20.0.2 k8s.io └─ kube-system/kube-scheduler-talos-default-master-1:kube-scheduler k8s.gcr.io/kube-scheduler:v1.20.4 2670 CONTAINER_RUNNING -... -``` - -If some of the containers are not running, it could be that image is still being pulled. -Otherwise process might crashing, in that case logs can be checked with `talosctl logs --kubernetes `: - -```bash -$ talosctl -n logs -k kube-system/kube-controller-manager-talos-default-master-1:kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291667526Z stderr F 2021/03/09 13:59:34 Running command: -172.20.0.3: 2021-03-09T13:59:34.291702262Z stderr F Command env: (log-file=, also-stdout=false, redirect-stderr=true) -172.20.0.3: 2021-03-09T13:59:34.291707121Z stderr F Run from directory: -172.20.0.3: 2021-03-09T13:59:34.291710908Z stderr F Executable path: /usr/local/bin/kube-controller-manager -172.20.0.3: 2021-03-09T13:59:34.291719163Z stderr F Args (comma-delimited): /usr/local/bin/kube-controller-manager,--allocate-node-cidrs=true,--cloud-provider=,--cluster-cidr=10.244.0.0/16,--service-cluster-ip-range=10.96.0.0/12,--cluster-signing-cert-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--cluster-signing-key-file=/system/secrets/kubernetes/kube-controller-manager/ca.key,--configure-cloud-routes=false,--kubeconfig=/system/secrets/kubernetes/kube-controller-manager/kubeconfig,--leader-elect=true,--root-ca-file=/system/secrets/kubernetes/kube-controller-manager/ca.crt,--service-account-private-key-file=/system/secrets/kubernetes/kube-controller-manager/service-account.key,--profiling=false -172.20.0.3: 2021-03-09T13:59:34.293870359Z stderr F 2021/03/09 13:59:34 Now listening for interrupts -172.20.0.3: 2021-03-09T13:59:34.761113762Z stdout F I0309 13:59:34.760982 10 serving.go:331] Generated self-signed cert in-memory -... -``` - -### Checking controller runtime logs - -Talos runs a set of controllers which work on resources to build and support Kubernetes control plane. - -Some debugging information can be queried from the controller logs with `talosctl logs controller-runtime`: - -```bash -$ talosctl -n logs controller-runtime -172.20.0.2: 2021/03/09 13:57:11 secrets.EtcdController: controller starting -172.20.0.2: 2021/03/09 13:57:11 config.MachineTypeController: controller starting -172.20.0.2: 2021/03/09 13:57:11 k8s.ManifestApplyController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.BootstrapStatusController: controller starting -172.20.0.2: 2021/03/09 13:57:11 v1alpha1.TimeStatusController: controller starting -... -``` - -Controllers run reconcile loop, so they might be starting, failing and restarting, that is expected behavior. -Things to look for: - -`v1alpha1.BootstrapStatusController: bootkube initialized status not found`: control plane is not self-hosted, running with static pods. - -`k8s.KubeletStaticPodController: writing static pod "/etc/kubernetes/manifests/talos-kube-apiserver.yaml"`: static pod definitions were rendered successfully. - -`k8s.ManifestApplyController: controller failed: error creating mapping for object /v1/Secret/bootstrap-token-q9pyzr: an error on the server ("") has prevented the request from succeeding`: control plane endpoint is not up yet, bootstrap manifests can't be injected, controller is going to retry. - -`k8s.KubeletStaticPodController: controller failed: error refreshing pod status: error fetching pod status: an error on the server ("Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)") has prevented the request from succeeding`: kubelet hasn't been able to contact `kube-apiserver` yet to push pod status, controller -is going to retry. - -`k8s.ManifestApplyController: created rbac.authorization.k8s.io/v1/ClusterRole/psp:privileged`: one of the bootstrap manifests got successfully applied. - -`secrets.KubernetesController: controller failed: missing cluster.aggregatorCA secret`: Talos is running with 0.8 configuration, if the cluster was upgraded from 0.8, this is expected, and conversion process will fix machine config -automatically. -If this cluster was bootstrapped with version 0.9, machine configuration should be regenerated with 0.9 talosctl. - -If there are no new messages in `controller-runtime` log, it means that controllers finished reconciling successfully. - -### Checking static pod definitions - -Talos generates static pod definitions for `kube-apiserver`, `kube-controller-manager`, and `kube-scheduler` -components based on machine configuration. -These definitions can be checked as resources with `talosctl get staticpods`: - -```bash -$ talosctl -n get staticpods -o yaml -get staticpods -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 2 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "1" - creationTimestamp: null - labels: - k8s-app: kube-apiserver - tier: control-plane - name: kube-apiserver - namespace: kube-system -... -``` - -Status of the static pods can queried with `talosctl get staticpodstatus`: - -```bash -$ talosctl -n get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 1 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 1 True -``` - -Most important status is `Ready` printed as last column, complete status can be fetched by adding `-o yaml` flag. - -### Checking bootstrap manifests - -As part of bootstrap process, Talos injects bootstrap manifests into Kubernetes API server. -There are two kinds of manifests: system manifests built-in into Talos and extra manifests downloaded (custom CNI, extra manifests in the machine config): - -```bash -$ talosctl -n get manifests -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 controlplane Manifest 00-kubelet-bootstrapping-token 1 -172.20.0.2 controlplane Manifest 01-csr-approver-role-binding 1 -172.20.0.2 controlplane Manifest 01-csr-node-bootstrap 1 -172.20.0.2 controlplane Manifest 01-csr-renewal-role-binding 1 -172.20.0.2 controlplane Manifest 02-kube-system-sa-role-binding 1 -172.20.0.2 controlplane Manifest 03-default-pod-security-policy 1 -172.20.0.2 controlplane Manifest 05-https://docs.projectcalico.org/manifests/calico.yaml 1 -172.20.0.2 controlplane Manifest 10-kube-proxy 1 -172.20.0.2 controlplane Manifest 11-core-dns 1 -172.20.0.2 controlplane Manifest 11-core-dns-svc 1 -172.20.0.2 controlplane Manifest 11-kube-config-in-cluster 1 -``` - -Details of each manifests can be queried by adding `-o yaml`: - -```bash -$ talosctl -n get manifests 01-csr-approver-role-binding --namespace=controlplane -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: Manifests.kubernetes.talos.dev - id: 01-csr-approver-role-binding - version: 1 - phase: running -spec: - - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - name: system-bootstrap-approve-node-client-csr - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:certificates.k8s.io:certificatesigningrequests:nodeclient - subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: system:bootstrappers -``` - -### Worker node is stuck with `apid` health check failures - -Control plane nodes have enough secret material to generate `apid` server certificates, but worker nodes -depend on control plane `trustd` services to generate certificates. -Worker nodes wait for `kubelet` to join the cluster, then `apid` queries Kubernetes endpoints via control plane -endpoint to find `trustd` endpoints, and use `trustd` to issue the certficiate. - -So if `apid` health checks is failing on worker node: - -* make sure control plane endpoint is healthy -* check that worker node `kubelet` joined the cluster diff --git a/website/content/v0.10/guides/upgrading-kubernetes.md b/website/content/v0.10/guides/upgrading-kubernetes.md deleted file mode 100644 index ee4a20d26..000000000 --- a/website/content/v0.10/guides/upgrading-kubernetes.md +++ /dev/null @@ -1,281 +0,0 @@ ---- -title: Upgrading Kubernetes ---- - -This guide covers Kubernetes control plane upgrade for clusters running Talos-managed control plane. -If the cluster is still running self-hosted control plane (after upgrade from Talos 0.8), please -refer to 0.8 docs. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Automated Kubernetes Upgrade - -To upgrade from Kubernetes v1.20.1 to v1.20.4 run: - -```bash -$ talosctl --nodes upgrade-k8s --from 1.20.1 --to 1.20.4 -discovered master nodes ["172.20.0.2" "172.20.0.3" "172.20.0.4"] -updating "kube-apiserver" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:01 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:05 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:55:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-controller-manager" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:55:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:55:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:56:07 retrying error: config version mismatch: got "2", expected "3" -updating "kube-scheduler" to version "1.20.4" - > updating node "172.20.0.2" -2021/03/09 19:56:27 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.3" -2021/03/09 19:56:47 retrying error: config version mismatch: got "2", expected "3" - > updating node "172.20.0.4" -2021/03/09 19:57:08 retrying error: config version mismatch: got "2", expected "3" -updating daemonset "kube-proxy" to version "1.20.4" -``` - -Script runs in two phases: - -1. In the first phase every control plane node machine configuration is patched with new image version for each control plane component. - Talos renders new static pod definition on configuration update which is picked up by the kubelet. - Script waits for the change to propagate to the API server state. - Messages `config version mismatch` indicate that script is waiting for the updated container to be registered in the API server. -2. In the second phase script updates `kube-proxy` daemonset with the new image version. - -If script fails for any reason, it can be safely restarted to continue upgrade process. - -## Manual Kubernetes Upgrade - -Kubernetes can be upgraded manually as well by following the steps outlined below. -They are equivalent to the steps performed by the `talosctl upgrade-k8s` command. - -### Kubeconfig - -In order to edit the control plane, we will need a working `kubectl` config. -If you don't already have one, you can get one by running: - -```bash -talosctl --nodes kubeconfig -``` - -### API Server - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "k8s.gcr.io/kube-apiserver:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need to be adjusted if current machine configuration is missing `.cluster.apiServer.image` key. - -Also machine configuration can be edited manually with `talosctl -n edit mc --immediate`. - -Capture new version of `kube-apiserver` config with: - -```bash -$ talosctl -n get kcpc kube-apiserver -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-apiserver - version: 5 - phase: running -spec: - image: k8s.gcr.io/kube-apiserver:v1.20.4 - cloudProvider: "" - controlPlaneEndpoint: https://172.20.0.1:6443 - etcdServers: - - https://127.0.0.1:2379 - localPort: 6443 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `5`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -5 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-apiserver --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-apiserver-talos-default-master-1 1/1 Running 0 16m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Controller Manager - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/controllerManager/image", "value": "k8s.gcr.io/kube-controller-manager:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.controllerManager.image` key. - -Capture new version of `kube-controller-manager` config with: - -```bash -$ talosctl -n get kcpc kube-controller-manager -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-controller-manager - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-controller-manager:v1.20.4 - cloudProvider: "" - podCIDR: 10.244.0.0/16 - serviceCIDR: 10.96.0.0/12 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-controller-manager --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-controller-manager-talos-default-master-1 1/1 Running 0 35m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Scheduler - -Patch machine configuration using `talosctl patch` command: - -```bash -$ talosctl -n patch mc --immediate -p '[{"op": "replace", "path": "/cluster/scheduler/image", "value": "k8s.gcr.io/kube-scheduler:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -JSON patch might need be adjusted if current machine configuration is missing `.cluster.scheduler.image` key. - -Capture new version of `kube-scheduler` config with: - -```bash -$ talosctl -n get kcpc kube-scheduler -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: KubernetesControlPlaneConfigs.config.talos.dev - id: kube-scheduler - version: 3 - phase: running -spec: - image: k8s.gcr.io/kube-scheduler:v1.20.4 - extraArgs: {} - extraVolumes: [] -``` - -In this example, new version is `3`. -Wait for the new pod definition to propagate to the API server state (replace `talos-default-master-1` with the node name): - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -o jsonpath='{.items[0].metadata.annotations.talos\.dev/config\-version}' -3 -``` - -Check that the pod is running: - -```bash -$ kubectl get pod -n kube-system -l k8s-app=kube-scheduler --field-selector spec.nodeName=talos-default-master-1 -NAME READY STATUS RESTARTS AGE -kube-scheduler-talos-default-master-1 1/1 Running 0 39m -``` - -Repeat this process for every control plane node, verifying that state got propagated successfully between each node update. - -### Proxy - -In the proxy's `DaemonSet`, change: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.1 - tolerations: - - ... -``` - -to: - -```yaml -kind: DaemonSet -... -spec: - ... - template: - ... - spec: - containers: - - name: kube-proxy - image: k8s.gcr.io/kube-proxy:v1.20.4 - tolerations: - - ... - - key: node-role.kubernetes.io/control-plane - operator: Exists - effect: NoSchedule -``` - -To edit the `DaemonSet`, run: - -```bash -kubectl edit daemonsets -n kube-system kube-proxy -``` - -## Kubelet - -Upgrading Kubelet version requires Talos node reboot after machine configuration change. - -For every node, patch machine configuration with new kubelet version, wait for the node to reboot: - -```bash -$ talosctl -n patch mc -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "ghcr.io/talos-systems/kubelet:v1.20.4"}]' -patched mc at the node 172.20.0.2 -``` - -Once node boots with the new configuration, confirm upgrade with `kubectl get nodes `: - -```bash -$ kubectl get nodes talos-default-master-1 -NAME STATUS ROLES AGE VERSION -talos-default-master-1 Ready control-plane,master 123m v1.20.4 -``` diff --git a/website/content/v0.10/guides/upgrading-talos.md b/website/content/v0.10/guides/upgrading-talos.md deleted file mode 100644 index 080dd0655..000000000 --- a/website/content/v0.10/guides/upgrading-talos.