console=ttyS0,115200

POST /schematics

GET /image/:schematic/:version/:path

alt-orchestra-<version>-<platform>-<arch>[-secureboot].<format>

GET /versions

$ curl -X GET https://factory.altlinux.space/versions

["v11.0"]

GET /version/:version/extensions/official

$ curl -X GET https://factory.altlinux.space/version/v11.0/extensions/official | jq .

[
  {
    "name": "alt-orchestra/crun",
    "ref": "altlinux.space/alt-orchestra/crun:1.27",
    "digest": "sha256:6a71e16de2b55ea03e4ef60dc1e2620f808facdbb948a4a87fc57a2cf1290127",
    "author": "Basealt LLC",
    "description": "containerd's runtime handler crun\n"
  },
  {
    "name": "alt-orchestra/util-linux-tools",
    "ref": "altlinux.space/alt-orchestra/util-linux-tools:2.39.2",
    "digest": "sha256:d8d76085b5144655baee9a55ab9b1c7583de6eabaaedd5954c8c3c1499de2ecd",
    "author": "Basealt LLC",
    "description": "minimal util-linux package\n"
  },
  {
    "name": "alt-orchestra/intel-ucode",
    "ref": "altlinux.space/alt-orchestra/intel-ucode:20251111",
    "digest": "sha256:459538bdeb0564fa0ccc86232f8dc0ba82e6937e7cbd1a12df04c0092740330e",
    "author": "Basealt LLC",
    "description": "intel-ucode module\n"
  },
  {
    "name": "alt-orchestra/btrfs",
    "ref": "altlinux.space/alt-orchestra/btrfs:v11.0",
    "digest": "sha256:f5b98bc2cec6bce4b539a204e74b1bac4926c4c27364279a74514d25b85cd34a",
    "author": "Basealt LLC",
    "description": "btrfs filesystem\n"
  },
  {
    "name": "alt-orchestra/nvidia-container-toolkit",
    "ref": "altlinux.space/alt-orchestra/nvidia-container-toolkit:580.142.0-1.17.8",
    "digest": "sha256:6acf10587343018528744e712187668e85258bdee739f77236f0e7c031f3064f",
    "author": "Basealt LLC",
    "description": "nvidia runtime and it's dependencies using NVIDIA's runtime handler.\n"
  },
  {
    "name": "alt-orchestra/drbd",
    "ref": "altlinux.space/alt-orchestra/drbd:9.3.0-v11.0",
    "digest": "sha256:592f5a83c78d1c17333d406449b2953a903ccbe1342950a67605703016a96d13",
    "author": "Basealt LLC",
    "description": "system extension provides kernel module driver for DRBD\n"
  },
  {
    "name": "alt-orchestra/qemu-guest-agent",
    "ref": "altlinux.space/alt-orchestra/qemu-guest-agent:9.1.2",
    "digest": "sha256:fe82cf46923b1ce7f3b6ea07cee04a29d8d3ea5a2fbba1ec79fdb2c467b68a1f",
    "author": "Basealt LLC",
    "description": "qemu-guest-agent service\n"
  },
  {
    "name": "alt-orchestra/nonfree-kmod-nvidia",
    "ref": "altlinux.space/alt-orchestra/nonfree-kmod-nvidia:580.142.0-v11.0",
    "digest": "sha256:b966fbea6ad241f4d28f12b08a6068385226ef00bcd729e0339ab9a7d537795f",
    "author": "Basealt LLC",
    "description": "nvidia proprietary kernel modules\n"
  }
]

GET /oci/cosign/signing-key.pub

$ curl -X GET https://factory.altlinux.space/oci/cosign/signing-key.pub

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEq2DB1eviFoHEcqKk+5wOXJ104XDP
P6sF7X9ddibyerutMvRY5zjxqVCZPRcTwVOZV49WmEIXia81JPgcEshkLA==
-----END PUBLIC KEY-----

$ cosign verify --offline  \
  --insecure-ignore-tlog \
  --insecure-ignore-sct \
  --key signing-key.pub \
  factory.altlinux.space/<image>

$ wget https://factory.altlinux.space/oci/cosign/signing-key.pub

$ cosign verify --offline \
 --insecure-ignore-tlog \
 --insecure-ignore-sct \
 --key signing-key.pub \
factory.altlinux.space/alt-orchestra-metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v11.0

Verification for factory.altlinux.space/alt-orchestra-metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v11.0 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

[{"critical":{"identity":{"docker-reference":"127.0.0.1:5001/image-factory/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"},"image":{"docker-manifest-digest":"sha256:b4639acde912d59dda83427e47f83acf75cd5bf95ef59c38271cb2cf7c15366f"},"type":"cosign container image signature"},"optional":null}]

# dd oflag=direct if=<файл-образа.iso> of=/dev/sdX bs=1M status=progress;sync

# pv <файл-образа.iso> | dd oflag=direct of=/dev/sdX bs=1M;sync

# pv alt-orchestra-11.0-metal-amd64.iso | dd of=/dev/sdd bs=1M oflag=direct; sync

#!ipxe

imgfree
kernel http://192.168.0.224/talos/alt-orchestra-11.0-kernel-amd64 initrd=initramfs-amd64.xz talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on ima_template=ima-ng ima_appraise=fix ima_hash=sha512 selinux=1
initrd http://192.168.0.224/talos/alt-orchestra-11.0-initramfs-amd64.xz
boot

# apt-get install wget
# cd /srv/talos
# wget https://factory.altlinux.space/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v11.0/alt-orchestra-11.0-kernel-amd64
# wget http://factory.altlinux.space/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v11.0/alt-orchestra-11.0-initramfs-amd64.xz

ip=192.168.0.100::192.168.0.1:255.255.255.0::ens19:off

ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>

ip=172.20.0.2::172.20.0.1:255.255.255.0::eth0.100:::::

vlan=eth0.100:eth0

bond=bond0:eth0,eth1:balance-rr

$ mkdir -p orchestra/controlplanes
$ mkdir -p orchestra/workers
$ cd talos

├── orchestra/
│   ├── controlplanes/
│   │   └── controlplane-01.yaml
│   └── workers/
│       ├── worker-01.yaml
│       ├── worker-02.yaml
│       └── worker-03.yaml

machine:
  network: {}

  network:
    interfaces:
    - interface: ens19

    install:
        disk: /dev/sda # Диск для установки системы

kind: HostnameConfig
# auto: stable # A method to automatically generate a hostname for the machine.

