Kubernetes on bare metal using Talos Linux. GitOps managed by ArgoCD via the App of Apps pattern. Secrets encrypted with SOPS/age and injected at runtime via the 1Password Kubernetes operator + External Secrets.
| Cluster | talos |
| Domain | k8s.piccola.us |
| VIP | 10.0.5.200 |
| Nodes | control-1 through control-5 at 10.0.5.201-205 |
| Talos | see talos/talenv.yaml |
| Kubernetes | see talos/talenv.yaml |
task restart:media # Rolling restart all media deploymentstask argocd:suspend APP=<app> # Suspend automated sync for an app
task argocd:resume APP=<app> # Resume automated sync for an apptask stateful:suspend-all # Suspend sync and scale down all stateful apps
task stateful:resume-all # Resume sync and scale up all stateful appstask pvc:browse PVC=<name> NS=<namespace> # Spin up a temp pod to browse/edit a PVCCilium is the CNI for this cluster. Upgrades require care — see docs/cilium-upgrades.md for the full procedure.
task talos:cordon-and-reboot NODE=control-1 # Cordon, drain, then reboot a nodetask argocd:getadminsecret # Get the initial ArgoCD admin password
task ha-codeserver:getpassword # Get the Home Assistant code-server passwordkubectltalhelpertalosctlhelmtasksopsageyqjqop(1Password CLI)
Talos Linux is a minimal, immutable, API-driven OS purpose-built for Kubernetes. There is no SSH — all management is via talosctl.
Talos and Kubernetes versions are interdependent. Refer to the support matrix for compatible pairs. Versions are set in talos/talenv.yaml and used throughout the config generation process.
- Talos releases: github.com/siderolabs/talos/releases
- Kubernetes releases: kubernetes.io/releases
talhelper generates per-node Talos configs from three source files:
| File | Purpose |
|---|---|
talos/talconfig.yaml |
Config template with ${variable} substitution |
talos/talenv.yaml |
Variable values (versions, IPs, domain) |
talos/talsecret.sops.yaml |
SOPS-encrypted cluster secrets (certs, tokens, keys) |
talsecret.sops.yaml was generated once with talhelper gensecret > talos/talsecret.sops.yaml and then encrypted in-place. It should never need to be regenerated unless starting fresh.
Output configs land in talos/clusterconfig/ (node YAMLs are committed; kubeconfig is git-ignored).
Regenerate configs whenever Talos version, Kubernetes version, or any config setting changes:
task talos:genconfigtalsecret.sops.yaml is encrypted with SOPS using an age key. The age key must be available as SOPS_AGE_KEY in your environment. This is set via the git-ignored .envrc at the repo root:
# .envrc
export SOPS_AGE_KEY=AGE-SECRET-KEY-...The .sops.yaml at the repo root defines which file paths and which keys within those files are in scope for encryption. To encrypt a new secrets file:
sops -e -i path/to/file.sops.yamlThe VSCode extension signageos.signageos-vscode-sops handles transparent encrypt/decrypt on save when SOPS_AGE_KEY is set.
task stateful:suspend-allThen open the Longhorn UI and trigger an immediate backup (run the daily backup job manually).
task talos:reset-node NODE=all
task talos:wipe-nvmeNot covered here.
Update talhelper and talosctl first if versions have changed.
task talos:genconfigtask talos:apply-configtask talos:bootstrapOnly required when new Talos secrets were generated.
task talos:get-kubeconfigCilium and ArgoCD are bootstrapped manually here and will be self-managed by ArgoCD afterward.
task install:gateway_api_crds
task install:cilium # wait for pods to be ready
task install:argocd
task stage:onepassword_secretsPrevents eventual-consistency delays for apps that depend on namespace labels.
task stage:namespacesInstalls: 1Password operator, External Secrets, cert-manager.
kubectl apply -n argocd -f argocd/aoa_infra.yamlInstalls: Longhorn.
kubectl apply -n argocd -f argocd/aoa_storage.yamlWith Longhorn running, open the UI (port-forward if needed) and restore volumes from backup:
- Clean up any orphaned data: Settings → Orphaned Data
- Restore each volume, checking Use Previous Name
- For each restored volume, go to Create PV/PVC, check Create PVC and Use Previous PVC
kubectl apply -n argocd -f argocd/aoa_apps.yaml