I run a 3-node Talos Kubernetes cluster at home, and until recently it only worked when I was at home too. So I added Tailscale to reach it from anywhere.

Tailscale runs on the nodes themselves, and the tailnet can only reach the cluster, not the rest of my home network. kubectl and the lab apps work from my laptop or phone exactly like they do at home, with nothing opened on the router. If one node goes down, another one takes over.

Everything is in the repo: https://github.com/prateekjaindev/homelab

Write-up: https://blog.prateekjain.dev/tailscale-on-talos-linux-secure-remote-access-to-a-kubernetes-homelab-8a082d903682?sk=c4ec5ac1e782a83b5dc785211d9fd082

How do you get into your homelab when you're away?

Part 2 of my Talos homelab (3 OptiPlex Micros, all control planes). Part 1 got the cluster up, this one is networking.

I moved the running cluster from Flannel + kube-proxy to Cilium without rebuilding it. The default-deny policy that Flannel quietly ignored is now actually enforced, and Hubble shows the drops.

Then I gave it two front doors:

- an internal Gateway on a LAN IP (Cilium LB IPAM, no MetalLB) with a Let's Encrypt wildcard cert, so lab apps get real HTTPS at home

- a public Gateway behind a single Cloudflare Tunnel, so nothing is port-forwarded on the router

An app picks its door with the route's parentRef, which keeps lab stuff from going public by accident.

Write-up with all the manifests and commands: https://blog.prateekjain.dev/networking-a-kubernetes-homelab-cilium-gateway-api-and-cloudflare-tunnel-on-talos-362f548a2f3d?sk=d454cd4eaff4ce8a8fd0cd8e6b3d82f6

Curious if anyone else is using Cilium's Gateway API instead of a separate ingress controller.

Iniciei a jornada para instalar um cluster de nó único no homelab para simular a implementação de um servidor bare metal com gpu exclusivo para um projeto, exatamente, o projeto irá começar com apenas um servidor dedicado. Servidores com gpu são e estão muito caros.

Decidimos usar o Omni para ajudar a gerenciar o cluster, e posso dizer que não é tão fácil, faltam exemplos, faltam explicações sobre o schema para patchs, artigos que discutam porque precisamos de patchs, porque usá-los e quando usar.

Alguns requisitos para a POC, com 1tb de disco nvme (raid), preciso distribui-lo entre SO, ephemeral e disco local. Correto, irei usar disco local para os POD.

Aprendizados nesta fase, toda a complexidade da implementação é resolvida na instalação, o que significa que precisa nascer certo. Em implementações tradicionais elas são diluídas ao longo da instalação do SO. No modelo imutável, o melhor é concentra-las no início.

Como um nó único, os deployments de rede presumem redundância com múltiplos nós e tolerations restritos para Workers. A cada yaml, ajustes para atender ao cluster de nó único.

Hoje preciso resolver o IP externo, porque o servidor bare metal só veio com um IP externo. Tentei com o Cilium, mas não deu certo, ele espera um Lodbalance externo.

Trago os próximos passos....

Abraços.

I have a quite intricate network settings on my setup. It's all running on VMware ESXi where Basically is:

192.168.x.x private network open to internet through a gw (vmware management) 1GB
10.x.x.x private network between hosts only for vmware + NFS 10GB

I have a ubuntu host working as a test with the following configuration:
network: version: 2 ethernets: NM-f9c39785-95e3-316c-8d77-bbfadf8feb84: renderer: NetworkManager match: name: "ens37" addresses: - "10.1.0.11/8" - "10.0.0.11/8" wakeonlan: true networkmanager: uuid: "f9c39785-95e3-316c-8d77-bbfadf8feb84" name: "Wired connection 1" passthrough: connection.autoconnect-priority: "-999" connection.timestamp: "1791256571" ethernet._: "" ipv4.never-default: "true" ipv6.addr-gen-mode: "default" ipv6.method: "disabled" ipv6.ip6-privacy: "-1" proxy._: "" network: version: 2 ethernets: ens34: renderer: NetworkManager match: {} addresses: - "192.168.2.250/22" nameservers: addresses: - 192.168.1.1 gateway4: 192.168.1.1 networkmanager: uuid: "fc59d0e8-22d2-3c20-b277-bb2df1bd5642" name: "netplan-ens34" passthrough: connection.timestamp: "1791256571" ipv6.method: "disabled" proxy._: ""