# # A static hostname to set for the machine.
hostname: controlplane-01

machine:
  network:
    interfaces:
      - interface: <interface>
        dhcp: true
  install:
    disk: /dev/<disk>

#controlplane-patch-01.yaml
machine:
  network:
    interfaces:
      - interface: ens19
        addresses:
          - 192.168.0.140/24
        routes:
          - network: 0.0.0.0/0
            gateway: 192.168.0.1
    nameservers:
      - 192.168.0.1
  install:
    disk: /dev/sda

apiVersion: v1alpha1
auto: off
kind: HostnameConfig
hostname: worker-01
---
machine:
  network:
    interfaces:
      - interface: ens19
        addresses:
          - 192.168.0.145/24
        routes:
          - network: 0.0.0.0/0
            gateway: 192.168.0.1
    nameservers:
      - 192.168.0.1
  install:
    disk: /dev/sda

$ kubectl --kubeconfig ./alternative-kubeconfig get pods -A

# apt-get install dhcp-server \
bind \
bind-utils \
chrony \
podman \
docker-registry \
containers-common \
net-tools \
curl \
jq \
grpcurl \
git \
talosctl \
wget \
kubernetes1.35-client \
discovery-service-rs \
helm

# sed -i 's|listen-on {.*|listen-on { 127.0.0.1; 192.168.0.1; };|g' \ 
  /etc/bind/options.conf

# cat >> /etc/bind/local.conf <<'EOF'
zone "internal.local" {
    type master;
    file "/etc/bind/zone/db.internal.local";
    allow-update { 192.168.0.0/24; };
};

zone "0.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zone/db.192.168.0";
    allow-update { 192.168.0.0/24; };
};
EOF

# cat > /etc/bind/zone/db.internal.local <<'EOF'
$TTL 604800
@       IN      SOA     ns1.internal.local. admin.internal.local. (
                                2025010101 ; Serial
                                604800     ; Refresh
                                86400      ; Retry
                                2419200    ; Expire
                                604800     ; Negative Cache TTL
                                )
        IN      NS      ns1.internal.local.
ns1     IN      A       192.168.0.1
EOF

# cat > /etc/bind/zone/db.192.168.0 <<'EOF'
$TTL 604800
@       IN      SOA     ns1.internal.local. admin.internal.local. (
                                2025010101 ; Serial
                                604800     ; Refresh
                                86400      ; Retry
                                2419200    ; Expire
                                604800     ; Negative Cache TTL
                                )
        IN      NS      ns1.internal.local.
1       IN      PTR     ns1.internal.local.
EOF

# systemctl enable --now bind

# cat >> /etc/chrony.conf <<'EOF'
allow all
pool pool.ntp.org iburst
EOF

# systemctl enable chronyd

# systemctl restart chronyd

setup_registry() {
    local registry_name="$1"
    local remote_url="$2"
    local registry_port="$3"

    # Настроить клиент Podman на использование прокси-кеша
    cat >> /etc/containers/registries.conf <<EOF
[[registry]]
location = "${registry_name}"

[[registry.mirror]]
location = "localhost:${registry_port}"
insecure = true
EOF

    # Создать конфигурацию сервера Docker Registry
    cat > /etc/docker-registry/config-${registry_name}.yml <<EOF
version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/docker-registry/${registry_name}
http:
  addr: ":${registry_port}"
  headers:
    X-Content-Type-Options: [nosniff]
proxy:
  remoteurl: ${remote_url}
EOF

    # Создать и включить systemd-службу
    cp /lib/systemd/system/docker-registry.service \
        /etc/systemd/system/docker-registry-${registry_name}.service
    sed -i "s|config.yml|config-${registry_name}.yml|g" \
        /etc/systemd/system/docker-registry-${registry_name}.service
    systemctl daemon-reload
    systemctl enable --now docker-registry-${registry_name}.service && \
    sleep 5 && \
    systemctl status docker-registry-${registry_name}.service --no-pager -l
}

# setup_registry registry.altlinux.org https://registry.altlinux.org 5000
# setup_registry altlinux.space https://altlinux.space 5001

# netstat -nlpt | grep -E ':(500[0-5])'

# for port in 5000 5001; do
    curl -s http://localhost:${port}/v2/_catalog | jq
done

$ podman pull registry.altlinux.org/p11/kube-apiserver && \
curl http://localhost:5000/v2/_catalog | jq && \
curl http://localhost:5000/v2/p11/kube-apiserver/tags/list | jq && \
podman pull localhost:5000/p11/kube-apiserver

# systemctl enable --now discovery-service-rs.service

$ netstat -tulnp | grep '[32]000'

tcp    0    0 0.0.0.0:2000     0.0.0.0:*     LISTEN    1790/discovery-serv
tcp    0    0 0.0.0.0:3000     0.0.0.0:*     LISTEN    1790/discovery-serv

$ for i in 2 3 4 5 6; do 
    talosctl -e 192.168.0.$i -n 192.168.0.$i get disks --insecure
done

NODE  NAMESPACE TYPE   ID    VERSION SIZE   READ ONLY TRANSPORT ROTATIONAL WWID MODEL       SERIAL
      runtime   Disk   loop0 2       4.1 kB true
      runtime   Disk   loop1 2       98 MB  true
      runtime   Disk   sda   2        6 GB  false     virtio    true            QEMU HARDDISK
      runtime   Disk   sr0   2       377 MB false     sata                      QEMU DVD-ROM

