Talos Kubernetes - Initial Machine Setup

About

Please refer to onedr0p/cluster-template for complete instructions. This following information is supplemental to onedr0p’s instructions since it includes steps specific to my setup.

Prerequisites

At least 3 bare metal machines with x86_64 cpus (amd64), UEFI and optionally secure boot enabled. See onedr0p/cluster-template: A template for deploying a Talos Kubernetes cluster including Flux for GitOps (github.com) for full specs and setup instructions.
(If installing from USB): A large enough usb stick and a Talos iso from https://factory.talos.dev/. Select amd64 and optionally tick the SecureBoot slider. No extensions.
(If PXE Booting): A router you have access to that is configured with OPNSense.

Instructions

Select a boot method and follow the instructions.

(SecureBoot from USB ISO)

Download Ventoy from Releases · ventoy/Ventoy (github.com) to your workstation.
Verify sha-256 checksum and extract.
Plug in usb drive and verify it’s readable by your file system (drive appears).
Run Ventoy disk utility, select your usb and click install. Hit yes to confirm you want to wipe everything on the drive, and then again for the double-check.
Once complete, the drive should be empty. Drag or copy/paste the SecureBoot iso onto the empty drive. The usb drive is now ready to go and can be ejected.

Ventoy splits the drive into multiple partitions, one for your isos and one for the Ventoy utility tools. You can place as many isos as can fit on the usb, and then upon boot, the Ventoy GUI will appear and you can select the iso you want to boot. This means you can boot into multiple operating systems easily, all from a single usb. Ventoy will also handle the custom secure boot keys, which other single iso flash tools like Rufus cannot.

Make sure the mini-PC is powered off and is connected to a display and keyboard or KVM, then insert the usb drive.
Tap F10 (may differ based on your hardware) on the keyboard repeatedly to enter the UEFI firmware settings.
Go to Advanced > Boot menu > and set the USB to be the first boot option.
Go to Advanced > Secure Boot Configuration > Legacy mode disabled and SecureBoot mode disabled
Check ‘Clear boot keys’, then Save and Exit and let it boot. (SecureBoot needs to be disabled initially, you should see a message saying it will be disabled. We’ll re-enable it later.)
Type in the 4 digit pin to confirm disabling SecureBoot if it was previously enabled.
Let the machine reboot, it will boot into Ventoy. DO NOT CONTINUE. Power cycle the machine and go back into the UEFI firmware settings (F10 for HP machines).
Go to Advanced > Secure Boot Configuration > Legacy mode disable and SecureBoot enable. Save and Exit and let it boot
A blue screen should appear with a message about Security Authentication failed. That’s because we need to import the certificate key from Ventoy that will enable SecureBoot for our isos. Hit okay and follow these instructions from the Ventoy docs: secure . Ventoy
Select Browse hard drive for MOK key
Select the drive that starts with VTOY
Select the file labeled along the lines of ‘USE_THIS_FOR_MOK_KEY.cer’
The key should import successfully and Ventoy will launch. You can boot into the Talos ISO from here.
Proceed with the instructions in onedr0p/cluster-template: A template for deploying a Talos Kubernetes cluster including Flux for GitOps

PXE Boot

We need to setup OPNSense as a PXE boot server (opnsense.org)

Prerequisites:

A shell account that can elevate permissions with sudo on OPNSense.
A shell account that can elevate permissions with sudo on a local webserver.
Internet connection to download some necessary files. I use a separate computer and then transfer to the firewall. Some will prefer to do it all on the firewall itself.
Some familiarity with basic shell commands and utilities like wget, nano, etc.

Now we start.

Install the tftp plugin in OPNSense
Go to System > Firmware > Plugins. Search for os-tftp. Click on the + sign at the end of the row to install it. You will get a message “The root folder for transfering files is /usr/local/tftp.” Once the WebUI refreshes you’ll have an entry in Services > TFTP > General where the service can be enabled or disabled. Check the box next to enable and then click apply.
On a shell connect to OPNSense via ssh and verify the path exists. For me it didn’t so I created it. Code: $ sudo mkdir -p /usr/local/tftp
Next, cd to the /usr/local/tftp/ folder and download the Talos factory iso file via the following command: curl -O https://boot.netboot.xyz/ipxe/netboot.xyz.efi
Back in the OPNsense GUI, navigate to Services > Kea DHCP [new] > Kea DHCPv4 > Subnets. Click on the subnet you want to use. In the TFTP server section enter the IP of OPNsense. Leave the TFTP bootfile name section empty.
Scroll down to Network booting > Check Enable network booting
Set x64 UEFI/EBC (64-bit) filename: netboot.xyz.efi
Set iPXE boot filename to: netboot.xyz.efi
Set root-path string: /usr/local/tftp/netboot.xyz.efi
Click on Save, then Apply.
Make sure PXE boot is enabled in the UEFI firmware settings. Priority should be lower than physical device, so if there is already an OS installed you should wipe it so the machines will boot to PXE.
Boot the machines, netboot.xyz should load. Find and install the Talos OS, you may have to scroll.
If everything went well, Talos should boot and your machines will go into maintenance mode as they await configuration.
Proceed with the instructions in onedr0p/cluster-template: A template for deploying a Talos Kubernetes cluster including Flux for GitOps

See Post Install Details (Split DNS).

References

PXE on OPNsense (github.com) OPN as a PXE boot server (opnsense.org) Using tftp netboot in pfsense for pxe boot server (youtube.com)