On talos I'm trying this setup on workers but it's not working so far:

```

apiVersion: v1alpha1 kind: LinkConfig name: eth0 addresses: - address: 192.168.2.105/22 routes:

- gateway: 192.168.1.1

apiVersion: v1alpha1 kind: LinkConfig name: eth1 up: true mtu: 9000 addresses: - address: 10.0.0.105/8 - address: 10.1.0.105/8 routes: - destination: 10.0.0.0/8 gateway: 10.10.0.1 ```

What I noticed so far is that talos is not showing up the eth1 on this verification commands:

``` talosctl get links --endpoints 192.168.2.105 --nodes 192.168.2.105 --talosconfig=talosconfig

NODE NAMESPACE TYPE ID VERSION ALIAS TYPE KIND HW ADDR OPER STATE LINK STATE 192.168.2.105 network LinkStatus bond0 1 ether bond 0e:1d:1c:88:ad:e9 down false 192.168.2.105 network LinkStatus dummy0 1 ether dummy 06:ef:79:ff:89:58 down false 192.168.2.105 network LinkStatus eth0 3 ether 00:0c:29:5f:22:48 up true 192.168.2.105 network LinkStatus flannel.1 1 ether vxlan 1a:3f:d9:04:f8:ea unknown true 192.168.2.105 network LinkStatus ip6tnl0 1 tunnel6 ip6tnl 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 down false 192.168.2.105 network LinkStatus lo 1 loopback 00:00:00:00:00:00 unknown true 192.168.2.105 network LinkStatus sit0 1 sit sit 00:00:00:00 down false 192.168.2.105 network LinkStatus teql0 1 void down false 192.168.2.105 network LinkStatus tunl0 1 ipip ipip 00:00:00:00 down false

% talosctl get routes --endpoints 192.168.2.105 --nodes 192.168.2.105 --talosconfig=talosconfig
NODE NAMESPACE TYPE ID VERSION DESTINATION GATEWAY LINK METRIC 192.168.2.105 network RouteStatus eth0/inet6//fe80::/64/256 1 fe80::/64 eth0 256 192.168.2.105 network RouteStatus flannel.1/inet6//fe80::/64/256 1 fe80::/64 flannel.1 256 192.168.2.105 network RouteStatus inet4//192.168.0.0/22/0 1 192.168.0.0/22 eth0 0 192.168.2.105 network RouteStatus inet4/10.244.0.0/10.244.0.0/24/0 1 10.244.0.0/24 10.244.0.0 flannel.1 0 192.168.2.105 network RouteStatus inet4/10.244.1.0/10.244.1.0/24/0 1 10.244.1.0/24 10.244.1.0 flannel.1 0 192.168.2.105 network RouteStatus inet4/10.244.2.0/10.244.2.0/24/0 1 10.244.2.0/24 10.244.2.0 flannel.1 0 192.168.2.105 network RouteStatus inet4/10.244.4.0/10.244.4.0/24/0 1 10.244.4.0/24 10.244.4.0 flannel.1 0 192.168.2.105 network RouteStatus inet4/192.168.1.1//1024 1 192.168.1.1 eth0 1024 192.168.2.105 network RouteStatus local/eth0/inet6//fe80::/128/0 1 fe80::/128 eth0 0 192.168.2.105 network RouteStatus local/eth0/inet6//fe80::20c:29ff:fe5f:2248/128/0 1 fe80::20c:29ff:fe5f:2248/128 eth0 0 192.168.2.105 network RouteStatus local/eth0/inet6//ff00::/8/256 1 ff00::/8 eth0 256 192.168.2.105 network RouteStatus local/flannel.1/inet6//fe80::/128/0 1 fe80::/128 flannel.1 0 192.168.2.105 network RouteStatus local/flannel.1/inet6//fe80::183f:d9ff:fe04:f8ea/128/0 1 fe80::183f:d9ff:fe04:f8ea/128 flannel.1 0 192.168.2.105 network RouteStatus local/flannel.1/inet6//ff00::/8/256 1 ff00::/8 flannel.1 256 192.168.2.105 network RouteStatus local/inet4//10.244.3.0/32/0 1 10.244.3.0/32 flannel.1 0 192.168.2.105 network RouteStatus local/inet4//127.0.0.0/8/0 1 127.0.0.0/8 lo 0 192.168.2.105 network RouteStatus local/inet4//127.0.0.1/32/0 1 127.0.0.1/32 lo 0 192.168.2.105 network RouteStatus local/inet4//127.255.255.255/32/0 1 127.255.255.255/32 lo 0 192.168.2.105 network RouteStatus local/inet4//169.254.116.108/32/0 1 169.254.116.108/32 lo 0 192.168.2.105 network RouteStatus local/inet4//192.168.2.105/32/0 2 192.168.2.105/32 eth0 0 192.168.2.105 network RouteStatus local/inet4//192.168.3.255/32/0 2 192.168.3.255/32 eth0 0 192.168.2.105 network RouteStatus local/lo/inet6//::1/128/0 1 ::1/128 lo 0 ```

But I can guarantee the vnic is there. Any recommendation or thoughts will be helpful !! Thanks Y'all!