REPO=p11 && \
KUBELET_VERSION="v1.34.8" && \
COREDNS_VERSION="$(curl -ks "https://registry.altlinux.org/v2/${REPO}/coredns/tags/list" | jq -r  '.tags | sort | .[]' | tail -1)" && \
ETCD_VERSION="$(curl -ks "https://registry.altlinux.org/v2/${REPO}/etcd/tags/list" | jq -r  '.tags | sort | .[]' | tail -1)" && \
PAUSE_VERSION="$(curl -ks "https://registry.altlinux.org/v2/${REPO}/pause/tags/list" | jq -r  '.tags | sort | .[]' | tail -1)"

DEVICE="/dev/sda" && \
INSTALLERIMAGE="altlinux.space/alt-orchestra/installer:v11.0"

KUBELETIMAGE="registry.altlinux.org/${REPO}/kubelet:${KUBELET_VERSION}" && \
APISERVERIMAGE="registry.altlinux.org/${REPO}/kube-apiserver:${KUBELET_VERSION}" && \
CONTROLMANAGERIMAGE="registry.altlinux.org/${REPO}/kube-controller-manager:${KUBELET_VERSION}" && \
SCHEDULERIMAGE="registry.altlinux.org/${REPO}/kube-scheduler:${KUBELET_VERSION}" && \
COREDNSIMAGE="registry.altlinux.org/${REPO}/coredns:${COREDNS_VERSION}" && \
ETCDIMAGE="registry.altlinux.org/${REPO}/etcd:${ETCD_VERSION}" && \
PAUSEIMAGE="registry.altlinux.org/${REPO}/pause:${PAUSE_VERSION}"

$ for image in \
  ${KUBELETIMAGE} \
  ${APISERVERIMAGE} \
  ${CONTROLMANAGERIMAGE} \
  ${SCHEDULERIMAGE} \
  ${COREDNSIMAGE} \
  ${ETCDIMAGE} \
  ${PAUSEIMAGE} \
  ${INSTALLERIMAGE};
do
  podman pull $image;
done

$ curl http://localhost:5000/v2/_catalog | jq
$ curl http://localhost:5001/v2/_catalog | jq

$ cat > patch_common.yaml << PATCH
cluster:
  network:
    cni:
      name: none
  proxy:
    disabled: true
  discovery:
    enabled: true
    registries:
      kubernetes:
        disabled: true
      service:
        endpoint: http://192.168.0.1:3000
machine:
  time:
    servers:
      - 192.168.0.1
  network:
    nameservers:
      - 192.168.0.1
  install:
    disk: ${DEVICE}
    image: ${INSTALLERIMAGE}
  kubelet:
    image: ${KUBELETIMAGE}
  registries:
    mirrors:
      registry.altlinux.org:
        endpoints:
          - http://192.168.0.1:5000
      altlinux.space:
        endpoints:
          - http://192.168.0.1:5001
PATCH

$ cat > patch_controlplane.yaml << PATCH
machine:
  network:
    interfaces:
      - deviceSelector:
          physical: true
        dhcp: true
        vip:
          ip: 192.168.0.200
cluster:
  apiServer:
    image: ${APISERVERIMAGE}
  controllerManager:
    image: ${CONTROLMANAGERIMAGE}
  scheduler:
    image: ${SCHEDULERIMAGE}
  etcd:
    image: ${ETCDIMAGE}
  coreDNS:
    image: ${COREDNSIMAGE}
PATCH

$ talosctl gen config talos https://192.168.0.200:6443 \
    --config-patch @patch_common.yaml \
    --config-patch-control-plane @patch_controlplane.yaml

$ talosctl config merge talosconfig

$ talosctl config context talos
$ talosctl config info

$ talosctl apply-config --insecure -n 192.168.0.2 --file controlplane.yaml
$ talosctl apply-config --insecure -n 192.168.0.3 --file controlplane.yaml
$ talosctl apply-config --insecure -n 192.168.0.4 --file controlplane.yaml

$ talosctl apply-config --insecure -n 192.168.0.5 --file worker.yaml
$ talosctl apply-config --insecure -n 192.168.0.6 --file worker.yaml

$ talosctl -e 192.168.0.2 -n 192.168.0.2 bootstrap

$ talosctl -e 192.168.0.2 -n 192.168.0.2 kubeconfig

$ curl https://altlinux.space/cloud/charts/raw/branch/master/cilium/sisyphus/1.18.2/values.yaml -o cilium-values.yaml

$ sed -i '/genericDigest: "sha256:a573bf42c0199aef9c68b657b2ea53cc31293a0a6eb2e812604cc8c31f846db0"/d' cilium-values.yaml

$ sed -i "s|useDigest: true|useDigest: false|g" cilium-values.yaml
$ helm repo add cilium https://helm.cilium.io
$ helm repo update
$ helm install \
  cilium \
  cilium/cilium \
  --version 1.18.2 \
  --namespace kube-system \
  --set ipam.mode=kubernetes \
  --set kubeProxyReplacement=true \
  --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
  --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
  --set cgroup.autoMount.enabled=false \
  --set cgroup.hostRoot=/sys/fs/cgroup \
  --set k8sServiceHost=localhost \
  --set k8sServicePort=7445 \
  -f cilium-values.yaml

$ kubectl get nodes

NAME                    STATUS   ROLES           AGE   VERSION
alt-orchestra-2n9-fm5   Ready    <none>          69s   v1.34.8
alt-orchestra-4ty-xyj   Ready    control-plane   70s   v1.34.8
alt-orchestra-861-o83   Ready    <none>          61s   v1.34.8
alt-orchestra-9v7-0p2   Ready    control-plane   63s   v1.34.8
alt-orchestra-kus-sds   Ready    control-plane   67s   v1.34.8

