> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install talosctl

> Set up talosctl for managing Talos machines.

export const version = 'v1.13';

`talosctl` is a command-line tool for interacting with the Talos API and managing Talos machines.

Follow the instructions below to install it on your operating system:

## Linux and macOS

The easiest way to install `talosctl` is via [Homebrew](https://brew.sh/):

```bash theme={null}
brew install siderolabs/tap/sidero-tools
```

This method ensures that `talosctl` stays up to date automatically when new versions are released.
The same tap also includes a formula for `omnictl`.

For manual or Windows installation, see the <a href={`../../talos/${version}/getting-started/talosctl#alternative-install`}>alternate installation methods</a> in the Talos documentation.

## Omni-managed clusters and permissions

When managing Talos nodes through Omni, certain privileged `talosctl` commands are restricted.

All `os:admin` role commands except for a select few are **not** allowed to run against the Talos machines connected to Omni.

The following [`os:admin`](../reference/acls#role) commands **are allowed** when accessing Talos machines through Omni:

| Allowed commands                               |
| ---------------------------------------------- |
| `talosctl etcd alarm list`                     |
| `talosctl etcd alarm disarm`                   |
| `talosctl etcd defrag`                         |
| `talosctl etcd downgrade validate`             |
| `talosctl etcd downgrade enable`               |
| `talosctl etcd downgrade cancel`               |
| `talosctl etcd forfeit leadership`             |
| `talosctl etcd status`                         |
| `talosctl pcap`                                |
| `talosctl reboot`                              |
| `talosctl restart`                             |
| `talosctl service <id> [stop\|start\|restart]` |
| `talosctl shutdown`                            |

## Sensitive resources

Omni restricts access to machine configuration because it may contain sensitive PKI material. To see which resources are not accessible, run:

```sh theme={null}
talosctl get rds -o json | jq -s '.[] | select(.spec.sensitivity=="sensitive") | .metadata.id'
```