omnictl CLI - Sidero Documentation

omnictl apply

Create or update resource using YAML file or directory as an input

Synopsis

Create or update resources using YAML file(s) as input. If a file is specified, only that file will be processed. If a directory is specified, all YAML files (*.yaml, *.yml) in the directory and its subdirectories will be processed recursively. Each file is processed independently, similar to kubectl behavior.

omnictl apply [flags]

Options

  -d, --dry-run       Dry run, implies verbose
  -f, --file string   Resource file or directory to load and apply
  -h, --help          help for apply
  -v, --verbose       Verbose output

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl audit-log

Read audit log from Omni

Synopsis

Read audit log from Omni. Optionally filter by date range using start and end arguments in YYYY-MM-DD format (date-only, interpreted in the server’s local time, e.g. 2024-01-01).

omnictl audit-log [start] [end] [flags]

Options

      --actor string                                                                                               filter events by actor email
      --cluster-id string                                                                                          filter events by cluster ID
      --event-type audit_log_access|create|destroy|k8s_access|talos_access|teardown|update|update_with_conflicts   filter events by event type
  -f, --follow                                                                                                     stream new events as they are written, starting at the current tail unless --since is given. Cannot be combined with filters. The stream is re-established transparently whenever the server ends it cleanly, while errors terminate the command.
  -h, --help                                                                                                       help for audit-log
      --order-by-dir asc|desc                                                                                      sort direction
      --order-by-field actor|cluster_id|event_ts_ms|event_type|resource_id|resource_type                           field to sort results by
      --resource-id string                                                                                         filter events by resource ID
      --resource-type string                                                                                       filter events by resource type
      --search string                                                                                              filter events by a search string
      --since duration                                                                                             start from the given duration ago, e.g. 2h. More precise than the date-only start argument, and the only way to include history in follow mode. A duration reaching past the retention period returns everything still retained.

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster delete

Delete all cluster resources.

Synopsis

Delete all resources related to the cluster. The command waits for the cluster to be fully destroyed.

omnictl cluster delete cluster-name [flags]

Options

      --destroy-disconnected-machines   removes all disconnected machines which are part of the cluster from Omni
  -d, --dry-run                         dry run
  -h, --help                            help for delete
  -v, --verbose                         verbose output (show diff for each resource)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster import abort

Abort an ongoing cluster import operation

Synopsis

Abort an ongoing cluster import operation. This will clean up any resources created during the import process and will only work if the cluster is locked and tainted as “importing”

omnictl cluster import abort <cluster name> [flags]

Options

  -h, --help   help for abort

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster import

Cluster import related commands.

Synopsis

Commands to manage cluster import operation.

omnictl cluster import [flags]

Options

  -O, --backup-output string                backup file for storing node machine configs before import
  -d, --dry-run                             skip the actual import and show the import plan instead
      --force                               force import even if validations fail
  -h, --help                                help for import
      --initial-kubernetes-version string   initial kubernetes version used on cluster creation, if not set current kubernetes version will be used
      --initial-talos-version string        initial talos version used on cluster creation, if not set current talos version will be used
      --kubernetes-version string           kubernetes version of the cluster, if not set, will be detected from the nodes
  -n, --nodes strings                       endpoints of all nodes to import
      --skip-health-check                   skip performing cluster health check before import
      --talos-context string                the context to be used for accessing talos. defaults to the selected context in the Talos configuration file
      --talos-endpoints strings             override default endpoints in Talos configuration file
      --talos-version string                talos version of the cluster, if not set, will be detected from the nodes
      --talosconfig string                  The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config'.
      --wait-timeout duration               timeout to wait for the cluster import to complete (default 5m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster kubernetes manifest-sync

Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API.

Synopsis

Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API. Bootstrap manifests might be updated with Talos version update, Kubernetes upgrade, and config patching. Talos never updates or deletes Kubernetes manifests, so this command fills the gap to keep manifests up-to-date.

omnictl cluster kubernetes manifest-sync cluster-name [flags]

Options

      --dry-run   don't actually sync manifests, just print what would be done (default true)
  -h, --help      help for manifest-sync

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster kubernetes upgrade-pre-checks

Run Kubernetes upgrade pre-checks for the cluster.

Synopsis

Verify that upgrading Kubernetes version is available for the cluster: version compatibility, deprecated APIs, etc.

omnictl cluster kubernetes upgrade-pre-checks cluster-name [flags]

Options

  -h, --help        help for upgrade-pre-checks
      --to string   target Kubernetes version for the planned upgrade

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster kubernetes

Cluster Kubernetes management subcommands.

