Talos on johanneskueber.com

Signed OCI Artifacts for Flux with Cosign and Gitea

Mon, 15 Jun 2026 00:00:00 +0000

Signed OCI Artifacts for Flux with Cosign and Gitea

Flux will happily pull a Git repository, run kustomize build over a folder, and apply the result. I ran it that way for a long time and it works. What it does not give you is any statement about what is being applied or where it came from. The source of truth is a mutable branch - anyone who can write to that path, or anything that can, changes what lands in the cluster on the next reconcile. There is no integrity check sitting between “a commit exists” and “this is what is running in production.”

Bare-Metal LoadBalancer Services on Talos with Cilium L2 Announcements

Mon, 01 Jun 2026 00:00:00 +0000

This article documents how to replace MetalLB with Cilium’s built-in L2 announcement feature, including the IPAM pool, the announcement policy, the supporting Cilium values, and what to verify on the wire.

1. MetalLB’s role

On a bare-metal cluster, a Service of type: LoadBalancer is meaningless until something assigns it an external IP and answers ARP for that IP on the local segment. The classic answer is MetalLB in L2 mode: a controller allocates an IP from a pool; a speaker DaemonSet replies to ARP requests, advertising via gratuitous ARP after leader election.

Per-PVC Encryption with Longhorn and CSI Secret Templates

Thu, 28 May 2026 00:00:00 +0000

This article documents how to configure a Longhorn StorageClass that encrypts every PVC with its own per-volume key, derived through CSI’s secret-template parameters, and how to provision the matching secrets so the keys are scoped to the application namespace.

1. What encryption Longhorn actually does

Longhorn 1.4+ supports LUKS encryption at the block device layer. When a PVC’s StorageClass declares encrypted: "true", Longhorn calls cryptsetup luksFormat on the underlying replica devices using a passphrase pulled from a Kubernetes Secret. The PVC is then exposed to the consuming Pod as an unencrypted filesystem — the kernel handles the encryption transparently through the device-mapper layer.

Intel iGPU passthrough with Proxmox and Talos

Sat, 11 Oct 2025 21:06:26 +0000

iGPU Passthrough with Proxmox and Talos

To use the GPU of the host system in K8s, it needs to be made aware of its existence. As I use VMs in Proxmox to run my Talos Cluster, there is an additional step to consider: passthrough of the hardware into the VM. The idea is the following:

Disable usage of GPU on the Proxmox Host - done via IOMMU and VFIO
Passthrough of the GPU into a Talos Worker Node - done via hostpci
Activation of GPU drivers in Talos - done via talhelper
GPU management in the cluster - done via Intel GPU Plugin
Usage of GPU in a deployment - by requesting the resource

There are quite some steps and all of them are specific to your environment. Different host system? Different steps. Different Cluster Software? You need to adept. Different GPU? You need other drivers and management. So please look out for the pitfalls and only copy and paste if you run proxmox with talos and have an Intel iGPU.

Use Longhorn with Talos 1.10 and userVolumes

Tue, 17 Jun 2025 07:06:26 +0000

When building a cluster, especially in a homelab, local storage is needed for application data. Especially for databases fast read and write is required. Offloading the workload to a NAS most of the time is slower. The solution I use is to provision on-node storage with Longhorn. Longhorn acts as a CSI and offers on-node storage, replication, backups and more.

As I am currently building a Talos cluster I need to integrate the longhorn CSI into the setup. This is not as straigt forward as with K3s oder K8s, as Talos has tighter security constraints and also needs additional plugins to handle SCSI - the underlying file system protocol used by longhorn. On top I am using Talhelper to allow a GitOps style usage of talosctl. The main advantage is the encryption of secrets used by talos config files with SOPS - something that I already use for Tofu and fluxCD.