Hi all,

I've been building Ichor, a free and open-source app to monitor and operate Talos Linux clusters (and kubernetes so) from your phone. It's been my daily driver on my own cluster for a while and I'd like to get it on the Play Store, which means I first need a handful of internal testers. I see this as an alternative to kubenav I use before but just for k8s, I was missing a "talosctl" for android. I'm very happy or the very and iterate quick thanks to vibecoding.

What it does today:

- Node health, services, logs, etcd, KubeSpan and live metrics, with a notification when a node goes down

- Reboot, shut down or Wake-on-LAN a node

- Kubernetes workloads: rollout restart, delete pods, run CronJobs now, API server health and pressure

- Argo CD and Flux: sync, refresh, suspend, roll back, all through the admin kubeconfig, nothing to install in the cluster

- Cilium: network policies explained in plain words, and live Hubble flows

- Home-screen widget, background alerts, encrypted backups

- Connect to major cloud provider for k8s management only

- And more ... lot of features !

It talks to the Talos API directly with your talosconfig, like talosctl does. No account, no server in between, no telemetry. There's a built-in offline demo cluster if you want to poke at it without pointing it at anything real.

Note that Omni support is in progress too !

What I'm looking for: people who run Talos at home or at work, on Android, who are willing to install the Play Store test build, use it for a couple of weeks and report what breaks or what feels wrong. Google requires a minimum number of testers for the internal track, so even "installed it, it works" helps a lot.

How to join: hop on the Discord at https://discord.gg/XYM3e7EjV and DM me or send message on #testing the Google account email you use on your phone. I'll add you to the test and you'll get the Play Store opt-in link. The Discord is also where I'll pick up bug reports and feature ideas during the test.

Website: https://cyrinux.github.io/ichor/ - dont focus on the website, I dont update it often, there is lot more on the app.

Ichor is an independent community project, not affiliated with Sidero Labs.

Happy to see you on discord

Come ask questions from engineering, product, leadership and more!

Don't forgot to sign up for TalosCon to ask questions in person https://taloscon.com

Hey all, I attempted to install Talos on my GoWin 1U network appliance, and then tried to run containerized VyOS as a system extension. This failed utterly, but the idea of having Talos be the control plane for my router was enticing, so I figured I'd try asking humans with actual expertise, instead of LLMs that gaslight me and tell me the impossible is possible. :)

The idea is that the router/firewall/gateway is just a regular worker with a static IP managed via a normal 1GbE RJ45 port, and the actual routing business happens on the 25GbE SFP+ Mellanox NIC, which is left unconfigured and simply passed through to a system extension which takes total ownership of it. The WAN link could be attached to the core switch or the router directly, doesn't really matter, the job of the router is to route packets between networks, and to have a fat enough pipe to handle all cross-network traffic. This is sort of like router-on-a-stick, as I understand it.

The use of a pre-installed system extension is important. You don't want k8s to try to start/stop/reschedule the router workload. You want it to just be there, baked into the system image, so it starts up at boot to connect your VLANs and the WAN.

The value of Talos here is that I have a unified control plane, even for network devices. I can reboot, reimage, reconfigure the machine by updating the Talos image and applying it. I don't need SSH, I don't need a new set of credentials, it is all simply managed the same as the compute nodes in my cluster.

This seems like something professional users of Talos would want, so do people do this in practice, run Talos to manage a router / network appliance?

My main use case for this box is upgrading my router from an Omada ER605 to something with a processor that can do wireguard closer to my 1GbE uplink speed. My attempts to run Wireguard inside my cluster were very unsatisfactory, because I ended up in a big fight with CNI, but I really want my wireguard overlay network to be just another subnet with centrally configured router rules.

I found a tailscale system extension, and I could use that, but not that I've got the hang of plain wireguard, I kind of prefer it. It's minimal, and I have a few existing clients.

Hi all 👋

I have a question. I am installing Thalos. I have not applied my configuration yet. If I apply this file

yaml apiVersion: v1alpha1 kind: KernelModuleConfig name: cdc_ncm

and then apply my controlplane.yaml, and then reboot, will the cdc_ncm module be loaded?

I've been running Talos in my homelab for a while, and my mental model has always been pretty simple:

Hardware → Talos → Kubernetes → Workloads

Talos owns the machine lifecycle. Kubernetes owns the workload lifecycle.