Synopsis

Commands to render, validate, manage cluster templates.

Options

  -h, --help   help for kubernetes

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster lock

Lock the cluster

Synopsis

When locked, no config updates, upgrades and downgrades will be performed on the cluster nodes.

omnictl cluster lock cluster-id [flags]

Options

  -h, --help   help for lock

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster machine delete

Delete the machine from the cluster

Synopsis

Delete the machine from the cluster. The command waits for the machine to be fully deleted.

omnictl cluster machine delete machine-id [flags]

Options

  -f, --force                  force delete the machine, skipping wipe
      --force-etcd-leave       force leave etcd
  -h, --help                   help for delete
  -t, --timeout duration       timeout for the machine deletion (default 5m0s)
  -y, --yes-i-am-really-sure   do not ask for confirmation when using --force-etcd-leave

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster machine lock

Lock the machine

Synopsis

When locked, no config updates, upgrades and downgrades will be performed on the machine.

omnictl cluster machine lock machine-id [flags]

Options

  -h, --help   help for lock

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster machine unlock

Unlock the machine

Synopsis

Removes locked annotation from the machine.

omnictl cluster machine unlock machine-id [flags]

Options

  -h, --help   help for unlock

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster machine

Machine related commands.

Synopsis

Commands to manage cluster machines.

Options

  -h, --help   help for machine

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster secret rotate kubernetes-ca

Rotate Kubernetes CA certificate.

Synopsis

Rotate Kubernetes CA certificate for all nodes in the cluster. Kubernetes CA is used by the Kubernetes API server and kubelet for authenticating clients.

omnictl cluster secret rotate kubernetes-ca [flags]

Options

  -h, --help   help for kubernetes-ca

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
  -n, --name string                cluster name
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.
  -w, --wait                       wait for the secret rotation to complete (default true)
  -t, --wait-timeout duration      wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s)

omnictl cluster secret rotate status

Show secret rotation status, wait for the rotation to complete.

Synopsis

Shows current secret rotation status, if the terminal supports it, watch the status as it updates. The command waits for the secret to be fully rotated by default.

omnictl cluster secret rotate status [flags]

Options

  -h, --help   help for status

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
  -n, --name string                cluster name
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.
  -w, --wait                       wait for the secret rotation to complete (default true)
  -t, --wait-timeout duration      wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s)

omnictl cluster secret rotate talos-ca

Rotate Talos CA certificate.

Synopsis

Rotate Talos CA certificate for all nodes in the cluster. Talos CA is used by Talos API.

omnictl cluster secret rotate talos-ca [flags]

Options

  -h, --help   help for talos-ca

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
  -n, --name string                cluster name
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.
  -w, --wait                       wait for the secret rotation to complete (default true)
  -t, --wait-timeout duration      wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s)

omnictl cluster secret rotate

Rotate cluster secrets, wait for the rotation to complete.

Synopsis

Rotates specified cluster secret, if the terminal supports it, watch the secret update steps. The command waits for the secret to be fully rotated by default.

Options

  -h, --help                    help for rotate
  -w, --wait                    wait for the secret rotation to complete (default true)
  -t, --wait-timeout duration   wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
  -n, --name string                cluster name
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster secret

Cluster secret management subcommands.

Synopsis

Commands to manage cluster secrets.

Options

  -h, --help          help for secret
  -n, --name string   cluster name

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster status

Show cluster status, wait for the cluster to be ready.

Synopsis

Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default.

omnictl cluster status cluster-name [flags]

Options

  -h, --help            help for status
  -q, --quiet           suppress output
  -w, --wait duration   wait timeout, if zero, report current status and exit (default 5m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template delete

Delete all cluster template resources from Omni.

Synopsis

Delete all resources related to the cluster template. This command requires API access.

omnictl cluster template delete [flags]

Options

      --destroy-disconnected-machines   removes all disconnected machines which are part of the cluster from Omni
  -d, --dry-run                         dry run
  -f, --file string                     path to the cluster template file or directory.
  -h, --help                            help for delete
  -v, --verbose                         verbose output (show diff for each resource)

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template diff

Show diff in resources if the template is synced.

