Oracle

Creating a cluster via the CLI (oci) on OracleCloud.com.

Upload image

Oracle Cloud at the moment does not have a Talos official image. So you can use Bring Your Own Image (BYOI) approach.

Prepare an image for upload:

1. Generate an image using Image Factory.

2. Download the disk image artifact in qcow2 format (e.g: Oracle arm64 )

3. Define the image metadata file called image_metadata.json. Example for an arm64 deployment:

   {
       "version": 2,
       "externalLaunchOptions": {
           "firmware": "UEFI_64",
           "networkType": "PARAVIRTUALIZED",
           "bootVolumeType": "PARAVIRTUALIZED",
           "remoteDataVolumeType": "PARAVIRTUALIZED",
           "localDataVolumeType": "PARAVIRTUALIZED",
           "launchOptionsSource": "PARAVIRTUALIZED",
           "pvAttachmentVersion": 2,
           "pvEncryptionInTransitEnabled": true,
           "consistentVolumeNamingEnabled": true
       },
       "imageCapabilityData": "{\"capabilities\":{\"Compute.AMD_SecureEncryptedVirtualization\":{\"descriptorType\":\"boolean\",\"defaultValue\":false},\"Storage.BootVolumeType\":{\"descriptorType\":\"enumstring\",\"values\":[\"ISCSI\",\"PARAVIRTUALIZED\",\"SCSI\",\"IDE\",\"NVME\"],\"defaultValue\":\"PARAVIRTUALIZED\"},\"Storage.Iscsi.MultipathDeviceSupported\":{\"descriptorType\":\"boolean\",\"defaultValue\":false},\"Storage.ParaVirtualization.EncryptionInTransit\":{\"descriptorType\":\"boolean\",\"defaultValue\":true},\"Storage.ConsistentVolumeNaming\":{\"descriptorType\":\"boolean\",\"defaultValue\":true},\"Compute.SecureBoot\":{\"descriptorType\":\"boolean\",\"defaultValue\":false},\"Storage.ParaVirtualization.AttachmentVersion\":{\"descriptorType\":\"enuminteger\",\"values\":[1,2],\"defaultValue\":2},\"Storage.LocalDataVolumeType\":{\"descriptorType\":\"enumstring\",\"values\":[\"ISCSI\",\"PARAVIRTUALIZED\",\"SCSI\",\"IDE\",\"NVME\"],\"defaultValue\":\"PARAVIRTUALIZED\"},\"Network.AttachmentType\":{\"descriptorType\":\"enumstring\",\"values\":[\"VFIO\",\"PARAVIRTUALIZED\",\"E1000\",\"VDPA\"],\"defaultValue\":\"PARAVIRTUALIZED\"},\"Storage.RemoteDataVolumeType\":{\"descriptorType\":\"enumstring\",\"values\":[\"ISCSI\",\"PARAVIRTUALIZED\",\"SCSI\",\"IDE\",\"NVME\"],\"defaultValue\":\"PARAVIRTUALIZED\"},\"Compute.LaunchMode\":{\"descriptorType\":\"enumstring\",\"values\":[\"NATIVE\",\"EMULATED\",\"VDPA\",\"PARAVIRTUALIZED\",\"CUSTOM\"],\"defaultValue\":\"PARAVIRTUALIZED\"},\"Network.IPv6Only\":{\"descriptorType\":\"boolean\",\"defaultValue\":false},\"Compute.Firmware\":{\"descriptorType\":\"enumstring\",\"values\":[\"UEFI_64\"],\"defaultValue\":\"UEFI_64\"}}}",
       "imageCapsFormatVersion": "0eacf73b-5e10-4b69-a5d2-afd3f37fdd45",
       "operatingSystem": "Talos",
       "operatingSystemVersion": "1.7.6",
       "additionalMetadata": {
           "shapeCompatibilities": [
               {
                   "internalShapeName": "VM.Standard.A1.Flex",
                   "ocpuConstraints": null,
                   "memoryConstraints": null
               }
           ]
       }
   }
   

4. Create an archive containing the image and metadata called talos-oracle-arm64.oci:

   tar zcf oracle-arm64.oci oracle-arm64.qcow2 image_metadata.json
   

5. Upload the image to a storage bucket.

6. Create an image, using the new URL format for the storage bucket object.

Note: file names depends on configuration of deployment such as architecture, adjust accordingly.