$ kubectl get pods -A

NAMESPACE     NAME                                            READY   STATUS    RESTARTS       AGE
kube-system   cilium-2jvb4                                    1/1     Running   0              112s
kube-system   cilium-4xrlg                                    1/1     Running   1 (52s ago)    112s
kube-system   cilium-9nspx                                    1/1     Running   0              112s
kube-system   cilium-9zb6v                                    1/1     Running   0              113s
kube-system   cilium-cp96k                                    1/1     Running   0              113s
kube-system   cilium-envoy-2m8wp                              1/1     Running   0              112s
kube-system   cilium-envoy-4mx5h                              1/1     Running   0              113s
kube-system   cilium-envoy-g8qh5                              1/1     Running   0              112s
kube-system   cilium-envoy-xffdn                              1/1     Running   0              113s
kube-system   cilium-envoy-z8xw6                              1/1     Running   0              113s
kube-system   cilium-operator-67f4b4f5fd-9djtg                1/1     Running   1 (82s ago)    112s
kube-system   cilium-operator-67f4b4f5fd-wkjdq                1/1     Running   1 (69s ago)    113s
kube-system   coredns-5966c6bdcd-2gxvq                        1/1     Running   0              3m43s
kube-system   coredns-5966c6bdcd-qfmn2                        1/1     Running   0              3m43s
kube-system   kube-apiserver-alt-orchestra-27m-03d            1/1     Running   0              3m30s
kube-system   kube-apiserver-alt-orchestra-gpg-qkl            1/1     Running   0              3m36s
kube-system   kube-apiserver-alt-orchestra-urk-gud            1/1     Running   0              2m59s
kube-system   kube-controller-manager-alt-orchestra-27m-03d   1/1     Running   0              3m30s
kube-system   kube-controller-manager-alt-orchestra-gpg-qkl   1/1     Running   1 (96s ago)    3m36s
kube-system   kube-controller-manager-alt-orchestra-urk-gud   1/1     Running   2 (4m3s ago)   2m59s
kube-system   kube-scheduler-alt-orchestra-27m-03d            1/1     Running   0              3m30s
kube-system   kube-scheduler-alt-orchestra-gpg-qkl            1/1     Running   0              3m36s
kube-system   kube-scheduler-alt-orchestra-urk-gud            1/1     Running   4 (58s ago)    2m58s

$ kubectl get all -A

NAMESPACE     NAME                                                READY   STATUS    RESTARTS        AGE
kube-system   pod/cilium-2jvb4                                    1/1     Running   0               2m11s
kube-system   pod/cilium-4xrlg                                    1/1     Running   1 (71s ago)     2m11s
kube-system   pod/cilium-9nspx                                    1/1     Running   0               2m11s
kube-system   pod/cilium-9zb6v                                    1/1     Running   0               2m12s
kube-system   pod/cilium-cp96k                                    1/1     Running   0               2m12s
kube-system   pod/cilium-envoy-2m8wp                              1/1     Running   0               2m11s
kube-system   pod/cilium-envoy-4mx5h                              1/1     Running   0               2m12s
kube-system   pod/cilium-envoy-g8qh5                              1/1     Running   0               2m11s
kube-system   pod/cilium-envoy-xffdn                              1/1     Running   0               2m12s
kube-system   pod/cilium-envoy-z8xw6                              1/1     Running   0               2m12s
kube-system   pod/cilium-operator-67f4b4f5fd-9djtg                1/1     Running   1 (101s ago)    2m11s
kube-system   pod/cilium-operator-67f4b4f5fd-wkjdq                1/1     Running   1 (88s ago)     2m12s
kube-system   pod/coredns-5966c6bdcd-2gxvq                        1/1     Running   0               4m2s
kube-system   pod/coredns-5966c6bdcd-qfmn2                        1/1     Running   0               4m2s
kube-system   pod/kube-apiserver-alt-orchestra-27m-03d            1/1     Running   0               3m49s
kube-system   pod/kube-apiserver-alt-orchestra-gpg-qkl            1/1     Running   0               3m55s
kube-system   pod/kube-apiserver-alt-orchestra-urk-gud            1/1     Running   0               3m18s
kube-system   pod/kube-controller-manager-alt-orchestra-27m-03d   1/1     Running   0               3m49s
kube-system   pod/kube-controller-manager-alt-orchestra-gpg-qkl   1/1     Running   1 (115s ago)    3m55s
kube-system   pod/kube-controller-manager-alt-orchestra-urk-gud   1/1     Running   2 (4m22s ago)   3m18s
kube-system   pod/kube-scheduler-alt-orchestra-27m-03d            1/1     Running   0               3m49s
kube-system   pod/kube-scheduler-alt-orchestra-gpg-qkl            1/1     Running   0               3m55s
kube-system   pod/kube-scheduler-alt-orchestra-urk-gud            1/1     Running   4 (77s ago)     3m17s

NAMESPACE     NAME                   TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                  AGE
default       service/kubernetes     ClusterIP   10.96.0.1      <none>        443/TCP                  5m32s
kube-system   service/cilium-envoy   ClusterIP   None           <none>        9964/TCP                 2m12s
kube-system   service/hubble-peer    ClusterIP   10.110.143.8   <none>        443/TCP                  2m12s
kube-system   service/kube-dns       ClusterIP   10.96.0.10     <none>        53/UDP,53/TCP,9153/TCP   4m16s

NAMESPACE     NAME                          DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
kube-system   daemonset.apps/cilium         5         5         5       5            5           kubernetes.io/os=linux   2m12s
kube-system   daemonset.apps/cilium-envoy   5         5         5       5            5           kubernetes.io/os=linux   2m12s

NAMESPACE     NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
kube-system   deployment.apps/cilium-operator   2/2     2            2           2m12s
kube-system   deployment.apps/coredns           2/2     2            2           4m16s

NAMESPACE     NAME                                         DESIRED   CURRENT   READY   AGE
kube-system   replicaset.apps/cilium-operator-67f4b4f5fd   2         2         2       2m12s
kube-system   replicaset.apps/coredns-5966c6bdcd           2         2         2       4m2s