Synopsis

Query existing resources for the cluster and compare them with the resources generated from the template. This command requires API access.

omnictl cluster template diff [flags]

Options

  -f, --file string   path to the cluster template file or directory.
  -h, --help          help for diff

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template export

Export a cluster template from an existing cluster on Omni.

Synopsis

Export a cluster template from an existing cluster on Omni. This command requires API access.

omnictl cluster template export cluster-name [flags]

Options

  -c, --cluster string        cluster name
  -f, --force                 overwrite output file if it exists
  -h, --help                  help for export
      --include-kernel-args   include kernel arguments (KernelArgs resources) in the exported template
  -o, --output string         output file (default: stdout)

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template render

Render a cluster template to a set of resources.

Synopsis

Validate template contents, convert to resources and output resources to stdout as YAML. This command is offline (doesn’t access API).

omnictl cluster template render [flags]

Options

  -f, --file string   path to the cluster template file or directory.
  -h, --help          help for render

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template status

Show template cluster status, wait for the cluster to be ready.

Synopsis

Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default.

omnictl cluster template status [flags]

Options

  -f, --file string     path to the cluster template file or directory.
  -h, --help            help for status
  -q, --quiet           suppress output
  -w, --wait duration   wait timeout, if zero, report current status and exit (default 5m0s)

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template sync

Apply template to the Omni.

Synopsis

Query existing resources for the cluster and compare them with the resources generated from the template, create/update/delete resources as needed. This command requires API access. If a file is specified, only that file will be processed. If a directory is specified, all YAML files (*.yaml, *.yml) in the directory and its subdirectories will be processed recursively. Each template file is processed independently, allowing management of multiple clusters.

omnictl cluster template sync [flags]

Options

  -d, --dry-run       dry run
  -f, --file string   path to the cluster template file or directory.
  -h, --help          help for sync
  -v, --verbose       verbose output (show diff for each resource)

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template validate

Validate a cluster template.

Synopsis

Validate that template contains valid structures, and there are no other warnings. This command is offline (doesn’t access API).

omnictl cluster template validate [flags]

Options

  -f, --file string   path to the cluster template file or directory.
  -h, --help          help for validate

Options inherited from parent commands

      --allowed-dir string         allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster template

Cluster template management subcommands.

Synopsis

Commands to render, validate, manage cluster templates.

Options

      --allowed-dir string   allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./")
  -h, --help                 help for template

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster unlock

Unlock the cluster

Synopsis

Removes locked annotation from the cluster.

omnictl cluster unlock cluster-id [flags]

Options

  -h, --help   help for unlock

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl cluster

Cluster-related subcommands.

Synopsis

Commands to destroy clusters and manage cluster templates.

Options

  -h, --help   help for cluster

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl completion bash

Generate the autocompletion script for bash

Synopsis

Generate the autocompletion script for the bash shell. This script depends on the ‘bash-completion’ package. If it is not installed already, you can install it via your OS’s package manager. To load completions in your current shell session:

source <(omnictl completion bash)

To load completions for every new session, execute once:

Linux:

omnictl completion bash > /etc/bash_completion.d/omnictl

macOS:

omnictl completion bash > $(brew --prefix)/etc/bash_completion.d/omnictl

You will need to start a new shell for this setup to take effect.

omnictl completion bash

Options

  -h, --help              help for bash
      --no-descriptions   disable completion descriptions

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl completion fish

Generate the autocompletion script for fish

Synopsis

Generate the autocompletion script for the fish shell. To load completions in your current shell session:

omnictl completion fish | source

To load completions for every new session, execute once:

omnictl completion fish > ~/.config/fish/completions/omnictl.fish

You will need to start a new shell for this setup to take effect.

omnictl completion fish [flags]

Options

  -h, --help              help for fish
      --no-descriptions   disable completion descriptions

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl completion powershell

Generate the autocompletion script for powershell

Synopsis

Generate the autocompletion script for powershell. To load completions in your current shell session:

omnictl completion powershell | Out-String | Invoke-Expression

To load completions for every new session, add the output of the above command to your powershell profile.

omnictl completion powershell [flags]

Options

  -h, --help              help for powershell
      --no-descriptions   disable completion descriptions

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl completion zsh

Generate the autocompletion script for zsh

Synopsis

Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:

echo "autoload -U compinit; compinit" >> ~/.zshrc

To load completions in your current shell session:

source <(omnictl completion zsh)

To load completions for every new session, execute once:

Linux:

omnictl completion zsh > "${fpath[1]}/_omnictl"

macOS:

omnictl completion zsh > $(brew --prefix)/share/zsh/site-functions/_omnictl

You will need to start a new shell for this setup to take effect.

omnictl completion zsh [flags]

Options

  -h, --help              help for zsh
      --no-descriptions   disable completion descriptions

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl completion

Generate the autocompletion script for the specified shell

Synopsis

Generate the autocompletion script for omnictl for the specified shell. See each sub-command’s help for details on how to use the generated script.