Talos config

OracleCloud has highly available NTP service, it can be enabled in Talos machine config with:

machine:
  time:
    servers:
      - 169.254.169.254

Creating a cluster via the CLI

Login to the console. And open the Cloud Shell.

Create a network

export cidr_block=10.0.0.0/16
export subnet_block=10.0.0.0/24
export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/network/vcn/create.html#cmdoption-compartment-id

export vcn_id=$(oci network vcn create --cidr-block $cidr_block --display-name talos-example --compartment-id $compartment_id --query data.id --raw-output)
export rt_id=$(oci network subnet create --cidr-block $subnet_block --display-name kubernetes --compartment-id $compartment_id --vcn-id $vcn_id --query data.route-table-id --raw-output)
export ig_id=$(oci network internet-gateway create --compartment-id $compartment_id --is-enabled true --vcn-id $vcn_id --query data.id --raw-output)

oci network route-table update --rt-id $rt_id --route-rules "[{\"cidrBlock\":\"0.0.0.0/0\",\"networkEntityId\":\"$ig_id\"}]" --force

# disable firewall
export sl_id=$(oci network vcn list --compartment-id $compartment_id --query 'data[0]."default-security-list-id"' --raw-output)

oci network security-list update --security-list-id $sl_id --egress-security-rules '[{"destination": "0.0.0.0/0", "protocol": "all", "isStateless": false}]' --ingress-security-rules '[{"source": "0.0.0.0/0", "protocol": "all", "isStateless": false}]' --force

Create a load balancer

Create a load balancer by issuing the commands shown below. Save the IP/DNS name, as this info will be used in the next step.

export subnet_id=$(oci network subnet list --compartment-id=$compartment_id --display-name kubernetes --query data[0].id --raw-output)
export network_load_balancer_id=$(oci nlb network-load-balancer create --compartment-id $compartment_id --display-name controlplane-lb --subnet-id $subnet_id --is-preserve-source-destination false --is-private false --query data.id --raw-output)

cat <<EOF > talos-health-checker.json
{
  "intervalInMillis": 10000,
  "port": 50000,
  "protocol": "TCP"
}
EOF

oci nlb backend-set create --health-checker file://talos-health-checker.json --name talos --network-load-balancer-id $network_load_balancer_id --policy TWO_TUPLE --is-preserve-source false
oci nlb listener create --default-backend-set-name talos --name talos --network-load-balancer-id $network_load_balancer_id --port 50000 --protocol TCP

cat <<EOF > controlplane-health-checker.json
{
  "intervalInMillis": 10000,
  "port": 6443,
  "protocol": "HTTPS",
  "returnCode": 401,
  "urlPath": "/readyz"
}
EOF

oci nlb backend-set create --health-checker file://controlplane-health-checker.json --name controlplane --network-load-balancer-id $network_load_balancer_id --policy TWO_TUPLE --is-preserve-source false
oci nlb listener create --default-backend-set-name controlplane --name controlplane --network-load-balancer-id $network_load_balancer_id --port 6443 --protocol TCP

# Save the external IP
oci nlb network-load-balancer list --compartment-id $compartment_id --display-name controlplane-lb --query 'data.items[0]."ip-addresses"'

Create the machine configuration files

Generating base configurations

Using the IP/DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines by issuing:

$ talosctl gen config talos-k8s-oracle-tutorial https://<load balancer IP or DNS>:6443 --additional-sans <load balancer IP or DNS>
created controlplane.yaml
created worker.yaml
created talosconfig

At this point, you can modify the generated configs to your liking. Optionally, you can specify machine configuration patches which will be applied during the config generation.