$ kubectl get svc -A

NAMESPACE    NAME         TYPE        CLUSTER-IP   EXTERNAL-IP  PORT(S)                  AGE
default      kubernetes   ClusterIP   10.96.0.1    <none>       443/TCP                  6m2s
kube-system  cilium-envoy ClusterIP   None         <none>       9964/TCP                 2m42s
kube-system  hubble-peer  ClusterIP   10.110.143.8 <none>       443/TCP                  2m42s
kube-system  kube-dns     ClusterIP   10.96.0.10   <none>       53/UDP,53/TCP,9153/TCP   4m46s
kube-system  hubble-relay ClusterIP   10.109.3.163 <none>       80/TCP                   2m42s
kube-system  hubble-ui    ClusterIP   10.97.174.183 <none>      80/TCP                   2m42s

$ talosctl config endpoint 192.168.0.2 192.168.0.3 192.168.0.4

$ talosctl -n 192.168.0.2 service
$ talosctl -n 192.168.0.3 service
$ talosctl -n 192.168.0.4 service
$ talosctl -n 192.168.0.5 service
$ talosctl -n 192.168.0.6 service

NODE          SERVICE     STATE     HEALTH  LAST CHANGE   LAST EVENT
192.168.0.4   apid       Running  OK      5m41s ago   Health check successful
192.168.0.4   auditd     Running  OK      5m52s ago   Health check successful
192.168.0.4   containerd Running  OK      5m52s ago   Health check successful
192.168.0.4   cri        Running  OK      5m41s ago   Health check successful
192.168.0.4   dashboard  Running  ?       5m42s ago   Process Process(["/sbin/dashboard"]) started with PID 2204
192.168.0.4   etcd       Running  OK      3m37s ago   Health check successful
192.168.0.4   kubelet    Running  OK      5m35s ago   Health check successful
192.168.0.4   machined   Running  OK      5m52s ago   Health check successful
192.168.0.4   syslogd    Running  OK      5m51s ago   Health check successful
192.168.0.4   trustd     Running  OK      5m41s ago   Health check successful
192.168.0.4   udevd      Running  OK      5m43s ago   Health check successful

NODE          SERVICE     STATE     HEALTH  LAST CHANGE  LAST EVENT
192.168.0.5   apid        Running  OK     5m40s ago    Health check successful
192.168.0.5   auditd      Running  OK     5m48s ago    Health check successful
192.168.0.5   containerd  Running  OK     5m48s ago    Health check successful
192.168.0.5   cri         Running  OK     5m39s ago    Health check successful
192.168.0.5   dashboard   Running  ?      5m41s ago    Process Process(["/sbin/dashboard"]) started with PID 2094
192.168.0.5   kubelet     Running  OK     5m34s ago    Health check successful
192.168.0.5   machined    Running  OK     5m48s ago    Health check successful
192.168.0.5   syslogd     Running  OK     5m47s ago    Health check successful
192.168.0.5   udevd       Running  OK     5m42s ago    Health check successful

$ talosctl get members -n 192.168.0.2 -e 192.168.0.2
$ talosctl get members -n 192.168.0.3 -e 192.168.0.3
$ talosctl get members -n 192.168.0.4 -e 192.168.0.4
$ talosctl get members -n 192.168.0.5 -e 192.168.0.5
$ talosctl get members -n 192.168.0.6 -e 192.168.0.6

NODE          NAMESPACE   TYPE     ID                      VERSION  HOSTNAME               MACHINE TYPE   OS                      ADDRESSES
192.168.0.2   cluster   Member   alt-orchestra-4nl-pux   1        alt-orchestra-4nl-pux  controlplane   ALT Orchestra (v11.0)   ["192.168.0.2"]
192.168.0.2   cluster   Member   alt-orchestra-8vo-85l   1        alt-orchestra-8vo-85l  controlplane   ALT Orchestra (v11.0)   ["192.168.0.3"]
192.168.0.2   cluster   Member   alt-orchestra-hku-1uk   1        alt-orchestra-hku-1uk  worker         ALT Orchestra (v11.0)   ["192.168.0.5"]
192.168.0.2   cluster   Member   alt-orchestra-tab-x0d   1        alt-orchestra-tab-x0d  worker         ALT Orchestra (v11.0)   ["192.168.0.6"]
192.168.0.2   cluster   Member   alt-orchestra-y3q-ik2   1        alt-orchestra-y3q-ik2  controlplane   ALT Orchestra (v11.0)   ["192.168.0.4"]

$ talosctl health -n 192.168.0.2
$ talosctl health -n 192.168.0.3
$ talosctl health -n 192.168.0.4

$ talosctl -n <IP-адрес-узла> get securitystate --insecure

$ talosctl -n 192.168.0.222 get securitystate --insecure

NODE  NAMESPACE  TYPE           ID             SECUREBOOT
runtime    SecurityState  securitystate  true

$ talosctl gen config <cluster-name> https://<endpoint>:6443 \
  --install-image=<secureboot-image> \
  --install-disk=/dev/sda

$ CONTROL_PLANE_IP=192.168.0.222
$ export CLUSTER_NAME=security-cluster
$ export BASE_REGISTRY="factory.altlinux.space"
$ export INSTALLERIMAGE="$BASE_REGISTRY/alt-orchestra-metal-installer-secureboot/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v11.0"
$ export DISK_NAME=/dev/vda

$ talosctl gen config $CLUSTER_NAME https://$CONTROL_PLANE_IP:6443 \
  --output-dir _security \
  --install-image $INSTALLERIMAGE \
  --install-disk=$DISK_NAME

$ talosctl -n <IP-адрес-узла> apply-config --insecure -f controlplane.yaml

$ talosctl apply-config --insecure \
  --nodes $CONTROL_PLANE_IP \
  --file _security/controlplane.yaml

$ talosctl -n <IP-адрес-узла> --talosconfig=<talosconfig> get securitystate

$ talosctl -n $CONTROL_PLANE_IP \
  --talosconfig=_security/talosconfig get securitystate

NODE           NAMESPACE  TYPE           ID             SECUREBOOT
192.168.0.222  runtime    SecurityState  securitystate  true

machine:
  systemDiskEncryption:
    ephemeral:
      provider: luks2
      keys:
        - slot: 0
          tpm: {}
    state:
      provider: luks2
      keys:
        - slot: 0
          tpm: {}