Options

  -h, --help   help for completion

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config add

Add a new context

omnictl config add <context> [flags]

Options

  -h, --help              help for add
      --identity string   identity to use for authentication
      --url string        URL of the server (default "grpc://127.0.0.1:8080")

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config context

Set the current context

omnictl config context <context> [flags]

Options

  -h, --help   help for context

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config contexts

List defined contexts

omnictl config contexts [flags]

Options

  -h, --help   help for contexts

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config identity

Set the auth identity for the current context

omnictl config identity <identity> [flags]

Options

  -h, --help   help for identity

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config info

Show information about the current context

omnictl config info [flags]

Options

  -h, --help   help for info

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config merge

Merge additional contexts from another client configuration file

Synopsis

Contexts with the same name are renamed while merging configs.

omnictl config merge <from> [flags]

Options

  -h, --help   help for merge

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config new

Generate a new client configuration file

omnictl config new [<path>] [flags]

Options

  -h, --help              help for new
      --identity string   identity to use for authentication
      --url string        URL of the server (default "grpc://127.0.0.1:8080")

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config url

Set the URL for the current context

omnictl config url <url> [flags]

Options

  -h, --help   help for url

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl config

Manage the client configuration file (omniconfig)

Options

  -h, --help   help for config

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl configure machine

Machine configuration command.

omnictl configure machine <uuid1> <uuid2> [flags]

Options

  -h, --help                                                  help for machine
      --reset-node-unique-token                               reset the node unique token for the machine
      --siderolink-connection one of [udp,http-tunnel,auto]   configure SideroLink connection mode

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl configure

Configuration subcommands.

Options

  -h, --help   help for configure

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl delete

Delete a specific resource by ID or all resources of the type.

Synopsis

Similar to ‘kubectl delete’, ‘omnictl delete’ initiates resource deletion and waits for the operation to complete.

omnictl delete <type> [<id>] [flags]

Options

      --all                Delete all resources of the type.
  -h, --help               help for delete
  -n, --namespace string   The resource namespace. (default "default")
  -l, --selector string    Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl edit

Edit Omni resources with the default editor.

Synopsis

The edit command allows you to directly edit the resources of an Omni instance using your preferred text editor. It will open the editor defined by your OMNI_EDITOR, TALOS_EDITOR, or EDITOR environment variables, or fall back to ‘vi’ for Linux or ‘notepad’ for Windows.

omnictl edit <type> [<id>] [flags]

Options

      --dry-run                  do not apply the change after editing and print the change summary instead
  -h, --help                     help for edit
      --id-match-regexp string   Match resource ID against a regular expression.
      --namespace string         resource namespace (default is to use default namespace per resource)
      --selector string          Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2)
  -v, --verbose                  Verbose output

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl get

Get a specific resource or list of resources.

Synopsis

Similar to ‘kubectl get’, ‘omnictl get’ returns a set of resources from the OS. To get a list of all available resource definitions, issue ‘omnictl get rd’

omnictl get <type> [<id>] [flags]

Options

  -h, --help                     help for get
      --id-match-regexp string   Match resource ID against a regular expression.
  -n, --namespace string         The resource namespace.
  -o, --output string            Output format (json, table, yaml, jsonpath). (default "table")
  -l, --selector string          Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2)
  -w, --watch                    Watch the resource state.

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl infraprovider create

Create an infra provider

omnictl infraprovider create <name> [flags]

Options

  -h, --help           help for create
  -t, --ttl duration   TTL for the infra provider service account key (default 8760h0m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl infraprovider delete

Delete an infra provider

omnictl infraprovider delete <name> [flags]

Options

  -h, --help   help for delete

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl infraprovider list

List infra providers

omnictl infraprovider list [flags]

Options

  -h, --help   help for list

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl infraprovider renewkey

Renew an infra provider service account by registering a new public key to it

omnictl infraprovider renewkey <name> [flags]

Options

  -h, --help           help for renewkey
  -t, --ttl duration   TTL for the infra provider service account key (default 8760h0m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl infraprovider