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Upgrading Talos ---- - -Talos upgrades are effected by an API call. -The `talosctl` CLI utility will facilitate this. - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Upgrading from Talos 0.9 - -TBD - -### After Upgrade to 0.10 - -TBD - -## `talosctl` Upgrade - -To manually upgrade a Talos node, you will specify the node's IP address and the -installer container image for the version of Talos to which you wish to upgrade. - -For instance, if your Talos node has the IP address `10.20.30.40` and you want -to install the official version `v0.10.0`, you would enter a command such -as: - -```sh - $ talosctl upgrade --nodes 10.20.30.40 \ - --image ghcr.io/talos-systems/installer:v0.10.0 -``` - -There is an option to this command: `--preserve`, which can be used to explicitly tell Talos to either keep intact its ephemeral data or not. -In most cases, it is correct to just let Talos perform its default action. -However, if you are running a single-node control-plane, you will want to make sure that `--preserve=true`. - -If Talos fails to run the upgrade, the `--stage` flag may be used to perform the upgrade after a reboot -which is followed by another reboot to upgraded version. - - - -## Machine Configuration Changes - -TBD diff --git a/website/content/v0.10/guides/vip.md b/website/content/v0.10/guides/vip.md deleted file mode 100644 index 12205537d..000000000 --- a/website/content/v0.10/guides/vip.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Virtual (shared) IP ---- - -One of the biggest pain points when building a high-availability controlplane -is giving clients a single IP or URL at which they can reach any of the controlplane nodes. -The most common approaches all require external resources: reverse proxy, load -balancer, BGP, and DNS. - -Using a "Virtual" IP address, on the other hand, provides high availability -without external coordination or resources, so long as the controlplane members -share a layer 2 network. -In practical terms, this means that they are all connected via a switch, with no -router in between them. - -The term "virtual" is misleading here. -The IP address is real, and it is assigned to an interface. -Instead, what actually happens is that the controlplane machines vie for -control of the shared IP address. -There can be only one owner of the IP address at any given time, but if that -owner disappears or becomes non-responsive, another owner will be chosen, -and it will take up the mantle: the IP address. - -Talos has (as of version 0.9) built-in support for this form of shared IP address, -and it can utilize this for both the Kubernetes API server and the Talos endpoint set. -Talos uses `etcd` for elections and leadership (control) of the IP address. - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Choose your Shared IP - -To begin with, you should choose your shared IP address. -It should generally be a reserved, unused IP address in the same subnet as -your controlplane nodes. -It should not be assigned or assignable by your DHCP server. - -For our example, we will assume that the controlplane nodes have the following -IP addresses: - -- `192.168.0.10` -- `192.168.0.11` -- `192.168.0.12` - -We then choose our shared IP to be: - -> 192.168.0.15 - -## Configure your Talos Machines - -The shared IP setting is only valid for controlplane nodes. - -For the example above, each of the controlplane nodes should have the following -Machine Config snippet: - -```yaml -machine: - network: - interfaces: - - interface: eth0 - dhcp: true - vip: - ip: 192.168.0.15 -``` - -Obviously, for your own environment, the interface and the DHCP setting may -differ. -You are free to use static addressing (`cidr`) instead of DHCP. - -## Caveats - -In general, the shared IP should just work. -However, since it relies on `etcd` for elections, the shared IP will not come -alive until after you have bootstrapped Kubernetes. -In general, this is not a problem, but it does mean that you cannot use the -shared IP when issuing the `talosctl bootstrap` command. -Instead, that command will need to target one of the controlplane nodes -discretely. diff --git a/website/content/v0.10/introduction/_index.md b/website/content/v0.10/introduction/_index.md deleted file mode 100644 index 143d3ae12..000000000 --- a/website/content/v0.10/introduction/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Introduction" -weight: 1 ---- diff --git a/website/content/v0.10/introduction/getting-started.md b/website/content/v0.10/introduction/getting-started.md deleted file mode 100644 index 0d775df11..000000000 --- a/website/content/v0.10/introduction/getting-started.md +++ /dev/null @@ -1,461 +0,0 @@ ---- -title: Getting Started -weight: 3 ---- - -This document will walk you through installing a full Talos Cluster. -You may wish to read through the [Quickstart](../../introduction/quickstart/) first, to quickly create a local virtual cluster on your workstation. - -Regardless of where you run Talos, you will find that there is a pattern to deploying it. - -In general you will need to: - -- acquire the installation image -- decide on the endpoint for Kubernetes - - optionally create a load balancer -- configure Talos -- configure `talosctl` -- bootstrap Kubernetes - -## Prerequisites - -### `talosctl` - -The `talosctl` tool provides a CLI tool which interfaces with the Talos API in -an easy manner. -It also includes a number of useful tools for creating and managing your clusters. - -You should install `talosctl` before continuing: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -## Acquire the installation image - -The easiest way to install Talos is to use the ISO image. - -The latest ISO image can be found on the Github [Releases](https://github.com/talos-systems/talos/releases) page: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.10.0/talos-amd64.iso](https://github.com/siderolabs/talos/releases/download/v0.10.0/talos-amd64.iso) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.10.0/talos-arm64.iso](https://github.com/siderolabs/talos/releases/download/v0.10.0/talos-arm64.iso) - -For self-built media and network booting, you can use the kernel and initramfs: - -- X86: [https://github.com/siderolabs/talos/releases/download/v0.10.0/boot-amd64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.10.0/boot-amd64.tar.gz) -- ARM64: [https://github.com/siderolabs/talos/releases/download/v0.10.0/boot-ard64.tar.gz](https://github.com/siderolabs/talos/releases/download/v0.10.0/boot-ard64.tar.gz) - -When booted from the ISO, Talos will run in RAM, and it will not install itself -until it is provided a configuration. -Thus, it is safe to boot the ISO onto any machine. - -### Alternative Booting - -If you wish to use a different boot mechanism (such as network boot or a custom ISO), there -are a number of required kernel parameters. - -Please see the [kernel](../../reference/kernel/) docs for more information. - -## Decide the Kubernetes Endpoint - -In order to configure Kubernetes and bootstrap the cluster, Talos needs to know -what the endpoint (DNS name or IP address) of the Kubernetes API Server will be. - -The endpoint should be the fully-qualified HTTP(S) URL for the Kubernetes API -Server, which (by default) runs on port 6443 using HTTPS. - -Thus, the format of the endpoint may be something like: - -- `https://192.168.0.10:6443` -- `https://kube.mycluster.mydomain.com:6443` -- `https://[2001:db8:1234::80]:6443` - -Because the Kubernetes controlplane is meant to be supplied in a high -availability manner, we must also choose how to bind it to the servers -themselves. -There are three common ways to do this. - -### Dedicated Load-balancer - -If you are using a cloud provider or have your own load-balancer available (such -as HAProxy, nginx reverse proxy, or an F5 load-balancer), using -a dedicated load balancer is a natural choice. -Just create an appropriate frontend matching the endpoint, and point the backends at each of the addresses of the Talos controlplane nodes. - -This is convenient if a load-balancer is available, but don't worry if that is -not the case. - -### Layer 2 Shared IP - -Talos has integrated support for serving Kubernetes from a shared (sometimes -called "virtual") IP address. -This method relies on OSI Layer 2 connectivity between controlplane Talos nodes. - -In this case, we may choose an IP address on the same subnet as the Talos -controlplane nodes which is not otherwise assigned to any machine. -For instance, if your controlplane node IPs are: - -- 192.168.0.10 -- 192.168.0.11 -- 192.168.0.12 - -You could choose the ip `192.168.0.15` as your shared IP address. -Just make sure that `192.168.0.15` is not used by any other machine and that your DHCP -will not serve it to any other machine. - -Once chosen, form the full HTTPS URL from this IP: - -```url -https://192.168.0.15:6443 -``` - -You are also free to set a DNS record to this IP address instead, but you will -still need to use the IP address to set up the shared IP -(`machine.network.interfaces[].vip.ip`) inside the Talos -configuration. - -For more information about using a shared IP, see the related -[Guide](../../guides/vip/) - -### DNS records - -If neither of the other methods work for you, you can instead use DNS records to -provide a measure of redundancy. -In this case, you would add multiple A or AAAA records for a DNS name. - -For instance, you could add: - -```dns -kube.cluster1.mydomain.com IN A 192.168.0.10 -kube.cluster1.mydomain.com IN A 192.168.0.11 -kube.cluster1.mydomain.com IN A 192.168.0.12 -``` - -Then, your endpoint would be: - -```url -https://kube.cluster1.mydomain.com:6443 -``` - -## Decide how to access the Talos API - -Since Talos is entirely API-driven, it is important to know how you are going to -access that API. -Talos comes with a number of mechanisms to make that easier. - -Controlplane nodes can proxy requests for worker nodes. -This means that you only need access to the controlplane nodes in order to access -the rest of the network. -This is useful for security (your worker nodes do not need to have -public IPs or be otherwise connected to the Internet), and it also makes working -with highly-variable clusters easier, since you only need to know the -controlplane nodes in advance. - -Even better, the `talosctl` tool will automatically load balance and fail over -between all of your controlplane nodes, so long as it is informed of each of the -controlplane node IPs. - -That does, of course, present the problem that you need to know how to talk to -the controlplane nodes. -In some environments, it is easy to be able to forecast, prescribe, or discover -the controlplane node IP addresses. -For others, though, even the controlplane nodes are dynamic, unpredictable, and -undiscoverable. - -The dynamic options above for the Kubernetes API endpoint also apply to the -Talos API endpoints. -The difference is that the Talos API runs on port `50000/tcp`. - -Whichever way you wish to access the Talos API, be sure to note the IP(s) or -hostname(s) so that you can configure your `talosctl` tool's `endpoints` below. - -## Configure Talos - -When Talos boots without a configuration, such as when using the Talos ISO, it -enters a limited maintenance mode and waits for a configuration to be provided. - -Alternatively, the Talos installer can be booted with the `talos.config` kernel -commandline argument set to an HTTP(s) URL from which it should receive its -configuration. -In cases where a PXE server can be available, this is much more efficient than -manually configuring each node. -If you do use this method, just note that Talos does require a number of other -kernel commandline parameters. -See the [required kernel parameters](../../reference/kernel/) for more information. - -In either case, we need to generate the configuration which is to be provided. -Luckily, the `talosctl` tool comes with a configuration generator for exactly -this purpose. - -```sh - talosctl gen config "cluster-name" "cluster-endpoint" -``` - -Here, `cluster-name` is an arbitrary name for the cluster which will be used -in your local client configuration as a label. -It does not affect anything in the cluster itself. -It is arbitrary, but it should be unique in the configuration on your local workstation. - -The `cluster-endpoint` is where you insert the Kubernetes Endpoint you -selected from above. -This is the Kubernetes API URL, and it should be a complete URL, with `https://` -and port, if not `443`. -The default port is `6443`, so the port is almost always required. - -When you run this command, you will receive a number of files in your current -directory: - -- `controlplane.yaml` -- `init.yaml` -- `join.yaml` -- `talosconfig` - -The three `.yaml` files are what we call Machine Configs. -They are installed onto the Talos servers to act as their complete configuration, -describing everything from what disk Talos should be installed to, to what -sysctls to set, to what network settings it should have. -In the case of the `controlplane.yaml` and `init.yaml`, it even describes how Talos should form its Kubernetes cluster. - -The `talosconfig` file (which