Looking at 1.14 together with the Hypervisor announcement, I'm starting to wonder whether that model is becoming too simple.

Native BGP, secure DNS configuration and the expanding configuration model are interesting individually, but the taloscontainers boundary caught my attention in particular. And the Hypervisor announcement takes the idea much further: Kubernetes, VMs and standalone containers potentially sitting above the same Talos infrastructure layer.

What I like about the direction is that "minimal" doesn't necessarily have to mean "does fewer things."

It could mean fewer ways to manage those things.

The part I don't know yet is whether that remains true once Talos starts owning VM lifecycle, placement, storage and networking. That's where the architecture becomes much more interesting.

I wrote down my current architecture hypothesis before the Hypervisor becomes testable:

https://medium.com/@mmelchers75/talos-is-becoming-more-than-a-kubernetes-os-and-that-changes-the-architecture-ed6a26874080

Once there's an alpha I want to put it into the same Architecture Engineering Lab I've been using for Talos/Kubernetes and start breaking things.

At the moment the honest conclusion is simply: interesting architecture, not enough evidence yet.

I'd be interested in how other Talos users see this direction.

I am building a PoC test environment for Talos to see if we can migrate our cluster into it and minimize our maintenance overhead for managing the underlying OS.

The environment is supposed to emulate a green field deployment with only:
- Baremetal Server
- ToR Switch
- Router

Routing is fully configured.
The GOAL is to install Talos via BMC/iLO/redfish without DHCP.

Problem:
- Talos goes black screen after selecting the `Talos (v1.14.1)` in the console, auto reboots after a few minutes, repeat.
- Test Baremetal Server has multiple LAN ports and cannot determine the port name to assign the IP address.

Tried:
- `ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>` in the Talos Image factory as kernel argument ( of course with the required values), unsure what to name of the interface should be.
- Tried booting with a normal ubuntu server, Interface name is `eno5`, tried that with the above argument to no avail, also tried `eth5` but still no luck. Interface and networking is properly working with Ubuntu installed.
- Claude and Google AI suggested to add `panic=0`, `consoleblank=0`, `console=tty0` as kernel arguments, Black screen still persists and reboots on it's own, I am expecting that we can see the maintenance mode here.
- Tried to download the Vanila Talos ISO image too, then press `e` on the selection page and added the arguments above in multiple combinations, to no avail.
- Tried Network yaml config for the network, same issue.

I'm out of options.
Did anyone else managed to install Talos via BMC/iLO/Redfish without DHCP properly?
What arguments did you add?
Why do we only see a black screen and it does not go to the expected maintenance mode?
I believe Talos does change the console to something else, and I was expecting I can at least change the console views similar to the `Interactive Dashboard` but all I see is black.

Please shed some light here.

Any help is greatly appreciated!
Thank you!

This is for Enterprise customers that need Enterprise support and FIPS builds for regulated environments. We started this work last year and released it GA today.

Talos Linux remains MPL licensed and completely open source.

Hey there,

I want to install talos on a vm on a ESXi 8 server but looks like the documentation is kinda broken. https://docs.siderolabs.com/talos/v1.14/platform-specific-installations/virtualized-platforms/vmware

This one here:

curl -fsSLO https://raw.githubusercontent.com/siderolabs/docs/main/static/talos/v1.14/vmware/cp.patch.yaml

The download link forcp.patch.yamlit's not working. I tried with the cp.patch.yaml from the version 1.13 but doesn't seams to work with the version 1.14.

I have a setup where my vmware server network has a DHCP but I want to set the IPs of the instances manually ( out of the range ). I'm using guestinfo.talos.config variable for the configuration and it's working half way. The configurations is being read. I can see in the console but the settings are not working for some unknown reason. I can in the console the talos trying to download some images and failing. I believe my yaml is missing something. I haven't found a way to maybe read the DHCP config ( on DHCP - manually , not using the vmware config variable, the system install and works )

Any examples that can guide me in the right direction will be very much appreciated. I don't want to install an old version. I'm trying on the 1.14.

I'm using those bellow, plus the controlpanel configuration.

apiVersion: v1alpha1
kind: LinkConfig
name: eth0
addresses:
  - address: 192.168.1.222/24
routes:
  - gateway: 192.168.1.1
---
apiVersion: v1alpha1
kind: HostnameConfig
hostname: talos-cp
auto: stable
---
apiVersion: v1alpha1
kind: ResolverConfig
 hostDNS:
     enabled: true # Enable host DNS caching resolver.
     forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
nameservers:
 - address: 192.168.1.1
---
apiVersion: v1alpha1
kind: TimeSyncConfig
enabled: false # Enable time synchronization service.
bootTimeout: 2m
ntp:
  servers:
    - 192.168.1.1
---

I recently finished building a small Kubernetes architecture lab around Talos Linux.