Manage infra providers

Options

  -h, --help   help for infraprovider

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken create

Create a join token

omnictl jointoken create <name> [flags]

Options

  -h, --help           help for create
  -t, --ttl duration   TTL for the join token

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken delete

Delete a join token

omnictl jointoken delete <id> [flags]

Options

  -f, --force   Delete the token even if it is going to make the machines to disconnect
  -h, --help    help for delete

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken kernel-args

Get Talos kernel args to make a machine join Omni

omnictl jointoken kernel-args [flags]

Options

  -h, --help                help for kernel-args
      --token-id string     Generate using specific token ID (uses default if empty)
      --token-name string   Looks up the token by name and generates the config using the token (uses default if empty)
      --use-grpc-tunnel     Use gRPC tunnel in the config

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken list

List join tokens

omnictl jointoken list [flags]

Options

  -h, --help   help for list

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken machine-config

Get partial machine config to make a machine join Omni

omnictl jointoken machine-config <id> [flags]

Options

  -h, --help                help for machine-config
      --token-id string     Generate using specific token ID (uses default if empty)
      --token-name string   Looks up the token by name and generates the config using the token (uses default if empty)
      --use-grpc-tunnel     Use gRPC tunnel in the config

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken make-default

Make the token default one

omnictl jointoken make-default <id> [flags]

Options

  -h, --help   help for make-default

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken omni-endpoint

Get the Omni endpoint URL with the join token

omnictl jointoken omni-endpoint [flags]

Options

  -h, --help                help for omni-endpoint
      --token-id string     Generate using specific token ID (uses default if empty)
      --token-name string   Looks up the token by name and generates the config using the token (uses default if empty)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken renew

Renew a join token

omnictl jointoken renew <id> [flags]

Options

  -h, --help           help for renew
  -t, --ttl duration   TTL for the join token

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken revoke

Revoke a join token

omnictl jointoken revoke <id> [flags]

Options

  -f, --force   Revoke the token even if it is going to make the machines to disconnect
  -h, --help    help for revoke

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken unrevoke

Unrevoke a join token

omnictl jointoken unrevoke <id> [flags]

Options

  -h, --help   help for unrevoke

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl jointoken

Manage join tokens

Options

  -h, --help   help for jointoken

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl kubeconfig

Download the admin kubeconfig of a cluster

Synopsis

Download the admin kubeconfig of a cluster. If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified. Otherwise kubeconfig will be written to PWD or [local-path] if specified.

omnictl kubeconfig [local-path] [flags]

Options

      --break-glass                  get kubeconfig that allows accessing nodes bypasing Omni (if enabled for the account)
  -c, --cluster string               cluster to use
  -f, --force                        force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge
      --force-context-name string    force context name in the resulting kubeconfig
      --grant-type string            Authorization grant type to use. One of (auto|authcode|authcode-keyboard)
      --groups strings               group to be used in the service account token (groups). only used when --service-account is set to true (default [system:masters])
  -h, --help                         help for kubeconfig
  -m, --merge                        merge with existing kubeconfig (default true)
      --oidc-cache-base-dir string   override the base cache directory for kubelogin in the generated kubeconfig
      --oidc-cache-isolation         isolate OIDC token caches across clusters by appending a per-context subdirectory to the cache directory
      --service-account              create a service account type kubeconfig instead of a OIDC-authenticated user type
      --ttl duration                 ttl for the service account token. only used when --service-account is set to true (default 8760h0m0s)
      --user string                  user to be used in the service account token (sub). required when --service-account is set to true

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine install

Install Talos to disk on a machine running in maintenance mode

Synopsis

Install Talos to disk on a machine that is running in maintenance mode. This requires the machine to be running Talos 1.13 or newer. The target disk must be specified with —disk (e.g. /dev/sda); use ‘omnictl get machinestatus <machine-id> -o yaml’ to inspect the available block devices. When —version is omitted, the version Talos is currently running in memory on the machine is installed. Installer progress is streamed to the terminal; on success the machine is rebooted so it boots from disk into the freshly installed Talos.

omnictl machine install machine-id [flags]

Options

      --disk string      target install disk (e.g. /dev/sda)
  -h, --help             help for install
      --version string   Talos version to install; defaults to the version running in memory on the machine

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine power-on

Power on a machine

Synopsis

Power on a machine managed by an infra provider. This clears the power off request and allows the provider to power the machine on.