is also YAML) is your local client configuration -file. - -### Controlplane, Init, and Join - -The three types of Machine Configs correspond to the three roles of Talos nodes. -For our purposes, you can ignore the Init type. -It is a legacy type which will go away eventually. -Its purpose was to self-bootstrap. -Instead, we now use an API call to bootstrap the cluster, which is much more robust. - -That leaves us with Controlplane and Join. - -The Controlplane Machine Config describes the configuration of a Talos server on -which the Kubernetes Controlplane should run. -The Join Machine Config describes everything else: workload servers. - -The main difference between Controlplane Machine Config files and Join Machine -Config files is that the former contains information about how to form the -Kubernetes cluster. - -### Templates - -The generated files can be thought of as templates. -Individual machines may need specific settings (for instance, each may have a -different static IP address). -When different files are needed for machines of the same type, simply -copy the source template (`controlplane.yaml` or `join.yaml`) and make whatever -modifications need to be done. - -For instance, if you had three controlplane nodes and three worker nodes, you -may do something like this: - -```bash - for i in $(seq 0 2); do - cp controlplane.yaml cp$i.yaml - end - for i in $(seq 0 2); do - cp join.yaml w$i.yaml - end -``` - -In cases where there is no special configuration needed, you may use the same -file for each machine of the same type. - -### Apply Configuration - -After you have generated each machine's Machine Config, you need to load them -into the mahines themselves. -For that, you need to know their IP addresses. - -If you have access to the console or console logs of the machines, you can read -them to find the IP address(es). -Talos will print them out during the boot process: - -```log -[ 4.605369] [talos] task loadConfig (1/1): this machine is reachable at: -[ 4.607358] [talos] task loadConfig (1/1): 192.168.0.2 -[ 4.608766] [talos] task loadConfig (1/1): server certificate fingerprint: -[ 4.611106] [talos] task loadConfig (1/1): xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= -[ 4.613822] [talos] task loadConfig (1/1): -[ 4.614985] [talos] task loadConfig (1/1): upload configuration using talosctl: -[ 4.616978] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --file -[ 4.620168] [talos] task loadConfig (1/1): or apply configuration using talosctl interactive installer: -[ 4.623046] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --interactive -[ 4.626365] [talos] task loadConfig (1/1): optionally with node fingerprint check: -[ 4.628692] [talos] task loadConfig (1/1): talosctl apply-config --insecure --nodes 192.168.0.2 --cert-fingerprint 'xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE=' --file -``` - -If you do not have console access, the IP address may also be discoverable from -your DHCP server. - -Once you have the IP address, you can then apply the correct configuration. - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --file cp0.yaml -``` - -The insecure flag is necessary at this point because the PKI infrastructure has -not yet been made available to the node. -Note that the connection _will_ be encrypted, it is just unauthenticated. - -If you have console access, though, you can extract the server -certificate fingerprint and use it for an additional layer of validation: - -```sh - talosctl apply-config --insecure \ - --nodes 192.168.0.2 \ - --cert-fingerprint xA9a1t2dMxB0NJ0qH1pDzilWbA3+DK/DjVbFaJBYheE= \ - --file cp0.yaml -``` - -Using the fingerprint allows you to be sure you are sending the configuration to -the right machine, but it is completely optional. - -After the configuration is applied to a node, it will reboot. - -You may repeat this process for each of the nodes in your cluster. - -## Configure your talosctl client - -Now that the nodes are running Talos with its full PKI security suite, you need -to use that PKI to talk to the machines. -That means configuring your client, and that is what that `talosconfig` file is for. - -### Endpoints - -Endpoints are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -In general, it is recommended that these point to the set of control plane -nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through -it, so it is not necessary to change the endpoint configuration just because you -wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the -target node, because these proxied connections reply on certificate-based -authentication. - -We need to set the `endpoints` in your `talosconfig`. -`talosctl` will automatically load balance and fail over among the endpoints, -so no external load balancer or DNS abstraction is required -(though you are free to use them, if desired). - -As an example, if the IP addresses of our controlplane nodes are: - -- 192.168.0.2 -- 192.168.0.3 -- 192.168.0.4 - -We would set those in the `talosconfig` with: - -```sh - talosctl --talosconfig=./talosconfig \ - config endpoint 192.168.0.2 192.168.0.3 192.168.0.4 -``` - -### Nodes - -The node is the target node on which you wish to perform the API call. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -Some people also like to set a default set of nodes in the `talosconfig`. -This can be done in the same manner, replacing `endpoint` with `node`. -If you do this, however, know that you could easily reboot the wrong machine -by forgetting to declare the right one explicitly. -Worse, if you set several nodes as defaults, you could, with one `talosctl upgrade` -command upgrade your whole cluster all at the same time. -It's a powerful tool, and with that comes great responsibility. -The author of this document does not set a default node. - -You may simply provide `-n` or `--nodes` to any `talosctl` command to -supply the node or (comma-delimited) nodes on which you wish to perform the -operation. -Supplying the commandline parameter will override any default nodes -in the configuration file. - -To verify default node(s) you're currently configured to use, you can run: - -```bash -$ talosctl version -Client: - ... -Server: - NODE: - ... -``` - -For a more in-depth discussion of Endpoints and Nodes, please see -[talosctl](../../learn-more/talosctl/). - -### Default configuration file - -You _can_ reference which configuration file to use directly with the `--talosconfig` parameter: - -```sh - talosctl --talosconfig=./talosconfig \ - --nodes 192.168.0.2 version -``` - -However, `talosctl` comes with tooling to help you integrate and merge this -configuration into the default `talosctl` configuration file. -This is done with the `merge` option. - -```sh - talosctl config merge ./talosconfig -``` - -This will merge your new `talosconfig` into the default configuration file -(`$XDG_CONFIG_HOME/talos/config.yaml`), creating it if necessary. -Like Kubernetes, the `talosconfig` configuration files has multiple "contexts" -which correspond to multiple clusters. -The `` you chose above will be used as the context name. - -## Kubernetes Bootstrap - -All of your machines are configured, and your `talosctl` client is set up. -Now, you are ready to bootstrap your Kubernetes cluster. -If that sounds daunting, you haven't used Talos before. - -Bootstrapping your Kubernetes cluster with Talos is as simple as: - -```sh - talosctl bootstrap --nodes 192.168.0.2 -``` - -The IP there can be any of your controlplanes (or the loadbalancer, if you have -one). -It should only be issued once. - -At this point, Talos will form an `etcd` cluster, generate all of the core -Kubernetes assets, and start the Kubernetes controlplane components. - -After a few moments, you will be able to download your Kubernetes client -configuration and get started: - -```sh - talosctl kubeconfig -``` - -Running this command will add (merge) you new cluster into you local Kubernetes -configuration in the same way as `talosctl config merge` merged the Talos client -configuration into your local Talos client configuration file. - -If you would prefer for the configuration to _not_ be merged into your default -Kubernetes configuration file, simple tell it a filename: - -```sh - talosctl kubeconfig alternative-kubeconfig -``` - -If all goes well, you should now be able to connect to Kubernetes and see your -nodes: - -```sh - kubectl get nodes -``` diff --git a/website/content/v0.10/introduction/quickstart.md b/website/content/v0.10/introduction/quickstart.md deleted file mode 100644 index 514a865f4..000000000 --- a/website/content/v0.10/introduction/quickstart.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Quickstart -weight: 2 ---- - -The easiest way to try Talos is by using the CLI (`talosctl`) to create a cluster on a machine with `docker` installed. - -## Prerequisites - -### `talosctl` - -Download `talosctl`: - -```bash -curl -Lo /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/latest/download/talosctl-$(uname -s | tr "[:upper:]" "[:lower:]")-amd64 -chmod +x /usr/local/bin/talosctl -``` - -### `kubectl` - -Download `kubectl` via one of methods outlined in the [documentation](https://kubernetes.io/docs/tasks/tools/install-kubectl/). - -## Create the Cluster - -Now run the following: - -```bash -talosctl cluster create -``` - -Verify that you can reach Kubernetes: - -```bash -$ kubectl get nodes -o wide -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-default-master-1 Ready master 115s v1.20.2 10.5.0.2 Talos (v0.10.0) containerd://1.4.3 -talos-default-worker-1 Ready 115s v1.20.2 10.5.0.3 Talos (v0.10.0) containerd://1.4.3 -``` - -## Destroy the Cluster - -When you are all done, remove the cluster: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.10/introduction/system-requirements.md b/website/content/v0.10/introduction/system-requirements.md deleted file mode 100644 index ee5cbe6df..000000000 --- a/website/content/v0.10/introduction/system-requirements.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Requirements -weight: 4 ---- - -## Minimum Requirements - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane2GB2
Worker1GB1
- -## Recommended - - - - - - - - - - - - - - - - - - - - - -
RoleMemoryCores
Init/Control Plane4GB4
Worker2GB2
- -These requirements are similar to that of kubernetes. diff --git a/website/content/v0.10/introduction/what-is-new.md b/website/content/v0.10/introduction/what-is-new.md deleted file mode 100644 index f65eda180..000000000 --- a/website/content/v0.10/introduction/what-is-new.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: What's New in Talos 0.10 -weight: 5 ---- - -## Disaster Recovery - -Talos now supports `etcd` [snapshots and recovery](../../guides/disaster-recovery/) from the snapshotted state. -Periodic snapshots of `etcd` data can be taken with `talosctl etcd snapshot` command, and in case of catastrophic control plane -failure `etcd` contents can be recovered from the latest snapshot with `talosctl bootstrap --recover-from=` command. - -## Time Synchronization - -The `timed` service was replaced with a new time sync controller without any machine configuration changes. -There should be no user-visible changes in the way new time synchronization process works, logs are now -available via `talosctl logs controller-runtime`. -Talos now prefers last successful time server (by IP address) on each sync attempt, which improves sync accuracy. - -## Single Board Computers - -Talos added support for the [Radxa Rock PI 4c](../../single-board-computers/rockpi_4/) board. -`u-boot` version was updated to fix the boot and USB issues on Raspberry Pi 4 8GiB version. - -## Optimizations - -Multiple optimizations were applied to reduce Talos `initramfs` size and memory footprint. -As a result, we see a reduction of memory usage of around 100 MiB for the core Talos components which leaves more resources available for you workloads. - -## Install Disk Selector - -Install section of the machine config now has `diskSelector` [field](../../reference/configuration/#installconfig) that allows querying install disk using the list of qualifiers: - -```yaml -... - install: - diskSelector: - size: >= 500GB - model: WDC* -... -``` - -`talosctl -n disks -i` can be used to check allowed disk qualifiers when the node is running in the maintenance mode. - -## Inline Kubernetes Manifests - -Kubernetes manifests can now be submitted in the machine configuration using the `cluster.inlineManifests` [field](../../reference/configuration/#clusterconfig), -which works same way as `cluster.extraManifests` field, but manifest contents are passed inline in the machine configuration. - -## Updated Components - -Linux: 5.10.19 -> 5.10.29 - -Kubernetes: 1.20.5 -> 1.21.0 - -Go: 1.15 -> 1.16 diff --git a/website/content/v0.10/introduction/what-is-talos.md b/website/content/v0.10/introduction/what-is-talos.md deleted file mode 100644 index 7ba56ac43..000000000 --- a/website/content/v0.10/introduction/what-is-talos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: What is Talos? -weight: 1 ---- - -Talos is a container optimized Linux distro; a reimagining of Linux for distributed systems such as Kubernetes. -Designed to be as minimal as possible while still maintaining practicality. -For these reasons, Talos has a number of features unique to it: - -- it is immutable -- it is atomic -- it is ephemeral -- it is minimal -- it is secure by default -- it is managed via a single declarative configuration file and gRPC API - -Talos can be deployed on container, cloud, virtualized, and bare metal platforms. - -## Why Talos - -In having less, Talos offers more. -Security. -Efficiency. -Resiliency. -Consistency. - -All of these areas are improved simply by having less. diff --git a/website/content/v0.10/learn-more/_index.md b/website/content/v0.10/learn-more/_index.md deleted file mode 100644 index 0c6fe17a0..000000000 --- a/website/content/v0.10/learn-more/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Learn More" -weight: 80 ---- diff --git a/website/content/v0.10/learn-more/architecture.md b/website/content/v0.10/learn-more/architecture.md deleted file mode 100644 index 59e8aabf5..000000000 --- a/website/content/v0.10/learn-more/architecture.