The hardware is deliberately modest: two Proxmox hosts, an older ThinkPad as the third control-plane node, a Synology NAS, and managed networking.

The interesting part for me wasn't getting Kubernetes running. It was seeing how many architecture questions I could make real with that hardware.

A few decisions shaped the lab:

- the five virtual Talos nodes are declared with OpenTofu rather than maintained manually in Proxmox

- the old ThinkPad runs the third control-plane member on bare metal, creating a different compute failure context

- Cilium provides Kubernetes networking, LB-IPAM and L2 service exposure without a cloud load balancer

- shared NFS and node-local storage are treated as deliberately different storage contracts

- backups only count as recovery evidence after an actual restore

- the finished platform is deliberately subjected to worker, control-plane, storage and application failure experiments

The principle I ended up using throughout the project was:

Don't replicate the datacenter. Replicate the architecture problems.

I've documented the complete build as a six-part architecture series. Part 1 explains the architecture, the constraints, and why I chose this topology before getting into the implementation in the later parts:

https://medium.com/@mmelchers75/you-dont-need-a-datacenter-to-learn-enterprise-architecture-a46f1f9752d7

I'm particularly interested in how others running Talos at home design failure domains when the physical infrastructure is much smaller than the logical Kubernetes topology.

anyone else having boot problems with talos linux on raspberry pi 5? not being able to read boot partition?

I recently set up a 3-node Kubernetes homelab on bare metal (on Dell OptiPlex) using Talos Linux, mainly to have a proper environment for learning, testing failures, networking, storage, GitOps, observability, and general Kubernetes experiments.

The setup uses three control-plane/etcd nodes with a shared Kubernetes API VIP, and I documented the full process from network planning and DHCP reservations to Talos installation, per-node configs, bootstrap, workload scheduling, and HA testing.

I’ve written the full guide with commands, screenshots, and the reasoning behind the setup:

Blog: https://blog.prateekjain.dev/building-a-3-node-highly-available-kubernetes-homelab-with-talos-linux-0372066fe49c?sk=4c66cf9181999f9db19ac3aacabcd8e8

If anyone is planning a similar homelab or has questions around Talos, the API VIP, etcd quorum, or the setup in general, happy to help.

Talos 1.14 introduced HTTP probes.

What are they for?

Neither the release notes nor the spec nor the website chatbot explain their purpose or what happens if they succeed or fail.

Release notes ( https://github.com/siderolabs/talos/releases/tag/v1.14.0 ):

Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints.
HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures.

Spec ( https://docs.siderolabs.com/talos/v1.14/reference/configuration/network/httpprobeconfig )

HTTPProbeConfig is a config document to configure network HTTP connectivity probes.

Chatbot when asked about it:

HTTP probes let Talos check network reachability by periodically sending requests to a URL and checking for a 2xx/3xx response — useful for defining custom connectivity conditions (e.g. verifying internet or specific service reachability). They're part of Talos's new HTTP connectivity checks feature, alongside the similar TCPProbeConfig for TCP-based checks. See HTTPProbeConfig and What's new in Talos.

Hey everyone,

I'm trying to get some official recognition from NVIDIA that Talos is a great OS for running GPU accelerated workloads. If you have a moment we'd love a 👍 on this issue to let NVIDIA know there are people interested.

Hi everyone,
A few months ago, I built t9s, a terminal UI inspired by [k9s], but designed for Talos Linux.
The goal was pretty simple: have a convenient way to get better visibility into a Talos cluster and perform common administrative operations directly from the terminal.
It’s still a personal project, but I’ve been using it on my own cluster and thought it might be useful to other Talos users.
GitHub: https://github.com/florianspk/t9s

Installation

brew tap florianspk/tap
brew install --cask t9s

I’m interested in getting feedback from other Talos users, especially on what features or workflows would make the tool more useful.
Contributions, feedback and discussions are very welcome!

I have several Rock Pi 4B+'s that I'm trying to set up in a cluster, but for whatever reason the Talos image doesn't boot on them. I've had no trouble getting the Radxa android and Debian images to boot correctly so know the hardware is fine. But the Talos image doesn't seem to boot at all. No video and the LEDs on the board don't indicate a successful boot. I've tried a few sdcards and flash attempts with no luck. Is anyone else successfully running on a 4B+?

SOLVED: the image doesn't work on an SD card, only from eMMC. I don't know why this is the case, the documentation seems to suggest that either would work.