omnictl machine power-on machine-id [flags]

Options

  -h, --help   help for power-on

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine shutdown

Shut down a machine

Synopsis

Shut down a machine. For machines managed by an infra provider, this also prevents the provider from automatically powering the machine back on.

omnictl machine shutdown machine-id [flags]

Options

  -h, --help   help for shutdown

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine upgrade

Upgrade the on-disk Talos on a machine running in maintenance mode

Synopsis

Upgrade the on-disk Talos on a machine that is running in maintenance mode and already has Talos installed. This requires the machine to be running Talos 1.13 or newer. —version is required and specifies the Talos version to write to disk. Installer progress is streamed to the terminal; on success the machine is rebooted so it boots from disk into the upgraded Talos.

omnictl machine upgrade machine-id [flags]

Options

  -h, --help             help for upgrade
      --version string   Talos version to upgrade to

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine

Machine related commands.

Synopsis

Commands to manage machines.

Options

  -h, --help   help for machine

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl machine-logs

Get logs for a machine

Synopsis

Get logs for a provided machine id

omnictl machine-logs machineID [flags]

Options

  -f, --follow              specify if the logs should be streamed
  -h, --help                help for machine-logs
      --log-format string   log format (raw, omni, dmesg) to display (default is to display in raw format) (default "raw")
      --tail int32          lines of log file to display (default is to show from the beginning) (default -1)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media download

Download installation media from a preset.

Synopsis

Download installation media using a saved preset configuration. Flags here override the corresponding values from the preset, but cannot change the preset’s platform, overlay, or bootloader: those define the preset itself. To use different settings, create a new preset. The format flag determines the output file type for metal presets:

iso - ISO image (default)
raw - Raw disk image (.raw.xz)
qcow2 - QEMU disk image (.qcow2)
pxe - Print PXE boot URL (no file downloaded)

For cloud presets, the format is automatically determined by the platform. For SBC presets, a raw disk image is always produced. Examples:

# Download from a preset (format is auto-detected from the preset type)
omnictl media download my-preset

# Force raw disk image for a metal preset
omnictl media download my-preset --format raw

# Get PXE boot URL for a metal preset
omnictl media download my-preset --format pxe

# Override extensions for a one-off download
omnictl media download my-preset --extensions qemu-guest-agent

# Download to a specific directory
omnictl media download my-preset --output /tmp/images/

omnictl media download <preset-name> [flags]

Options

      --arch string                           Image architecture override (amd64, arm64; uses preset value if empty)
      --embedded-machine-config-file string   Override the embedded machine config, reading it from a file or "-" for stdin
      --extensions strings                    Override extensions to pre-install
      --extra-kernel-args stringArray         Override extra kernel args
      --format string                         Output format for metal presets: iso, raw, qcow2, pxe (auto-detected if omitted)
  -h, --help                                  help for download
      --initial-labels strings                Override initial machine labels (key=value)
      --join-token string                     Join token ID override (uses preset token if empty)
      --output string                         Output file or directory, defaults to current working directory (default ".")
      --secureboot                            Override secure boot setting
      --talos-version string                  Talos version override (uses preset value if empty)
      --use-siderolink-grpc-tunnel            Configure Talos to use the SideroLink (WireGuard) gRPC tunnel over HTTP/2 for Omni management traffic, instead of UDP. Only enable this if the network blocks UDP packets, as HTTP tunneling adds significant overhead for communications.

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media preset create

Create an installation media preset.

Synopsis

Create a new installation media preset that can be used for downloading installation media. Examples:

# Create a basic metal preset
omnictl media preset create my-preset --arch amd64

# Create a cloud preset for AWS
omnictl media preset create aws-preset --arch amd64 --platform aws

# Create an SBC preset for Raspberry Pi
omnictl media preset create rpi-preset --arch arm64 --overlay rpi_generic

# Create a preset with extensions and labels
omnictl media preset create full-preset --arch amd64 \
    --extensions qemu-guest-agent --extensions intel-ucode \
    --initial-labels env=production --initial-labels team=infra

# Create a preset with an embedded machine config read from a file
omnictl media preset create embedded-preset --arch amd64 \
    --embedded-machine-config-file ./machine-config.yaml

omnictl media preset create <name> [flags]