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Architecture" -weight: 3 ---- - -Talos is designed to be **atomic** in _deployment_ and **modular** in _composition_. - -It is atomic in the sense that the entirety of Talos is distributed as a -single, self-contained image, which is versioned, signed, and immutable. - -It is modular in the sense that it is composed of many separate components -which have clearly defined gRPC interfaces which facilitate internal flexibility -and external operational guarantees. - -There are a number of components which comprise Talos. -All of the main Talos components communicate with each other by gRPC, through a socket on the local machine. -This imposes a clear separation of concerns and ensures that changes over time which affect the interoperation of components are a part of the public git record. -The benefit is that each component may be iterated and changed as its needs dictate, so long as the external API is controlled. -This is a key component in reducing coupling and maintaining modularity. - -## The File System - -One of the more unique design decisions in Talos is the layout of the root file system. -There are three "layers" to the Talos root file system. -At its' core the rootfs is a read-only squashfs. -The squashfs is then mounted as a loop device into memory. -This provides Talos with an immutable base. - -The next layer is a set of `tmpfs` file systems for runtime specific needs. -Aside from the standard pseudo file systems such as `/dev`, `/proc`, `/run`, `/sys` and `/tmp`, a special `/system` is created for internal needs. -One reason for this is that we need special files such as `/etc/hosts`, and `/etc/resolv.conf` to be writable (remember that the rootfs is read-only). -For example, at boot Talos will write `/system/etc/hosts` and the bind mount it over `/etc/hosts`. -This means that instead of making all of `/etc` writable, Talos only makes very specific files writable under `/etc`. - -All files under `/system` are completely reproducible. -For files and directories that need to persist across boots, Talos creates `overlayfs` file systems. -The `/etc/kubernetes` is a good example of this. -Directories like this are `overlayfs` backed by an XFS file system mounted at `/var`. - -The `/var` directory is owned by Kubernetes with the exception of the above `overlayfs` file systems. -This directory is writable and used by `etcd` (in the case of control plane nodes), the kubelet, and the CRI (containerd). diff --git a/website/content/v0.10/learn-more/components.md b/website/content/v0.10/learn-more/components.md deleted file mode 100644 index eed0fdee7..000000000 --- a/website/content/v0.10/learn-more/components.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: "Components" -weight: 4 ---- - -In this section, we discuss the various components that underpin Talos. - -## Components - -| Component | Description | -| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| apid | When interacting with Talos, the gRPC API endpoint you interact with directly is provided by `apid`. `apid` acts as the gateway for all component interactions and forwards the requests to `machined`. | -| containerd | An industry-standard container runtime with an emphasis on simplicity, robustness, and portability. To learn more, see the [containerd website](https://containerd.io). | -| machined | Talos replacement for the traditional Linux init-process. Specially designed to run Kubernetes and does not allow starting arbitrary user services. | -| networkd | Handles all of the host level network configuration. The configuration is defined under the `networking` key | -| kernel | The Linux kernel included with Talos is configured according to the recommendations outlined in the [Kernel Self Protection Project](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project). | -| trustd | To run and operate a Kubernetes cluster, a certain level of trust is required. Based on the concept of a 'Root of Trust', `trustd` is a simple daemon responsible for establishing trust within the system. | -| udevd | Implementation of `eudev` into `machined`. `eudev` is Gentoo's fork of udev, systemd's device file manager for the Linux kernel. It manages device nodes in /dev and handles all user space actions when adding or removing devices. To learn more, see the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Eudev). | - -### apid - -When interacting with Talos, the gRPC api endpoint you will interact with directly is `apid`. -Apid acts as the gateway for all component interactions. -Apid provides a mechanism to route requests to the appropriate destination when running on a control plane node. - -We'll use some examples below to illustrate what `apid` is doing. - -When a user wants to interact with a Talos component via `talosctl`, there are two flags that control the interaction with `apid`. -The `-e | --endpoints` flag specifies which Talos node ( via `apid` ) should handle the connection. -Typically this is a public-facing server. -The `-n | --nodes` flag specifies which Talos node(s) should respond to the request. -If `--nodes` is omitted, the first endpoint will be used. - -> Note: Typically, there will be an `endpoint` already defined in the Talos config file. -> Optionally, `nodes` can be included here as well. - -For example, if a user wants to interact with `machined`, a command like `talosctl -e cluster.talos.dev memory` may be used. - -```bash -$ talosctl -e cluster.talos.dev memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -cluster.talos.dev 7938 1768 2390 145 53 3724 6571 -``` - -In this case, `talosctl` is interacting with `apid` running on `cluster.talos.dev` and forwarding the request to the `machined` api. - -If we wanted to extend our example to retrieve `memory` from another node in our cluster, we could use the command `talosctl -e cluster.talos.dev -n node02 memory`. - -```bash -$ talosctl -e cluster.talos.dev -n node02 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node02 7938 1768 2390 145 53 3724 6571 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `apid` running on `node02`, which forwards the request to the `machined` api. - -We can further extend our example to retrieve `memory` for all nodes in our cluster by appending additional `-n node` flags or using a comma separated list of nodes ( `-n node01,node02,node03` ): - -```bash -$ talosctl -e cluster.talos.dev -n node01 -n node02 -n node03 memory -NODE TOTAL USED FREE SHARED BUFFERS CACHE AVAILABLE -node01 7938 871 4071 137 49 2945 7042 -node02 257844 14408 190796 18138 49 52589 227492 -node03 257844 1830 255186 125 49 777 254556 -``` - -The `apid` instance on `cluster.talos.dev` receives the request and forwards it to `node01`, `node02`, and `node03`, which then forwards the request to their local `machined` api. - -### containerd - -[Containerd](https://github.com/containerd/containerd) provides the container runtime to launch workloads on Talos and Kubernetes. - -Talos services are namespaced under the `system` namespace in containerd, whereas the Kubernetes services are namespaced under the `k8s.io` namespace. - -### machined - -A common theme throughout the design of Talos is minimalism. -We believe strongly in the UNIX philosophy that each program should do one job well. -The `init` included in Talos is one example of this, and we are calling it "`machined`". - -We wanted to create a focused `init` that had one job - run Kubernetes. -To that extent, `machined` is relatively static in that it does not allow for arbitrary user-defined services. -Only the services necessary to run Kubernetes and manage the node are available. -This includes: - -- containerd -- [kubelet](https://kubernetes.io/docs/concepts/overview/components/) -- networkd -- trustd -- udevd - -### networkd - -Networkd handles all of the host level network configuration. -The configuration is defined under the `networking` key. - -By default, we attempt to issue a DHCP request for every interface on the server. -This can be overridden by supplying one of the following kernel arguments: - -- `talos.network.interface.ignore` - specify a list of interfaces to skip discovery on -- `ip` - `ip=:::::::::` as documented in the [kernel here](https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt) - - ex, `ip=10.0.0.99:::255.0.0.0:control-1:eth0:off:10.0.0.1` - -### kernel - -The Linux kernel included with Talos is configured according to the recommendations outlined in the Kernel Self Protection Project ([KSSP](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project)). - -### trustd - -Security is one of the highest priorities within Talos. -To run a Kubernetes cluster, a certain level of trust is required to operate a cluster. -For example, orchestrating the bootstrap of a highly available control plane requires sensitive PKI data distribution. - -To that end, we created `trustd`. -Based on a Root of Trust concept, `trustd` is a simple daemon responsible for establishing trust within the system. -Once trust is established, various methods become available to the trustee. -For example, it can accept a write request from another node to place a file on disk. - -Additional methods and capabilities will be added to the `trustd` component to support new functionality in the rest of the Talos environment. - -### udevd - -Udevd handles the kernel device notifications and sets up the necessary links in `/dev`. diff --git a/website/content/v0.10/learn-more/concepts.md b/website/content/v0.10/learn-more/concepts.md deleted file mode 100644 index 04a7e129f..000000000 --- a/website/content/v0.10/learn-more/concepts.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: "Concepts" -weight: 2 ---- - -### Platform - -### Mode - -### Endpoint - -### Node diff --git a/website/content/v0.10/learn-more/control-plane.md b/website/content/v0.10/learn-more/control-plane.md deleted file mode 100644 index fa7ab6b81..000000000 --- a/website/content/v0.10/learn-more/control-plane.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Control Plane" -weight: 8 ---- - -This guide provides details on how Talos runs and bootstraps the Kubernetes control plane. - -### High-level Overview - -Talos cluster bootstrap flow: - -1. The `etcd` service is started on control plane nodes. - Instances of `etcd` on control plane nodes build the `etcd` cluster. -2. The `kubelet` service is started. -3. Control plane components are started as static pods via the `kubelet`, and the `kube-apiserver` component connects to the local (running on the same node) `etcd` instance. -4. The `kubelet` issues client certificate using the bootstrap token using the control plane endpoint (via `kube-apiserver` and `kube-controller-manager`). -5. The `kubelet` registers the node in the API server. -6. Kubernetes control plane schedules pods on the nodes. - -### Cluster Bootstrapping - -All nodes start the `kubelet` service. -The `kubelet` tries to contact the control plane endpoint, but as it is not up yet, it keeps retrying. - -One of the control plane nodes is chosen as the bootstrap node. -The node's type can be either `init` or `controlplane`, where the `controlplane` type is promoted using the bootstrap API (`talosctl bootstrap`). -The bootstrap node initiates the `etcd` bootstrap process by initializing `etcd` as the first member of the cluster. - -> Note: there should be only one bootstrap node for the cluster lifetime. -> Once `etcd` is bootstrapped, the bootstrap node has no special role and acts the same way as other control plane nodes. - -Services `etcd` on non-bootstrap nodes try to get `Endpoints` resource via control plane endpoint, but that request fails as control plane endpoint is not up yet. - -As soon as `etcd` is up on the bootstrap node, static pod definitions for the Kubernetes control plane components (`kube-apiserver`, `kube-controller-manager`, `kube-scheduler`) are rendered to disk. -The `kubelet` service on the bootstrap node picks up the static pod definitions and starts the Kubernetes control plane components. -As soon as `kube-apiserver` is launched, the control plane endpoint comes up. - -The bootstrap node acquires an `etcd` mutex and injects the bootstrap manifests into the API server. -The set of the bootstrap manifests specify the Kubernetes join token and kubelet CSR auto-approval. -The `kubelet` service on all the nodes is now able to issue client certificates for themselves and register nodes in the API server. - -Other bootstrap manifests specify additional resources critical for Kubernetes operations (i.e. CNI, PSP, etc.) - -The `etcd` service on non-bootstrap nodes is now able to discover other members of the `etcd` cluster via the Kubernetes `Endpoints` resource. -The `etcd` cluster is now formed and consists of all control plane nodes. - -All control plane nodes render static pod manifests for the control plane components. -Each node now runs a full set of components to make the control plane HA. - -The `kubelet` service on worker nodes is now able to issue the client certificate and register itself with the API server. - -### Scaling Up the Control Plane - -When new nodes are added to the control plane, the process is the same as the bootstrap process above: the `etcd` service discovers existing members of the control plane via the -control plane endpoint, joins the `etcd` cluster, and the control plane components are scheduled on the node. - -### Scaling Down the Control Plane - -Scaling down the control plane involves removing a node from the cluster. -The most critical part is making sure that the node which is being removed leaves the etcd cluster. -When using `talosctl reset` command, the targeted control plane node leaves the `etcd` cluster as part of the reset sequence. - -### Upgrading Control Plane Nodes - -When a