Validate the configuration files

Validate any edited machine configs with:

$ talosctl validate --config controlplane.yaml --mode cloud
controlplane.yaml is valid for cloud mode
$ talosctl validate --config worker.yaml --mode cloud
worker.yaml is valid for cloud mode

Create the servers

Create the control plane nodes

Create the control plane nodes with:

export shape='VM.Standard.A1.Flex'
export subnet_id=$(oci network subnet list --compartment-id=$compartment_id --display-name kubernetes --query data[0].id --raw-output)
export image_id=$(oci compute image list --compartment-id $compartment_id --shape $shape --operating-system Talos --limit 1 --query data[0].id --raw-output)
export availability_domain=$(oci iam availability-domain list --compartment-id=$compartment_id --query data[0].name --raw-output)
export network_load_balancer_id=$(oci nlb network-load-balancer list --compartment-id $compartment_id --display-name controlplane-lb --query 'data.items[0].id' --raw-output)

cat <<EOF > shape.json
{
  "memoryInGBs": 4,
  "ocpus": 1
}
EOF

export instance_id=$(oci compute instance launch --shape $shape --shape-config file://shape.json --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name controlplane-1 --private-ip 10.0.0.11 --assign-public-ip true --launch-options '{"networkType":"PARAVIRTUALIZED"}' --user-data-file controlplane.yaml --query 'data.id' --raw-output)

oci nlb backend create --backend-set-name talos --network-load-balancer-id $network_load_balancer_id --port 50000 --target-id $instance_id
oci nlb backend create --backend-set-name controlplane --network-load-balancer-id $network_load_balancer_id --port 6443 --target-id $instance_id

export instance_id=$(oci compute instance launch --shape $shape --shape-config file://shape.json --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name controlplane-2 --private-ip 10.0.0.12 --assign-public-ip true --launch-options '{"networkType":"PARAVIRTUALIZED"}' --user-data-file controlplane.yaml --query 'data.id' --raw-output)

oci nlb backend create --backend-set-name talos --network-load-balancer-id $network_load_balancer_id --port 50000 --target-id $instance_id
oci nlb backend create --backend-set-name controlplane --network-load-balancer-id $network_load_balancer_id --port 6443 --target-id $instance_id

export instance_id=$(oci compute instance launch --shape $shape --shape-config file://shape.json --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name controlplane-3 --private-ip 10.0.0.13 --assign-public-ip true --launch-options '{"networkType":"PARAVIRTUALIZED"}' --user-data-file controlplane.yaml --query 'data.id' --raw-output)

oci nlb backend create --backend-set-name talos --network-load-balancer-id $network_load_balancer_id --port 50000 --target-id $instance_id
oci nlb backend create --backend-set-name controlplane --network-load-balancer-id $network_load_balancer_id --port 6443 --target-id $instance_id

Create the worker nodes

Create the worker nodes with the following command, repeating (and incrementing the name counter) as many times as desired.

export subnet_id=$(oci network subnet list --compartment-id=$compartment_id --display-name kubernetes --query data[0].id --raw-output)
export image_id=$(oci compute image list --compartment-id $compartment_id --operating-system Talos --limit 1 --query data[0].id --raw-output)
export availability_domain=$(oci iam availability-domain list --compartment-id=$compartment_id --query data[0].name --raw-output)
export shape='VM.Standard.E2.1.Micro'

oci compute instance launch --shape $shape --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name worker-1 --assign-public-ip true --user-data-file worker.yaml

oci compute instance launch --shape $shape --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name worker-2 --assign-public-ip true --user-data-file worker.yaml

oci compute instance launch --shape $shape --availability-domain $availability_domain --compartment-id $compartment_id --image-id $image_id --subnet-id $subnet_id --display-name worker-3 --assign-public-ip true --user-data-file worker.yaml

Bootstrap etcd

To configure talosctl we will need the first control plane node’s IP. This can be found by issuing:

export instance_id=$(oci compute instance list --compartment-id $compartment_id --display-name controlplane-1 --query 'data[0].id' --raw-output)

oci compute instance list-vnics --instance-id $instance_id --query 'data[0]."private-ip"' --raw-output

Set the endpoints and nodes for your talosconfig with:

talosctl --talosconfig talosconfig config endpoint <load balancer IP or DNS>
talosctl --talosconfig talosconfig config node <control-plane-1-IP>

Bootstrap etcd on the first control plane node with:

talosctl --talosconfig talosconfig bootstrap

Retrieve the kubeconfig

At this point we can retrieve the admin kubeconfig by running:

talosctl --talosconfig talosconfig kubeconfig .