$ talosctl gen config <cluster-name> https://<endpoint>:6443 \
  --install-image=<secureboot-image> \
  --install-disk=/dev/sda \
  --config-patch @tpm-disk-encryption.yaml

$ CONTROL_PLANE_IP=192.168.0.194
$ export CLUSTER_NAME=security-cluster
$ export BASE_REGISTRY="factory.altlinux.space"
$ export INSTALLERIMAGE="$BASE_REGISTRY/alt-orchestra-metal-installer-secureboot/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v11.0"
$ export DISK_NAME=/dev/vda

$ talosctl gen config $CLUSTER_NAME https://$CONTROL_PLANE_IP:6443 \
  --output-dir _tpm \
  --install-image $INSTALLERIMAGE \
  --config-patch @tpm-disk-encryption.yaml  \
  --install-disk=$DISK_NAME

$ talosctl -n <IP-адрес-узла> apply-config --insecure -f controlplane.yaml

$ talosctl apply-config --insecure \
  --nodes $CONTROL_PLANE_IP \
  --file _tpm/controlplane.yaml

$ talosctl -n <IP-адрес-узла> --talosconfig=<talosconfig> get securitystate

$ talosctl gen secureboot uki --common-name "SecureBoot Key"

  writing _out/uki-signing-cert.pem
  writing _out/uki-signing-cert.der
  writing _out/uki-signing-key.pem

$ talosctl gen secureboot pcr

  writing _out/pcr-signing-key.pem

$ talosctl gen secureboot database

  writing _out/db.auth
  writing _out/KEK.auth
  writing _out/PK.auth

$ podman run --rm -t \
  -v $PWD/_out:/secureboot:ro \
  -v $PWD/_out:/out \
  altlinux.space/alt-orchestra/imager:v11.0 secureboot-iso

_out/alt-orchestra-11.0-metal-amd64-secureboot.iso

$ podman run --rm -t \
  -v $PWD/_out:/secureboot:ro \
  -v $PWD/_out:/out \
  altlinux.space/alt-orchestra/imager:v11.0 \
  secureboot-installer \
  --base-installer-image altlinux.space/alt-orchestra/installer-base:v11.0

_out/alt-orchestra-11.0-installer-amd64-secureboot.tar

$ mkdir -p ~/ha-cluster
$ cd ~/ha-cluster

$ talosctl gen secrets -o secrets.yaml

$ talosctl gen config \
  --with-secrets secrets.yaml \
  "$CLUSTER_NAME" \
  "https://$CLUSTER_ENDPOINT:6443"

$ talosctl apply-config --insecure \
  --nodes "${CONTROL_PLANE_IP[0]}" \
  --file talos/controlplanes/controlplane-1.yaml

$ talosctl apply-config --insecure \
  --nodes "${CONTROL_PLANE_IP[1]}" \
  --file talos/controlplanes/controlplane-2.yaml

$ talosctl apply-config --insecure \
  --nodes "${CONTROL_PLANE_IP[2]}" \
  --file talos/controlplanes/controlplane-3.yaml

$ talosctl apply-config --insecure \
  --nodes "${WORKER_IP[0]}" \
  --file talos/workers/worker-1.yaml

$ talosctl apply-config --insecure \
  --nodes "${WORKER_IP[1]}" \
  --file talos/workers/worker-2.yaml

$ talosctl dmesg --nodes <IP-адрес_узла>

$ talosctl config merge ./talosconfig

$ talosctl config context "$CLUSTER_NAME"

$ talosctl config endpoint "${CONTROL_PLANE_IP[@]}"

$ talosctl bootstrap \
  --nodes "${CONTROL_PLANE_IP[0]}" \
  --endpoints "${CONTROL_PLANE_IP[0]}"

$ talosctl kubeconfig \
  --nodes "${CONTROL_PLANE_IP[0]}" \
  --endpoints "${CONTROL_PLANE_IP[0]}"

$ kubectl config current-context

$ kubectl get nodes -o wide

$ talosctl health \
  --nodes "${CONTROL_PLANE_IP[0]}" \
  --endpoints "${CONTROL_PLANE_IP[0]}"

# apt-get install sops age

$ mkdir -p ~/.config/sops/age
$ age-keygen -o ~/.config/sops/age/keys.txt

$ AGE_RECIPIENT=$(age-keygen -y ~/.config/sops/age/keys.txt)

$ sops encrypt --age "$AGE_RECIPIENT" secrets.yaml > secrets.sops.yaml

$ sops encrypt \
  --input-type binary \
  --output-type binary \
  --age "$AGE_RECIPIENT" \
  talosconfig > talosconfig.sops

$ sops encrypt \
  --input-type binary \
  --output-type binary \
  --age "$AGE_RECIPIENT" \
  kubeconfig > kubeconfig.sops

$ sops decrypt secrets.sops.yaml > secrets.yaml

$ sops decrypt \
  --input-type binary \
  --output-type binary \
  talosconfig.sops > talosconfig

$ sops decrypt \
  --input-type binary \
  --output-type binary \
  kubeconfig.sops > kubeconfig

$ talosctl apply-config --insecure \
 --nodes 192.168.0.141 \
 --file _pve/controlplane.yaml

$ talosctl apply-config --insecure \
 --nodes 192.168.0.147 \
 --file _pve/worker.yaml

$ talosctl apply-config --insecure \
 --nodes 192.168.0.147 \
 --file _pve/worker.yaml

$ kubectl --kubeconfig ./kubeconfig get nodes

NAME                    STATUS   ROLES           AGE   VERSION
alt-orchestra-40p-byh   Ready      <none>          5m16s   v1.35.0
alt-orchestra-6ub-m6m   Ready      <none>          26m     v1.35.0
alt-orchestra-9hf-ozu   Ready      control-plane   26m     v1.35.0
alt-orchestra-bob-f6v   NotReady   control-plane   17s     v1.35.0
alt-orchestra-ezp-gxw   Ready      <none>          26m     v1.35.0