control plane node is upgraded, Talos leaves `etcd`, wipes the system disk, installs a new version of itself, and reboots. -The upgraded node then joins the `etcd` cluster on reboot. -So upgrading a control plane node is equivalent to scaling down the control plane node followed by scaling up with a new version of Talos. diff --git a/website/content/v0.10/learn-more/controllers-resources.md b/website/content/v0.10/learn-more/controllers-resources.md deleted file mode 100644 index d52e45875..000000000 --- a/website/content/v0.10/learn-more/controllers-resources.md +++ /dev/null @@ -1,227 +0,0 @@ ---- -title: "Controllers and Resources" -weight: 9 ---- - - - -Talos implements concepts of *resources* and *controllers* to facilitate internal operations of the operating system. -Talos resources and controllers are very similar to Kubernetes resources and controllers, but there are some differences. -The content of this document is not required to operate Talos, but it is useful for troubleshooting. - -Starting with Talos 0.9, most of the Kubernetes control plane boostrapping and operations is implemented via controllers and resources which allows Talos to be reactive to configuration changes, environment changes (e.g. time sync). - -## Resources - -A resource captures a piece of system state. -Each resource belongs to a "Type" which defines resource contents. -Resource state can be split in two parts: - -* metadata: fixed set of fields describing resource - namespace, type, ID, etc. -* spec: contents of the resource (depends on resource type). - -Resource is uniquely identified by (`namespace`, `type`, `id`). -Namespaces provide a way to avoid conflicts on duplicate resource IDs. - -At the moment of this writing, all resources are local to the node and stored in memory. -So on every reboot resource state is rebuilt from scratch (the only exception is `MachineConfig` resource which reflects current machine config). - -## Controllers - -Controllers run as independent lightweight threads in Talos. -The goal of the controller is to reconcile the state based on inputs and eventually update outputs. - -A controller can have any number of resource types (and namespaces) as inputs. -In other words, it watches specified resources for changes and reconciles when these changes occur. -A controller might also have additional inputs: running reconcile on schedule, watching `etcd` keys, etc. - -A controller has a single output: a set of resources of fixed type in a fixed namespace. -Only one controller can manage resource type in the namespace, so conflicts are avoided. - -## Querying Resources - -Talos CLI tool `talosctl` provides read-only access to the resource API which includes getting specific resource, listing resources and watching for changes. - -Talos stores resources describing resource types and namespaces in `meta` namespace: - -```bash -$ talosctl get resourcedefinitions -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta ResourceDefinition bootstrapstatuses.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition etcdsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetescontrolplaneconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition kubernetessecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition machineconfigs.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition machinetypes.config.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifests.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition manifeststatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition namespaces.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition resourcedefinitions.meta.cosi.dev 1 -172.20.0.2 meta ResourceDefinition rootsecrets.secrets.talos.dev 1 -172.20.0.2 meta ResourceDefinition secretstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition services.v1alpha1.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpods.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition staticpodstatuses.kubernetes.talos.dev 1 -172.20.0.2 meta ResourceDefinition timestatuses.v1alpha1.talos.dev 1 -``` - -```bash -$ talosctl get namespaces -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -172.20.0.2 meta Namespace controlplane 1 -172.20.0.2 meta Namespace meta 1 -172.20.0.2 meta Namespace runtime 1 -172.20.0.2 meta Namespace secrets 1 -``` - -Most of the time namespace flag (`--namespace`) can be omitted, as `ResourceDefinition` contains default namespace which is used if no namespace is given: - -```bash -$ talosctl get resourcedefinitions resourcedefinitions.meta.cosi.dev -o yaml -node: 172.20.0.2 -metadata: - namespace: meta - type: ResourceDefinitions.meta.cosi.dev - id: resourcedefinitions.meta.cosi.dev - version: 1 - phase: running -spec: - type: ResourceDefinitions.meta.cosi.dev - displayType: ResourceDefinition - aliases: - - resourcedefinitions - - resourcedefinition - - resourcedefinitions.meta - - resourcedefinitions.meta.cosi - - rd - - rds - printColumns: [] - defaultNamespace: meta -``` - -Resource definition also contains type aliases which can be used interchangeably with canonical resource name: - -```bash -$ talosctl get ns config -NODE NAMESPACE TYPE ID VERSION -172.20.0.2 meta Namespace config 1 -``` - -### Output - -Command `talosctl get` supports following output modes: - -* `table` (default) prints resource list as a table -* `yaml` prints pretty formatted resources with details, including full metadata spec. - This format carries most details from the backend resource (e.g. comments in `MachineConfig` resource) -* `json` prints same information as `yaml`, some additional details (e.g. comments) might be lost. - This format is useful for automated processing with tools like `jq`. - -### Watching Changes - -If flag `--watch` is appended to the `talosctl get` command, the command switches to watch mode. -If list of resources was requested, `talosctl` prints initial contents of the list and then appends resource information for every change: - -```bash -$ talosctl get svc -w -NODE * NAMESPACE TYPE ID VERSION RUNNING HEALTHY -172.20.0.2 + runtime Service timed 2 true true -172.20.0.2 + runtime Service trustd 2 true true -172.20.0.2 + runtime Service udevd 2 true true -172.20.0.2 - runtime Service timed 2 true true -172.20.0.2 + runtime Service timed 1 true false -172.20.0.2 runtime Service timed 2 true true -``` - -Column `*` specifies event type: - -* `+` is created -* `-` is deleted -* ` ` is updated - -In YAML/JSON output, field `event` is added to the resource representation to describe the event type. - -### Examples - -Getting machine config: - -```bash -$ talosctl get machineconfig -o yaml -node: 172.20.0.2 -metadata: - namespace: config - type: MachineConfigs.config.talos.dev - id: v1alpha1 - version: 2 - phase: running -spec: - version: v1alpha1 # Indicates the schema used to decode the contents. - debug: false # Enable verbose logging to the console. - persist: true # Indicates whether to pull the machine config upon every boot. - # Provides machine specific configuration options. -... -``` - -Getting control plane static pod statuses: - -```bash -$ talosctl get staticpodstatus -NODE NAMESPACE TYPE ID VERSION READY -172.20.0.2 controlplane StaticPodStatus kube-system/kube-apiserver-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-controller-manager-talos-default-master-1 3 True -172.20.0.2 controlplane StaticPodStatus kube-system/kube-scheduler-talos-default-master-1 4 True -``` - -Getting static pod definition for `kube-apiserver`: - -```bash -$ talosctl get sp kube-apiserver -n 172.20.0.2 -o yaml -node: 172.20.0.2 -metadata: - namespace: controlplane - type: StaticPods.kubernetes.talos.dev - id: kube-apiserver - version: 3 - phase: running - finalizers: - - k8s.StaticPodStatus("kube-apiserver") -spec: - apiVersion: v1 - kind: Pod - metadata: - annotations: - talos.dev/config-version: "1" - talos.dev/secrets-version: "2" -... -``` - -## Inspecting Controller Dependencies - -Talos can report current dependencies between controllers and resources for debugging purposes: - -```bash -$ talosctl inspect dependencies -digraph { - - n1[label="config.K8sControlPlaneController",shape="box"]; - n3[label="config.MachineTypeController",shape="box"]; - n2[fillcolor="azure2",label="config:KubernetesControlPlaneConfigs.config.talos.dev",shape="note",style="filled"]; -... -``` - -This outputs graph in `graphviz` format which can be rendered to PNG with command: - -```bash -talosctl inspect dependencies | dot -T png > deps.png -``` - -![Controller Dependencies](/images/controller-dependencies-v2.png) - -Graph can be enhanced by replacing resource types with actual resource instances: - -```bash -talosctl inspect dependencies --with-resources | dot -T png > deps.png -``` - -![Controller Dependencies with Resources](/images/controller-dependencies-with-resources-v2.png) diff --git a/website/content/v0.10/learn-more/faqs.md b/website/content/v0.10/learn-more/faqs.md deleted file mode 100644 index d797d9780..000000000 --- a/website/content/v0.10/learn-more/faqs.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: "FAQs" -weight: 6 ---- - - - -## How is Talos different from other container optimized Linux distros? - -Talos shares a lot of attributes with other distros, but there are some important differences. -Talos integrates tightly with Kubernetes, and is not meant to be a general-purpose operating system. -The most important difference is that Talos is fully controlled by an API via a gRPC interface, instead of an ordinary shell. -We don't ship SSH, and there is no console access. -Removing components such as these has allowed us to dramatically reduce the footprint of Talos, and in turn, improve a number of other areas like security, predictability, reliability, and consistency across platforms. -It's a big change from how operating systems have been managed in the past, but we believe that API-driven OSes are the future. - -## Why no shell or SSH? - -Since Talos is fully API-driven, all maintenance and debugging operations should be possible via the OS API. -We would like for Talos users to start thinking about what a "machine" is in the context of a Kubernetes cluster. -That is, that a Kubernetes _cluster_ can be thought of as one massive machine, and the _nodes_ are merely additional, undifferentiated resources. -We don't want humans to focus on the _nodes_, but rather on the _machine_ that is the Kubernetes cluster. -Should an issue arise at the node level, `talosctl` should provide the necessary tooling to assist in the identification, debugging, and remedation of the issue. -However, the API is based on the Principle of Least Privilege, and exposes only a limited set of methods. -We envision Talos being a great place for the application of [control theory](https://en.wikipedia.org/wiki/Control_theory) in order to provide a self-healing platform. - -## Why the name "Talos"? - -Talos was an automaton created by the Greek God of the forge to protect the island of Crete. -He would patrol the coast and enforce laws throughout the land. -We felt it was a fitting name for a security focused operating system designed to run Kubernetes. diff --git a/website/content/v0.10/learn-more/philosophy.md b/website/content/v0.10/learn-more/philosophy.md deleted file mode 100644 index a9c7dcebe..000000000 --- a/website/content/v0.10/learn-more/philosophy.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Philosophy -weight: 1 ---- - -## Distributed - -Talos is intended to be operated in a distributed manner. -That is, it is built for a high-availability dataplane _first_. -Its `etcd` cluster is built in an ad-hoc manner, with each appointed node joining on its own directive (with proper security validations enforced, of course). -Like as kubernetes itself, workloads are intended to be distributed across any number of compute nodes. - -There should be no single points of failure, and the level of required coordination is as low as each platform allows. - -## Immutable - -Talos takes immutability very seriously. -Talos itself, even when installed on a disk, always runs from a SquashFS image, meaning that even if a directory is mounted to be writable, the image itself is never modified. -All images are signed and delivered as single, versioned files. -We can always run integrity checks on our image to verify that it has not been modified. - -While Talos does allow a few, highly-controlled write points to the filesystem, we strive to make them as non-unique and non-critical as possible. -In fact, we call the writable partition the "ephemeral" partition precisely because we want to make sure none of us ever uses it for unique, non-replicated, non-recreatable data. -Thus, if all else fails, we can always wipe the disk and get back up and running. - -## Minimal - -We are always trying to reduce and keep small Talos' footprint. -Because nearly the entire OS is built from scratch in Go, we are already -starting out in a good position. -We have no shell. -We have no SSH. -We have none of the GNU utilities, not even a rollup tool such as busybox. -Everything which is included in Talos is there because it is necessary, and -nothing is included which isn't. - -As a result, the OS right now produces a SquashFS image size of less than **80 MB**. - -## Ephemeral - -Everything Talos writes to its disk is either replicated or reconstructable. -Since the controlplane is high availability, the loss of any node will cause -neither service disruption nor loss of data. -No writes are even allowed to the vast majority of the filesystem. -We even call the writable partition "ephemeral" to keep this idea always in -focus. - -## Secure - -Talos has always been designed with security in mind. -With its immutability, its minimalism, its signing, and its componenture, we are -able to simply bypass huge classes of vulnerabilities. -Moreover, because of the way we have designed Talos, we are able to take -advantage of a number of additional settings, such as the recommendations of the Kernel Self Protection Project (kspp) and the complete disablement of dynamic modules. - -There are no passwords in Talos. -All networked communication is encrypted and key-authenticated. -The Talos certificates are short-lived and automatically-rotating. -Kubernetes is always constructed with its own separate PKI structure which is -enforced. - -## Declarative - -Everything which can be configured in Talos is done so through a single YAML -manifest. -There is no scripting and no procedural steps. -Everything is defined by the one declarative YAML file. -This configuration includes that of both Talos itself and the Kubernetes which -it forms. - -This is achievable because Talos is tightly focused to do one thing: run -kubernetes, in the easiest, most secure, most reliable way it can. diff --git a/website/content/v0.10/learn-more/talosctl.md b/website/content/v0.10/learn-more/talosctl.md deleted file mode 100644 index 0c988e3af..000000000 --- a/website/content/v0.10/learn-more/talosctl.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: "talosctl" -weight: 7 ---- - -The `talosctl` tool packs a lot of power into a small package. -It acts as a reference implementation for the Talos API, but it also handles a lot of -conveniences for the use of Talos and its clusters. - -### Video Walkthrough - -To see some live examples of talosctl usage, view the following video: - - - -## Client Configuration - -Talosctl configuration is located in `$XDG_CONFIG_HOME/talos/config.yaml` if `$XDG_CONFIG_HOME` is defined. -Otherwise it is in `$HOME/.talos/config`. -The location can always be overridden by the `TALOSCONFIG` environment variable or the `--talosconfig` parameter. - -Like `kubectl`, `talosctl` uses the concept of configuration contexts, so any number of Talos clusters can be managed with a single configuration file. -Unlike `kubectl`, it also comes with some intelligent tooling to manage the merging of new contexts into the config. -The default operation is a non-destructive merge, where if a context of the same name already exists in the file, the context to be added is renamed by appending an index number. -You can easily overwrite instead, as well. -See the `talosctl config help` for more information. - -## Endpoints and Nodes - -![Endpoints and Nodes](/images/endpoints-and-nodes.png) - -The `endpoints` are the communication endpoints to which the client directly talks. -These can be load balancers, DNS hostnames, a list of IPs, etc. -Further, if multiple endpoints are specified, the client will automatically load -balance and fail over between them. -In general, it is recommended that these point to the set of control plane nodes, either directly or through a reverse proxy or load balancer. - -Each endpoint will automatically proxy requests destined to another node through it, so it is not necessary to change the endpoint configuration just because you wish to talk to a different node within the cluster. - -Endpoints _do_, however, need to be members of the same Talos cluster as the target node, because these proxied connections reply on certificate-based authentication. - -The `node` is the target node on which you wish to perform the API call. -While you can configure the target node (or even set of target nodes) inside the 'talosctl' configuration file, it is often useful to simply and explicitly declare the target node(s) using the `-n` or `--nodes` command-line parameter. - -Keep in mind, when specifying nodes that their IPs and/or hostnames are as seen by the endpoint servers, not as from the client. -This is because all connections are proxied first through the endpoints. - -## Kubeconfig - -The configuration for accessing a Talos Kubernetes cluster is obtained with `talosctl`. -By default, `talosctl` will safely merge the cluster into the default kubeconfig. -Like `talosctl` itself, in the event of a naming conflict, the new context name will be index-appended before insertion. -The `--force` option can be used to overwrite instead. - -You can also specify an alternate path by supplying it as a positional parameter. - -Thus, like Talos clusters themselves, `talosctl` makes it easy to manage any -number of kubernetes clusters from the same workstation. - -## Commands - -Please see the [CLI reference](https://www.talos.dev/docs/v0.10/reference/cli/) for the entire list of commands which are available from `talosctl`. diff --git a/website/content/v0.10/learn-more/upgrades.md b/website/content/v0.10/learn-more/upgrades.md deleted file mode 100644 index 00c957121..000000000 --- a/website/content/v0.10/learn-more/upgrades.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Upgrades -weight: 5 ---- - -## Talos - -The upgrade process for Talos, like everything else, begins with an API call. -This call tells a node the installer image to use to perform the upgrade. -Each Talos version corresponds to an installer with the same version, such that the -version of the installer is the version of Talos which will be installed. - -Because Talos is image based, even at run-time, upgrading Talos is almost -exactly the same set of operations as installing Talos, with the difference that -the system has already been initialized with a configuration. - -An upgrade makes use of an A-B image scheme in order to facilitate rollbacks. -This scheme retains the one previous Talos kernel and OS image following each upgrade. -If an upgrade fails to boot, Talos will roll back to the previous version. -Likewise, Talos may be manually rolled back via API (or `talosctl rollback`). -This will simply update the boot reference and reboot. - -An upgrade can `preserve` data or not. -If Talos is told to NOT preserve data, it will wipe its ephemeral partition, remove itself from the etcd cluster (if it is a control node), and generally make itself as pristine as is possible. -There are likely to be changes to the default option here over time, so if your setup has a preference to one way or the other, it is better to specify it explicitly, but we try to always be "safe" with this setting. - -### Sequence - -When a Talos node receives the upgrade command, the first thing it does is cordon -itself in kubernetes, to avoid receiving any new workload. -It then starts to drain away its existing workload. - -**NOTE**: If any of your workloads is sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks). - -Once all of the workload Pods are drained, Talos will start shutting down its -internal processes. -If it is a control node, this will include etcd. -If `preserve` is not enabled, Talos will even leave etcd membership. -(Don't worry about this; we make sure the etcd cluster is healthy and that it will remain healthy after our node departs, before we allow this to occur.) - -Once all the processes are stopped and the services are shut down, all of the -filesystems will be unmounted. -This allows Talos to produce a very clean upgrade, as close as possible to a pristine system. -We verify the disk and then perform the actual image upgrade. - -Finally, we tell the bootloader to boot _once_ with the new kernel and OS image. -Then we reboot. - -After the node comes back up and Talos verifies itself, it will make permanent -the bootloader change, rejoin the cluster, and finally uncordon itself to receive new workloads. - -### FAQs - -**Q.** What happens if an upgrade fails? - -**A.** There are many potential ways an upgrade can fail, but we always try to do -the safe thing. - -The most common first failure is an invalid installer image reference. -In this case, Talos will fail to download the upgraded image and will abort the upgrade. - -Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade. -In this case, it will abort the upgrade and reboot. - -It is possible (especially with test builds) that the upgraded Talos system will fail to start. -In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively aborting the upgrade. - -Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason. -This is when you would use the `talosctl rollback` command to revert back to the previous Talos version. - -**Q.** Can upgrades be scheduled? - -**A.** We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to coordinate upgrades of a cluster. -Additionally, because the upgrade sequence is API-driven, you can easily tie this in to your own business logic to schedule and coordinate your upgrades. - -**Q.** Can the upgrade process be observed? - -**A.** The Talos Controller Manager does this internally, watching the logs of -the node being upgraded, using the streaming log API of Talos. - -You can do the same thing using the `talosctl logs --follow machined` command. - -**Q.** Are worker node upgrades handled differently from control plane node upgrades? - -**A.** Short answer: no. - -Long answer: Both node types follow the same set procedure. -However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them. -From the user's standpoint, however, the processes are identical. - -There are also additional restrictions on upgrading control plane nodes. -For instance, Talos will refuse to upgrade a control plane node if that upgrade will cause a loss of quorum for etcd. -This can generally be worked around by setting `preserve` to `true`. - -**Q.** Will an upgrade try to do the whole cluster at once? -Can I break my cluster by upgrading everything? - -**A.** No. - -Nothing prevents the user from sending any number of near-simultaneous upgrades to each node of the cluster. -While most people would not attempt to do this, it may be the desired behaviour in certain situations. - -If, however, multiple control plane nodes are asked to upgrade at the same time, Talos will protect itself by making sure only one control plane node upgrades at any time, through its checking of etcd quorum. -A lease is taken out by the winning control plane node, and no other control plane node is allowed to execute the upgrade until the lease is released and the etcd cluster is healthy and _will_ be healthy when the next node performs its upgrade. - -**Q.** Is there an operator or controller which will keep my nodes updated -automatically? - -**A.** Yes. - -We provide the [Talos Controller Manager](https://github.com/talos-systems/talos-controller-manager) to perform this maintenance in a simple, controllable fashion. diff --git a/website/content/v0.10/local-platforms/_index.md b/website/content/v0.10/local-platforms/_index.md deleted file mode 100644 index e9b720762..000000000 --- a/website/content/v0.10/local-platforms/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Local Platforms" -weight: 50 ---- diff --git a/website/content/v0.10/local-platforms/docker.md b/website/content/v0.10/local-platforms/docker.md deleted file mode 100644 index 43e4ee443..000000000 --- a/website/content/v0.10/local-platforms/docker.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Docker -description: "Creating Talos Kubernetes cluster using Docker." ---- - -In this guide we will create a Kubernetes cluster in Docker, using a containerized version of Talos. - -Running Talos in Docker is intended to be used in CI pipelines, and local testing when you need a quick and easy cluster. -Furthermore, if you are running Talos in production, it provides an excellent way for developers to develop against the same version of Talos. - -## Requirements - -The follow are requirements for running Talos in Docker: - -- Docker 18.03 or greater -- a recent version of [`talosctl`](https://github.com/talos-systems/talos/releases) - -## Caveats - -Due to the fact that Talos runs in a container, certain APIs are not available when running in Docker. -For example `upgrade`, `reset`, and APIs like these don't apply in container mode. - -## Create the Cluster - -Creating a local cluster is as simple as: - -```bash -talosctl cluster create --wait -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -If you are running on MacOS, an additional command is required: - -```bash -talosctl config --endpoints 127.0.0.1 -``` - -> Note: Startup times can take up to a minute before the cluster is available. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -kubectl --kubeconfig kubeconfig config set-cluster talos-default --server https://127.0.0.1:6443 -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -## Cleaning Up - -To cleanup, run: - -```bash -talosctl cluster destroy -``` diff --git a/website/content/v0.10/local-platforms/firecracker.md b/website/content/v0.10/local-platforms/firecracker.md deleted file mode 100644 index 1a4e90933..000000000 --- a/website/content/v0.10/local-platforms/firecracker.