$ talosctl health -n 192.168.0.140
$ talosctl health -n 192.168.0.141

$ kubectl --kubeconfig ./kubeconfig get all -A

$ talosctl get KubernetesDynamicCerts -o yaml \
 --nodes <controlplane-ip>

$ talosctl -n <controlplane-ip> config new talosconfig-reader \
  --roles os:reader \
  --crt-ttl 24h

$ talosctl gen config \
  --with-secrets secrets.yaml \
  --output-types talosconfig \
  -o talosconfig \
  <cluster-name> https://<cluster-endpoint>

$ talosctl get machineconfig v1alpha1 -o jsonpath='{.spec}' > machineconfig.yaml

$ talosctl -n <IP-адрес-узла> apply-config -f config.yaml

$ talosctl -n <IP-адрес-узла> apply machineconfig -f config.yaml

$ talosctl -n <IP-адрес-узла> apply machineconfig -f config.yaml --mode=no-reboot

$ talosctl -n <IP-адрес-узла> apply machineconfig --mode=interactive

$ talosctl -n <IP-адрес-узла> edit machineconfig

$ talosctl -n <IP1>,<IP2>… edit machineconfig

$ talosctl -n <IP-адрес-узла> edit machineconfig --mode=no-reboot

$ talosctl -n <IP-адрес-узла> patch machineconfig -p '[{"op": "replace", "path": "/machine/kubelet/image", "value": "registry.altlinux.org/p11/kubelet:v1.35"}]'

$ talosctl -n <IP-адрес-узла> patch machineconfig --mode=no-reboot -p '[{"op": "replace", "path": "/cluster/apiServer/image", "value": "registry.altlinux.org/p11/kube-apiserver:v1.35"}]'

$ talosctl -n <IP1>,<IP2>… patch machineconfig -p '[{...}]'

$ talosctl -n <IP-адрес-узла> patch machineconfig \
  -p @kubelet-patch.json -p @manifest-patch.json

- op: replace
  path: /machine/kubelet/image
  value: registry.altlinux.org/p11/kubelet:v1.35

$ talosctl -n <IP-адрес-узла> patch machineconfig -p @kubelet-patch.yaml

docker build -t my-extension:latest .

$ talosctl -n 192.168.0.147 get extensions

NODE          NAMESPACE  TYPE            ID VERSION  NAME               VERSION
192.168.0.147 runtime    ExtensionStatus 0  1        intel-ucode        20251111
192.168.0.147 runtime    ExtensionStatus 1  1        util-linux-tools   2.39.2
192.168.0.147 runtime    ExtensionStatus    1        schematic          80d5f9d0991e825b84617b4f2ce25b840050e3ee6a83647ac1bc0a559cf90962

$ talosctl -n 192.168.0.147 get extensions 0 -o yaml

node: 192.168.0.147
metadata:
    namespace: runtime
    type: ExtensionStatuses.runtime.talos.dev
    id: 0
    version: 1
    owner: runtime.ExtensionStatusController
    phase: running
    created: 2026-04-23T11:21:14Z
    updated: 2026-04-23T11:21:14Z
spec:
    image: 0.sqsh
    metadata:
        name: intel-ucode
        version: "20251111"
        author: Basealt LLC
        description: |
            intel-ucode module
        compatibility:
            talos:
                version: '>= v1.0.0'

$ talosctl -n 192.168.0.147 get extensions 1 -o yaml

{
    "metadata": {
        "created": "2026-04-23T11:21:14Z",
        "id": 1,
        "namespace": "runtime",
        "owner": "runtime.ExtensionStatusController",
        "phase": "running",
        "type": "ExtensionStatuses.runtime.talos.dev",
        "updated": "2026-04-23T11:21:14Z",
        "version": 1
    },
    "node": "192.168.0.147",
    "spec": {
        "image": "1.sqsh",
        "metadata": {
            "author": "Basealt LLC",
            "compatibility": {
                "talos": {
                    "version": "\u003e= v1.0.0"
                }
            },
            "description": "minimal util-linux package\n",
            "name": "util-linux-tools",
            "version": "2.39.2"
        }
    }
}

$ talosctl -n 192.168.0.140 dmesg

…
192.168.0.140: kern:    info: [2026-05-20T09:04:32.286426442Z]: cni0: port 2(vethfc8629cd) entered disabled state
192.168.0.140: kern:    info: [2026-05-20T09:04:32.286454534Z]: vethfc8629cd: entered allmulticast mode
192.168.0.140: kern:    info: [2026-05-20T09:04:32.286520294Z]: vethfc8629cd: entered promiscuous mode
192.168.0.140: kern:    info: [2026-05-20T09:04:32.29266636Z]: cni0: port 2(vethfc8629cd) entered blocking state
192.168.0.140: kern:    info: [2026-05-20T09:04:32.292682238Z]: cni0: port 2(vethfc8629cd) entered forwarding state

$ talosctl -n 192.168.0.140 services

NODE          SERVICE     STATE    HEALTH  LAST CHANGE   LAST EVENT
192.168.0.140 apid        Running  OK      1h27m45s ago  Health check successful
192.168.0.140 auditd      Running  OK      1h27m58s ago  Health check successful
192.168.0.140 containerd  Running  OK      1h27m58s ago  Health check successful
192.168.0.140 cri         Running  OK      1h27m41s ago  Health check successful
192.168.0.140 dashboard   Running  ?       1h27m46s ago  Process Process(["/sbin/dashboard"]) started with PID 2143
192.168.0.140 etcd        Running  OK      1h27m30s ago  Health check successful
192.168.0.140 kubelet     Running  OK      1h27m26s ago  Health check successful
192.168.0.140 machined    Running  OK      1h27m58s ago  Health check successful
192.168.0.140 syslogd      Running   OK    1h27m57s ago  Health check successful
192.168.0.140 trustd      Running  OK      1h27m42s ago  Health check successful
192.168.0.140 udevd       Running  OK      1h27m48s ago  Health check successful