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Firecracker -description: "Creating Talos Kubernetes cluster using Firecracker VMs." ---- - -In this guide we will create a Kubernetes cluster using Firecracker. - -> Note: Talos on [QEMU](../qemu/) offers easier way to run Talos in a set of VMs. - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- [firecracker](https://github.com/firecracker-microvm/firecracker/releases) (v0.21.0 or higher) -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` -- iptables -- `/etc/cni/conf.d` directory should exist -- `/var/run/netns` directory should exist - -## Installation - -### How to get firecracker (v0.21.0 or higher) - -You can download `firecracker` binary via -[github.com/firecracker-microvm/firecracker/releases](https://github.com/firecracker-microvm/firecracker/releases) - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download//firecracker-- -L -o firecracker -``` - -For example version `v0.21.1` for `linux` platform: - -```bash -curl https://github.com/firecracker-microvm/firecracker/releases/download/v0.21.1/firecracker-v0.21.1-x86_64 -L -o firecracker -sudo cp firecracker /usr/local/bin -sudo chmod +x /usr/local/bin/firecracker -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Install bridge, firewall and static required CNI plugins - -You can download standard CNI required plugins via -[github.com/containernetworking/plugins/releases](https://github.com/containernetworking/plugins/releases) - -```bash -curl https://github.com/containernetworking/plugins/releases/download//cni-plugins---tgz -L -o cni-plugins---.tgz -``` - -For example version `v0.9.5` for `linux` platform: - -```bash -curl https://github.com/containernetworking/plugins/releases/download/v0.9.5/cni-plugins-linux-amd64-v0.9.5.tgz -L -o cni-plugins-linux-amd64-v0.9.5.tgz -mkdir cni-plugins-linux -tar -xf cni-plugins-linux-amd64-v0.9.5.tgz -C cni-plugins-linux -sudo mkdir -p /opt/cni/bin -sudo cp cni-plugins-linux/{bridge,firewall,static} /opt/cni/bin -``` - -### Install tc-redirect-tap CNI plugin - -You should install CNI plugin from the `tc-redirect-tap` repository [github.com/awslabs/tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) - -```bash -go get -d github.com/awslabs/tc-redirect-tap/cmd/tc-redirect-tap -cd $GOPATH/src/github.com/awslabs/tc-redirect-tap -make all -sudo cp tc-redirect-tap /opt/cni/bin -``` - -> Note: if `$GOPATH` is not set, it defaults to `~/go`. - -## Install Talos kernel and initramfs - -Firecracker provisioner depends on Talos uncompressed kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz -L -o _out/vmlinuz -curl https://github.com/siderolabs/talos/releases/download//initramfs.xz -L -o _out/initramfs.xz -``` - -For example version `v0.10.0`: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/vmlinuz -L -o _out/vmlinuz -curl https://github.com/talos-systems/talos/releases/latest/download/initramfs.xz -L -o _out/initramfs.xz -``` - -## Create the Cluster - -```bash -sudo talosctl cluster create --provisioner firecracker -``` - -Once the above finishes successfully, your talosconfig(`~/.talos/config`) will be configured to point to the new cluster. - -## Retrieve and Configure the `kubeconfig` - -```bash -talosctl kubeconfig . -``` - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Talos, and Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner firecracker -PROVISIONER firecracker -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo talosctl cluster destroy --provisioner firecracker -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Stopping VMs - -Find the process of `firecracker --api-sock` execute: - -```bash -ps -elf | grep '[f]irecracker --api-sock' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep '[f]irecracker --api-sock' -4 S root 158065 157615 44 80 0 - 264152 - 07:54 ? 00:34:25 firecracker --api-sock /root/.talos/clusters/k8s/k8s-master-1.sock -4 S root 158216 157617 18 80 0 - 264152 - 07:55 ? 00:14:47 firecracker --api-sock /root/.talos/clusters/k8s/k8s-worker-1.sock -sudo kill -s SIGTERM 158065 -sudo kill -s SIGTERM 158216 -``` - -### Remove VMs - -Find the process of `talosctl firecracker-launch` execute: - -```bash -ps -elf | grep 'talosctl firecracker-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl firecracker-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl firecracker-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl firecracker-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch` execute: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`/root/.talos/clusters/` directory. - -```bash -sudo cat /root/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /root/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat /root/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -sudo ls -la /root/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -sudo su - -tail -f /root/.talos/clusters//*.log -``` - -## Post-installation - -After executing these steps and you should be able to use `kubectl` - -```bash -sudo talosctl kubeconfig . -mv kubeconfig $HOME/.kube/config -sudo chown $USER:$USER $HOME/.kube/config -``` diff --git a/website/content/v0.10/local-platforms/qemu.md b/website/content/v0.10/local-platforms/qemu.md deleted file mode 100644 index 69d0ff556..000000000 --- a/website/content/v0.10/local-platforms/qemu.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: QEMU -description: "Creating Talos Kubernetes cluster using QEMU VMs." ---- - -In this guide we will create a Kubernetes cluster using QEMU. - - - -## Video Walkthrough - -To see a live demo of this writeup, see the video below: - - - -## Requirements - -- Linux -- a kernel with - - KVM enabled (`/dev/kvm` must exist) - - `CONFIG_NET_SCH_NETEM` enabled - - `CONFIG_NET_SCH_INGRESS` enabled -- at least `CAP_SYS_ADMIN` and `CAP_NET_ADMIN` capabilities -- QEMU -- `bridge`, `static` and `firewall` CNI plugins from the [standard CNI plugins](https://github.com/containernetworking/cni), and `tc-redirect-tap` CNI plugin from the [awslabs tc-redirect-tap](https://github.com/awslabs/tc-redirect-tap) installed to `/opt/cni/bin` (installed automatically by `talosctl`) -- iptables -- `/var/run/netns` directory should exist - -## Installation - -### How to get QEMU - -Install QEMU with your operating system package manager. -For example, on Ubuntu for x86: - -```bash -apt install qemu-system-x86 qemu-kvm -``` - -### Install talosctl - -You can download `talosctl` and all required binaries via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -## Install Talos kernel and initramfs - -QEMU provisioner depends on Talos kernel (`vmlinuz`) and initramfs (`initramfs.xz`). -These files can be downloaded from the Talos release: - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//vmlinuz- -L -o _out/vmlinuz- -curl https://github.com/siderolabs/talos/releases/download//initramfs-.xz -L -o _out/initramfs-.xz -``` - -For example version `v0.10.0`: - -```bash -curl https://github.com/siderolabs/talos/releases/download/v0.10.0/vmlinuz-amd64 -L -o _out/vmlinuz-amd64 -curl https://github.com/siderolabs/talos/releases/download/v0.10.0/initramfs-amd64.xz -L -o _out/initramfs-amd64.xz -``` - -## Create the Cluster - -For the first time, create root state directory as your user so that you can inspect the logs as non-root user: - -```bash -mkdir -p ~/.talos/clusters -``` - -Create the cluster: - -```bash -sudo -E talosctl cluster create --provisioner qemu -``` - -Before the first cluster is created, `talosctl` will download the CNI bundle for the VM provisioning and install it to `~/.talos/cni` directory. - -Once the above finishes successfully, your talosconfig (`~/.talos/config`) will be configured to point to the new cluster, and `kubeconfig` will be -downloaded and merged into default kubectl config location (`~/.kube/config`). - -Cluster provisioning process can be optimized with [registry pull-through caches](../../guides/configuring-pull-through-cache/). - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl -n 10.5.0.2 containers` for a list of containers in the `system` namespace, or `talosctl -n 10.5.0.2 containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl -n 10.5.0.2 logs ` or `talosctl -n 10.5.0.2 logs -k `. - -A bridge interface will be created, and assigned the default IP 10.5.0.1. -Each node will be directly accessible on the subnet specified at cluster creation time. -A loadbalancer runs on 10.5.0.1 by default, which handles loadbalancing for the Kubernetes APIs. - -You can see a summary of the cluster state by running: - -```bash -$ talosctl cluster show --provisioner qemu -PROVISIONER qemu -NAME talos-default -NETWORK NAME talos-default -NETWORK CIDR 10.5.0.0/24 -NETWORK GATEWAY 10.5.0.1 -NETWORK MTU 1500 - -NODES: - -NAME TYPE IP CPU RAM DISK -talos-default-master-1 Init 10.5.0.2 1.00 1.6 GB 4.3 GB -talos-default-master-2 ControlPlane 10.5.0.3 1.00 1.6 GB 4.3 GB -talos-default-master-3 ControlPlane 10.5.0.4 1.00 1.6 GB 4.3 GB -talos-default-worker-1 Join 10.5.0.5 1.00 1.6 GB 4.3 GB -``` - -## Cleaning Up - -To cleanup, run: - -```bash -sudo -E talosctl cluster destroy --provisioner qemu -``` - -> Note: In that case that the host machine is rebooted before destroying the cluster, you may need to manually remove `~/.talos/clusters/talos-default`. - -## Manual Clean Up - -The `talosctl cluster destroy` command depends heavily on the clusters state directory. -It contains all related information of the cluster. -The PIDs and network associated with the cluster nodes. - -If you happened to have deleted the state folder by mistake or you would like to cleanup -the environment, here are the steps how to do it manually: - -### Remove VM Launchers - -Find the process of `talosctl qemu-launch`: - -```bash -ps -elf | grep 'talosctl qemu-launch' -``` - -To remove the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **157615** and **157617** - -```bash -ps -elf | grep '[t]alosctl qemu-launch' -0 S root 157615 2835 0 80 0 - 184934 - 07:53 ? 00:00:00 talosctl qemu-launch -0 S root 157617 2835 0 80 0 - 185062 - 07:53 ? 00:00:00 talosctl qemu-launch -sudo kill -s SIGTERM 157615 -sudo kill -s SIGTERM 157617 -``` - -### Stopping VMs - -Find the process of `qemu-system`: - -```bash -ps -elf | grep 'qemu-system' -``` - -To stop the VMs manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where VMs are running with PIDs **158065** and **158216** - -```bash -ps -elf | grep qemu-system -2 S root 1061663 1061168 26 80 0 - 1786238 - 14:05 ? 01:53:56 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/home/username/.talos/clusters/talos-default/bootstrap-master.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=1e:86:c6:b4:7c:c4 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=7ec0a73c-826e-4eeb-afd1-39ff9f9160ca -machine q35,accel=kvm -2 S root 1061663 1061170 67 80 0 - 621014 - 21:23 ? 00:00:07 qemu-system-x86_64 -m 2048 -drive format=raw,if=virtio,file=/homeusername/.talos/clusters/talos-default/pxe-1.disk -smp cpus=2 -cpu max -nographic -netdev tap,id=net0,ifname=tap0,script=no,downscript=no -device virtio-net-pci,netdev=net0,mac=36:f3:2f:c3:9f:06 -device virtio-rng-pci -no-reboot -boot order=cn,reboot-timeout=5000 -smbios type=1,uuid=ce12a0d0-29c8-490f-b935-f6073ab916a6 -machine q35,accel=kvm -sudo kill -s SIGTERM 1061663 -sudo kill -s SIGTERM 1061663 -``` - -### Remove load balancer - -Find the process of `talosctl loadbalancer-launch`: - -```bash -ps -elf | grep 'talosctl loadbalancer-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl loadbalancer-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl loadbalancer-launch --loadbalancer-addr 10.5.0.1 --loadbalancer-upstreams 10.5.0.2 -sudo kill -s SIGTERM 157609 -``` - -### Remove DHCP server - -Find the process of `talosctl dhcpd-launch`: - -```bash -ps -elf | grep 'talosctl dhcpd-launch' -``` - -To remove the LB manually, execute: - -```bash -sudo kill -s SIGTERM -``` - -Example output, where loadbalancer is running with PID **157609** - -```bash -ps -elf | grep '[t]alosctl dhcpd-launch' -4 S root 157609 2835 0 80 0 - 184998 - 07:53 ? 00:00:07 talosctl dhcpd-launch --state-path /home/username/.talos/clusters/talos-default --addr 10.5.0.1 --interface talosbd9c32bc -sudo kill -s SIGTERM 157609 -``` - -### Remove network - -This is more tricky part as if you have already deleted the state folder. -If you didn't then it is written in the `state.yaml` in the -`~/.talos/clusters/` directory. - -```bash -sudo cat ~/.talos/clusters//state.yaml | grep bridgename -bridgename: talos -``` - -If you only had one cluster, then it will be the interface with name -`talos` - -```bash -46: talos: mtu 1500 qdisc noqueue state DOWN group default qlen 1000 - link/ether a6:72:f4:0a:d3:9c brd ff:ff:ff:ff:ff:ff - inet 10.5.0.1/24 brd 10.5.0.255 scope global talos17c13299 - valid_lft forever preferred_lft forever - inet6 fe80::a472:f4ff:fe0a:d39c/64 scope link - valid_lft forever preferred_lft forever -``` - -To remove this interface: - -```bash -sudo ip link del talos -``` - -### Remove state directory - -To remove the state directory execute: - -```bash -sudo rm -Rf /home/$USER/.talos/clusters/ -``` - -## Troubleshooting - -### Logs - -Inspect logs directory - -```bash -sudo cat ~/.talos/clusters//*.log -``` - -Logs are saved under `--.log` - -For example in case of **k8s** cluster name: - -```bash -ls -la ~/.talos/clusters/k8s | grep log --rw-r--r--. 1 root root 69415 Apr 26 20:58 k8s-master-1.log --rw-r--r--. 1 root root 68345 Apr 26 20:58 k8s-worker-1.log --rw-r--r--. 1 root root 24621 Apr 26 20:59 lb.log -``` - -Inspect logs during the installation - -```bash -tail -f ~/.talos/clusters//*.log -``` diff --git a/website/content/v0.10/local-platforms/virtualbox.md b/website/content/v0.10/local-platforms/virtualbox.md deleted file mode 100644 index 73ea94fee..000000000 --- a/website/content/v0.10/local-platforms/virtualbox.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -title: VirtualBox -description: "Creating Talos Kubernetes cluster using VurtualBox VMs." ---- - -In this guide we will create a Kubernetes cluster using VirtualBox. - -## Video Walkthrough - -To see a live demo of this writeup, visit Youtube here: - - - -## Installation - -### How to Get VirtualBox - -Install VirtualBox with your operating system package manager or from the [website](https://www.virtualbox.org/). -For example, on Ubuntu for x86: - -```bash -apt install virtualbox -``` - -### Install talosctl - -You can download `talosctl` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -curl https://github.com/siderolabs/talos/releases/download//talosctl-- -L -o talosctl -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -curl https://github.com/talos-systems/talos/releases/latest/download/talosctl-linux-amd64 -L -o talosctl -sudo cp talosctl /usr/local/bin -sudo chmod +x /usr/local/bin/talosctl -``` - -### Download ISO Image - -In order to install Talos in VirtualBox, you will need the ISO image from the Talos release page. -You can download `talos-amd64.iso` via -[github.com/talos-systems/talos/releases](https://github.com/talos-systems/talos/releases) - -```bash -mkdir -p _out/ -curl https://github.com/siderolabs/talos/releases/download//talos-.iso -L -o _out/talos-.iso -``` - -For example version `v0.10.0` for `linux` platform: - -```bash -mkdir -p _out/ -curl https://github.com/talos-systems/talos/releases/latest/download/talos-amd64.iso -L -o _out/talos-amd64.iso -``` - -## Create VMs - -Start by creating a new VM by clicking the "New" button in the VirtualBox UI: - - - -Supply a name for this VM, and specify the Type and Version: - - - -Edit the memory to supply at least 2GB of RAM for the VM: - - - -Proceed through the disk settings, keeping the defaults. -You can increase the disk space if desired. - -Once created, select the VM and hit "Settings": - - - -In the "System" section, supply at least 2 CPUs: - - - -In the "Network" section, switch the network "Attached To" section to "Bridged Adapter": - - - -Finally, in the "Storage" section, select the optical drive and, on the right, select the ISO by browsing your filesystem: - - - -Repeat this process for a second VM to use as a worker node. -You can also repeat this for additional nodes desired. - -## Start Control Plane Node - -Once the VMs have been created and updated, start the VM that will be the first control plane node. -This VM will boot the ISO image specified earlier and enter "maintenance mode". -Once the machine has entered maintenance mode, there will be a console log that details the IP address that the node received. -Take note of this IP address, which will be referred to as `$CONTROL_PLANE_IP` for the rest of this guide. -If you wish to export this IP as a bash variable, simply issue a command like `export CONTROL_PLANE_IP=1.2.3.4`. - - - -## Generate Machine Configurations - -With the IP address above, you can now generate the machine configurations to use for installing Talos and Kubernetes. -Issue the following command, updating the output directory, cluster name, and control plane IP as you see fit: - -```bash -talosctl gen config talos-vbox-cluster https://$CONTROL_PLANE_IP:6443 --output-dir _out -``` - -This will create several files in the \_out directory: init.yaml, controlplane.yaml, join.yaml, and talosconfig. - -## Create Control Plane Node - -Using the `init.yaml` generated above, you can now apply this config using talosctl. -Issue: - -```bash -talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file _out/init.yaml -``` - -You should now see some action in the VirtualBox console for this VM. -Talos will be installed to disk, the VM will reboot, and then Talos will configure the Kubernetes control plane on this VM. - -> Note: This process can be repeated multiple times to create an HA control plane. -> Simply apply `controlplane.yaml` instead of `init.yaml` for subsequent nodes. - -## Create Worker Node - -Create at least a single worker node using a process similar to the control plane creation above. -Start the worker node VM and wait for it to enter "maintenance mode". -Take note of the worker node's IP address, which will be referred to as `$WORKER_IP` - -Issue: - -```bash -talosctl apply-config --insecure --nodes $WORKER_IP --file _out/join.yaml -``` - -> Note: This process can be repeated multiple times to add additional workers. - -## Using the Cluster - -Once the cluster is available, you can make use of `talosctl` and `kubectl` to interact with the cluster. -For example, to view current running containers, run `talosctl containers` for a list of containers in the `system` namespace, or `talosctl containers -k` for the `k8s.io` namespace. -To view the logs of a container, use `talosctl logs ` or `talosctl logs -k `. - -First, configure talosctl to talk to your control plane node by issuing the following, updating paths and IPs as necessary: - -```bash -export TALOSCONFIG="_out/talosconfig" -talosctl config endpoint $CONTROL_PLANE_IP -talosctl config node $CONTROL_PLANE_IP -``` - -## Retrieve and Configure the `kubeconfig` - -Fetch the kubeconfig file from the control plane node by issuing: - -```bash -talosctl kubeconfig -``` - -You can then use kubectl in this fashion: - -```bash -kubectl get nodes -``` - -## Cleaning Up - -To cleanup, simply stop and delete the virtual machines from the VirtualBox UI. diff --git a/website/content/v0.10/reference/_index.md b/website/content/v0.10/reference/_index.md deleted file mode 100644 index d548bde02..000000000 --- a/website/content/v0.10/reference/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Reference" -weight: 70 ---- diff --git a/website/content/v0.10/reference/api.md b/website/content/v0.10/reference/api.md deleted file mode 100644 index 5df49a0af..000000000 --- a/website/content/v0.10/reference/api.md +++ /dev/null @@ -1,3677 +0,0 @@ ---- -title: API -description: Talos gRPC API reference. ---- - -## Table of Contents - -- [common/common.proto](#common/common.proto) - - [Data](#common.Data) - - [DataResponse](#common.DataResponse) - - [Empty](#common.Empty) - - [EmptyResponse](#common.EmptyResponse) - - [Error](#common.Error) - - [Metadata](#common.Metadata) - - - [Code](#common.Code) - - [ContainerDriver](#common.ContainerDriver) - -- [health/health.proto](#health/health.proto) - - [HealthCheck](#health.HealthCheck) - - [HealthCheckResponse](#health.HealthCheckResponse) - - [HealthWatchRequest](#health.HealthWatchRequest) - - [ReadyCheck](#health.ReadyCheck) - - [ReadyCheckResponse](#health.ReadyCheckResponse) - - - [HealthCheck.ServingStatus](#health.HealthCheck.ServingStatus) - - [ReadyCheck.ReadyStatus](#health.ReadyCheck.ReadyStatus) - - - [Health](#health.Health) - -- [inspect/inspect.proto](#inspect/inspect.proto) - - [ControllerDependencyEdge](#inspect.ControllerDependencyEdge) - - [ControllerRuntimeDependenciesResponse](#inspect.ControllerRuntimeDependenciesResponse) - - [ControllerRuntimeDependency](#inspect.ControllerRuntimeDependency) - - - [DependencyEdgeType](#inspect.DependencyEdgeType) - - - [InspectService](#inspect.InspectService) - -- [machine/machine.proto](#machine/machine.proto) - - [ApplyConfiguration](#machine.ApplyConfiguration) - - [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) - - [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) - - [Bootstrap](#machine.Bootstrap) - - [BootstrapRequest](#machine.BootstrapRequest) - - [BootstrapResponse](#machine.BootstrapResponse) - - [CNIConfig](#machine.CNIConfig) - - [CPUInfo](#machine.CPUInfo) - - [CPUInfoResponse](#machine.CPUInfoResponse) - - [CPUStat](#machine.CPUStat) - - [CPUsInfo](#machine.CPUsInfo) - - [ClusterConfig](#machine.ClusterConfig) - - [ClusterNetworkConfig](#machine.ClusterNetworkConfig) - - [Container](#machine.Container) - - [ContainerInfo](#machine.ContainerInfo) - - [ContainersRequest](#machine.ContainersRequest) - - [ContainersResponse](#machine.ContainersResponse) - - [ControlPlaneConfig](#machine.ControlPlaneConfig) - - [CopyRequest](#machine.CopyRequest) - - [DHCPOptionsConfig](#machine.DHCPOptionsConfig) - - [DiskStat](#machine.DiskStat) - - [DiskStats](#machine.DiskStats) - - [DiskStatsResponse](#machine.DiskStatsResponse) - - [DiskUsageInfo](#machine.DiskUsageInfo) - - [DiskUsageRequest](#machine.DiskUsageRequest) - - [DmesgRequest](#machine.DmesgRequest) - - [EtcdForfeitLeadership](#machine.EtcdForfeitLeadership) - - [EtcdForfeitLeadershipRequest](#machine.EtcdForfeitLeadershipRequest) - - [EtcdForfeitLeadershipResponse](#machine.EtcdForfeitLeadershipResponse) - - [EtcdLeaveCluster](#machine.EtcdLeaveCluster) - - [EtcdLeaveClusterRequest](#machine.EtcdLeaveClusterRequest) - - [EtcdLeaveClusterResponse](#machine.EtcdLeaveClusterResponse) - - [EtcdMember](#machine.EtcdMember) - - [EtcdMemberListRequest](#machine.EtcdMemberListRequest) - - [EtcdMemberListResponse](#machine.EtcdMemberListResponse) - - [EtcdMembers](#machine.EtcdMembers) - - [EtcdRecover](#machine.EtcdRecover) - - [EtcdRecoverResponse](#machine.EtcdRecoverResponse) - - [EtcdRemoveMember](#machine.EtcdRemoveMember) - - [EtcdRemoveMemberRequest](#machine.EtcdRemoveMemberRequest) - - [EtcdRemoveMemberResponse](#machine.EtcdRemoveMemberResponse) - - [EtcdSnapshotRequest](#machine.EtcdSnapshotRequest) - - [Event](#machine.Event) - - [EventsRequest](#machine.EventsRequest) - - [FileInfo](#machine.FileInfo) - - [GenerateConfiguration](#machine.GenerateConfiguration) - - [GenerateConfigurationRequest](#machine.GenerateConfigurationRequest) - - [GenerateConfigurationResponse](#machine.GenerateConfigurationResponse) - - [Hostname](#machine.Hostname) - - [HostnameResponse](#machine.HostnameResponse) - - [InstallConfig](#machine.InstallConfig) - - [ListRequest](#machine.ListRequest) - - [LoadAvg](#machine.LoadAvg) - - [LoadAvgResponse](#machine.LoadAvgResponse) - - [LogsRequest](#machine.LogsRequest) - - [MachineConfig](#machine.MachineConfig) - - [MemInfo](#machine.MemInfo) - - [Memory](#machine.Memory) - - [MemoryResponse](#machine.MemoryResponse) - - [MountStat](#machine.MountStat) - - [Mounts](#machine.Mounts) - - [MountsResponse](#machine.MountsResponse) - - [NetDev](#machine.NetDev) - - [NetworkConfig](#machine.NetworkConfig) - - [NetworkDeviceConfig](#machine.NetworkDeviceConfig) - - [NetworkDeviceStats](#machine.NetworkDeviceStats) - - [NetworkDeviceStatsResponse](#machine.NetworkDeviceStatsResponse) - - [PhaseEvent](#machine.PhaseEvent) - - [PlatformInfo](#machine.PlatformInfo) - - [Process](#machine.Process) - - [ProcessInfo](#machine.ProcessInfo) - - [ProcessesRequest](#machine.ProcessesRequest) - - [ProcessesResponse](#machine.ProcessesResponse) - - [ReadRequest](#machine.ReadRequest) - - [Reboot](#machine.Reboot) - - [RebootResponse](#machine.RebootResponse) - - [Recover](#machine.Recover) - - [RecoverRequest](#machine.RecoverRequest) - - [RecoverResponse](#machine.RecoverResponse) - - [RemoveBootkubeInitializedKey](#machine.RemoveBootkubeInitializedKey) - - [RemoveBootkubeInitializedKeyResponse](#machine.RemoveBootkubeInitializedKeyResponse) - - [Reset](#machine.Reset) - - [ResetPartitionSpec](#machine.ResetPartitionSpec) - - [ResetRequest](#machine.ResetRequest) - - [ResetResponse](#machine.ResetResponse) - - [Restart](#machine.Restart) - - [RestartEvent](#machine.RestartEvent) - - [RestartRequest](#machine.RestartRequest) - - [RestartResponse](#machine.RestartResponse) - - [Rollback](#machine.Rollback) - - [RollbackRequest](#machine.RollbackRequest) - - [RollbackResponse](#machine.RollbackResponse) - - [RouteConfig](#machine.RouteConfig) - - [SequenceEvent](#machine.SequenceEvent) - - [ServiceEvent](#machine.ServiceEvent) - - [ServiceEvents](#machine.ServiceEvents) - - [ServiceHealth](#machine.ServiceHealth) - - [ServiceInfo](#machine.ServiceInfo) - - [ServiceList](#machine.ServiceList) - - [ServiceListResponse](#machine.ServiceListResponse) - - [ServiceRestart](#machine.ServiceRestart) - - [ServiceRestartRequest](#machine.ServiceRestartRequest) - - [ServiceRestartResponse](#machine.ServiceRestartResponse) - - [ServiceStart](#machine.ServiceStart) - - [ServiceStartRequest](#machine.ServiceStartRequest) - - [ServiceStartResponse](#machine.ServiceStartResponse) - - [ServiceStateEvent](#machine.ServiceStateEvent) - - [ServiceStop](#machine.ServiceStop) - - [ServiceStopRequest](#machine.ServiceStopRequest) - - [ServiceStopResponse](#machine.ServiceStopResponse) - - [Shutdown](#machine.Shutdown) - - [ShutdownResponse](#machine.ShutdownResponse) - - [SoftIRQStat](#machine.SoftIRQStat) - - [StartRequest](#machine.StartRequest) - - [StartResponse](#machine.StartResponse) - - [Stat](#machine.Stat) - - [Stats](#machine.Stats) - - [StatsRequest](#machine.StatsRequest) - - [StatsResponse](#machine.StatsResponse) - - [StopRequest](#machine.StopRequest) - - [StopResponse](#machine.StopResponse) - - [SystemStat](#machine.SystemStat) - - [SystemStatResponse](#machine.SystemStatResponse) - - [TaskEvent](#machine.TaskEvent) - - [Upgrade](#machine.Upgrade) - - [UpgradeRequest](#machine.UpgradeRequest) - - [UpgradeResponse](#machine.UpgradeResponse) - - [Version](#machine.Version) - - [VersionInfo](#machine.VersionInfo) - - [VersionResponse](#machine.VersionResponse) - - - [ListRequest.Type](#machine.ListRequest.Type) - - [MachineConfig.MachineType](#machine.MachineConfig.MachineType) - - [PhaseEvent.Action](#machine.PhaseEvent.Action) - - [RecoverRequest.Source](#machine.RecoverRequest.Source) - - [SequenceEvent.Action](#machine.SequenceEvent.Action) - - [ServiceStateEvent.Action](#machine.ServiceStateEvent.Action) - - [TaskEvent.Action](#machine.TaskEvent.Action) - - - [MachineService](#machine.MachineService) - -- [network/network.proto](#network/network.proto) - - [Interface](#network.Interface) - - [Interfaces](#network.Interfaces) - - [InterfacesResponse](#network.InterfacesResponse) - - [Route](#network.Route) - - [Routes](#network.Routes) - - [RoutesResponse](#network.RoutesResponse) - - - [AddressFamily](#network.AddressFamily) - - [InterfaceFlags](#network.InterfaceFlags) - - [RouteProtocol](#network.RouteProtocol) - - - [NetworkService](#network.NetworkService) - -- [resource/resource.proto](#resource/resource.proto) - - [Get](#resource.Get) - - [GetRequest](#resource.GetRequest) - - [GetResponse](#resource.GetResponse) - - [ListRequest](#resource.ListRequest) - - [ListResponse](#resource.ListResponse) - - [Metadata](#resource.Metadata) - - [Resource](#resource.Resource) - - [Spec](#resource.Spec) - - [WatchRequest](#resource.WatchRequest) - - [WatchResponse](#resource.WatchResponse) - - - [EventType](#resource.EventType) - - - [ResourceService](#resource.ResourceService) - -- [security/security.proto](#security/security.proto) - - [CertificateRequest](#securityapi.CertificateRequest) - - [CertificateResponse](#securityapi.CertificateResponse) - - [ReadFileRequest](#securityapi.ReadFileRequest) - - [ReadFileResponse](#securityapi.ReadFileResponse) - - [WriteFileRequest](#securityapi.WriteFileRequest) - - [WriteFileResponse](#securityapi.WriteFileResponse) - - - [SecurityService](#securityapi.SecurityService) - -- [storage/storage.proto](#storage/storage.proto) - - [Disk](#storage.Disk) - - [Disks](#storage.Disks) - - [DisksResponse](#storage.DisksResponse) - - - [Disk.DiskType](#storage.Disk.DiskType) - - - [StorageService](#storage.StorageService) - -- [time/time.proto](#time/time.proto) - - [Time](#time.Time) - - [TimeRequest](#time.TimeRequest) - - [TimeResponse](#time.TimeResponse) - - - [TimeService](#time.TimeService) - -- [Scalar Value Types](#scalar-value-types) - - - - -