$ talosctl -n 192.168.0.140 logs machined

192.168.0.140: uthorized ([os:admin os:operator os:reader] includes [os:admin])
192.168.0.140: 2026/05/20 10:08:42.674116 machined OK [/machine.MachineService/LoadAvg] 684.822µs unary Success (:authority=localhost;content-type=application/grpc;grpc-accept-encoding=gzip;runtime=Talos;talos-role=os:admin;user-agent=grpc-go/1.79.3)
192.168.0.140: 2026/05/20 10:08:42.674139 machined/authz/authorizer authorized ([os:admin os:operator os:reader] includes [os:admin])
192.168.0.140: 2026/05/20 10:08:42.674196 machined OK [/machine.MachineService/Version] 61.501µs unary Success (:authority=localhost;content-type=application/grpc;grpc-accept-encoding=gzip;runtime=Talos;talos-role=os:admin;user-agent=grpc-go/1.79.3)

$ talosctl -n 192.168.0.140 containers -k

NODE             NAMESPACE   ID                                                                                          IMAGE                                                            PID    STATUS

192.168.0.140   k8s.io      kube-system/coredns-5d988558b4-bprr7                                                          registry.altlinux.org/p11/pause:latest                      3706   SANDBOX_READY
192.168.0.140   k8s.io      └─ kube-system/coredns-5d988558b4-bprr7:coredns:12d271240d6a                                  registry.altlinux.org/p11/coredns:v1.13.1                   3729   CONTAINER_RUNNING
192.168.0.140   k8s.io      kube-system/coredns-5d988558b4-lcqkq                                                          registry.altlinux.org/p11/pause:latest                      3546   SANDBOX_READY
192.168.0.140   k8s.io      └─ kube-system/coredns-5d988558b4-lcqkq:coredns:e8d4666636d8                                  registry.altlinux.org/p11/coredns:v1.13.1                   3570   CONTAINER_RUNNING
192.168.0.140   k8s.io      kube-system/kube-apiserver-controlplane-01                                                    registry.altlinux.org/p11/pause:latest                      2534   SANDBOX_READY
192.168.0.140   k8s.io      └─ kube-system/kube-apiserver-controlplane-01:kube-apiserver:22ba4d5e9dc7                     registry.altlinux.org/p11/kube-apiserver:v1.35.0            2628   CONTAINER_RUNNING
…

$ talosctl -n 192.168.0.140 logs syslogd

$ talosctl -n 192.168.0.140 processes | sed 's| |\n|g' | grep -E "(audit-policy|audit-log)"

--audit-log-maxage=30
--audit-log-maxbackup=10
--audit-log-maxsize=100
--audit-log-path=/var/log/audit/kube/kube-apiserver.log
--audit-policy-file=/system/config/kubernetes/kube-apiserver/auditpolicy.yaml

$ talosctl -n 192.168.0.140 cat /system/config/kubernetes/kube-apiserver/auditpolicy.yaml

apiVersion: audit.k8s.io/v1
kind: Policy
metadata:
  creationTimestamp: null
rules:
- level: Metadata

$ talosctl get mc -n 192.168.0.140 v1alpha1 \
   -o jsonpath='{.spec}' 2>/dev/null | \
   yq '.cluster.apiServer.auditPolicy'

{
  "apiVersion": "audit.k8s.io/v1",
  "kind": "Policy",
  "rules": [
    {
      "level": "Metadata"
    }
  ]
}

$ talosctl -n 192.168.0.140 cat /var/log/audit/kube/kube-apiserver.log | \
  tail -n 1 | jq

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "35da1bd4-458d-4ae3-8d94-48a43f191b6a",
  "stage": "ResponseComplete",
  "requestURI": "/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-scheduler?timeout=5s",
  "verb": "get",
  "user": {
    "username": "system:kube-scheduler",
    "groups": [
      "system:kube-scheduler",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=1c78e3fa4db5aa8c23483a739b010dde1e044a80a7b03afa108f90ab00913b16"
      ]
    }
  },
  "sourceIPs": [
    "fdda:e7b2:9f17:0:a00:27ff:fee4:406d"
  ],
  "userAgent": "kube-scheduler/v1.33.6 (linux/amd64) kubernetes/1e09fec/leader-election",
  "objectRef": {
    "resource": "leases",
    "namespace": "kube-system",
    "name": "kube-scheduler",
    "apiGroup": "coordination.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-04-16T15:58:38.860528Z",
  "stageTimestamp": "2026-04-16T15:58:38.863596Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"system:kube-scheduler\" of ClusterRole \"system:kube-scheduler\" to User \"system:kube-scheduler\""
  }
}

[
    {
        "op": "replace",
        "path": "/cluster/apiServer/auditPolicy/rules/0/level",
        "value": "RequestResponse"
    }
]

$ talosctl -n 192.168.0.140 patch machineconfig \
  -p '[{"op":"replace","path":"/cluster/apiServer/auditPolicy/rules/0/level","value":"RequestResponse"}]'

$ talosctl -n 192.168.0.141 patch machineconfig \
  -p '[{"op":"replace","path":"/cluster/apiServer/auditPolicy/rules/0/level","value":"RequestResponse"}]'

$ talosctl -n 192.168.0.140 cat /system/config/kubernetes/kube-apiserver/auditpolicy.yaml

apiVersion: audit.k8s.io/v1
kind: Policy
metadata:
  creationTimestamp: null
rules:
- level: RequestResponse

$ talosctl get mc -n 192.168.0.140 v1alpha1 \
   -o jsonpath='{.spec}' 2>/dev/null | yq '.cluster.apiServer.auditPolicy'

{
  "apiVersion": "audit.k8s.io/v1",
  "kind": "Policy",
  "rules": [
    {
      "level": "RequestResponse"
    }
  ]
}

$ kubectl --kubeconfig ./kubeconfig create sa test

$ talosctl -n 192.168.0.140 cat /var/log/audit/kube/kube-apiserver.log | \
  tail -n 1 | jq

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "4fe3c9a3-76e7-445a-a8f3-db0e31761652",
  "stage": "ResponseComplete",
  "requestURI": "...",
  "verb": "..."
...
}