Options

      --arch string                           Image architecture (amd64, arm64) (default "amd64")
      --bootloader string                     Bootloader type (auto, uefi, bios, dual) (default "auto")
      --embedded-machine-config-file string   Embedded machine config read from a file, or "-" for stdin
      --extensions strings                    Extensions to pre-install in the preset
      --extra-kernel-args stringArray         Extra kernel args to include in the preset
  -h, --help                                  help for create
      --initial-labels strings                Initial machine labels in key=value format
      --join-token string                     Join token ID (uses default token if empty)
      --overlay string                        SBC overlay name (e.g., rpi_generic, rockpi_4c)
      --overlay-options string                SBC overlay options (YAML string)
      --platform string                       Cloud platform (e.g., aws, gcp, azure, vultr)
      --secureboot                            Enable SecureBoot in the preset
      --talos-version string                  Talos version for the preset (leave empty to track the server's default at download time)
      --use-siderolink-grpc-tunnel            Configure Talos to use the SideroLink (WireGuard) gRPC tunnel over HTTP/2 for Omni management traffic, instead of UDP. Only enable this if the network blocks UDP packets, as HTTP tunneling adds significant overhead for communications.

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media preset delete

Delete an installation media preset.

omnictl media preset delete <name> [flags]

Options

  -h, --help   help for delete

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media preset list

List installation media presets.

omnictl media preset list [flags]

Options

  -h, --help            help for list
  -o, --output string   Output format. One of: wide

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media preset

Manage installation media presets.

Synopsis

Commands to create, list, and delete installation media presets.

Options

  -h, --help   help for preset

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl media

Manage installation media presets.

Synopsis

Commands to create, list, delete, and download from installation media presets.

Options

  -h, --help   help for media

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl security sbom

Fetch the SPDX bundle of a schematic, or of every schematic in a cluster.

Synopsis

Fetches the SPDX bundle of a schematic, or of every schematic installed across a cluster’s machines, including upgrade targets with —upgrade-paths. Always prints a JSON array of {schematicId, arch, version, sbom}, one entry per bundle fetched. Examples:

# Fetch the SBOM of a specific schematic build
omnictl security sbom --schematic \<schematic-id> --talos-version 1.9.0 --arch amd64

# Fetch the SBOM of every schematic a cluster's machines are running, including upgrade targets
omnictl security sbom --cluster-id my-cluster --upgrade-paths

omnictl security sbom [flags]

Options

      --arch string            Architecture to fetch an artifact for (amd64, arm64).
      --cluster-id string      Resolve targets from a cluster's installed schematics.
  -h, --help                   help for sbom
  -o, --output string          Output format (json, yaml). (default "json")
      --schematic string       Schematic ID to fetch an artifact for.
      --talos-version string   Talos version to fetch an artifact for.
      --upgrade-paths          Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id).

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl security scan

Fetch the vulnerability scan report of a schematic, or of every schematic in a cluster.

Synopsis

Fetches the vulnerability scan report of a schematic, or of every schematic installed across a cluster’s machines. By default, prints a table of findings by severity. With -o json or -o yaml, prints a JSON array of {schematicId, arch, version, report, upgradeCandidates}, one entry per target fetched: report is the factory’s report embedded verbatim, and upgradeCandidates lists {version, report} for each upgrade-target version —upgrade-paths also fetched. —format selects the report format fetched from the factory (json, sarif, cyclonedx - all of which are themselves JSON, so any embeds cleanly under -o json/yaml). There is no “table” format value here - that’s Grype’s own preformatted text table, a separate thing from -o table’s severity summary, and can’t be embedded in -o json/yaml output. The default -o table only works with —format json: its severity counts are read from Grype’s own JSON schema, which sarif/cyclonedx don’t share - pass -o json/yaml to fetch a report in another format. Examples:

# Scan a specific schematic build
omnictl security scan --schematic \<schematic-id> --talos-version 1.9.0 --arch amd64

# Scan every schematic a cluster's machines are running, including upgrade targets
omnictl security scan --cluster-id my-cluster --upgrade-paths

# Print the full reports as JSON instead of the severity table
omnictl security scan --cluster-id my-cluster -o json

# Print SARIF reports instead of Grype's native JSON
omnictl security scan --cluster-id my-cluster -o json --format sarif

omnictl security scan [flags]

Options

      --arch string            Architecture to fetch an artifact for (amd64, arm64).
      --cluster-id string      Resolve targets from a cluster's installed schematics.
      --format string          Report format to fetch (json, sarif, cyclonedx). (default "json")
  -h, --help                   help for scan
  -o, --output string          Output format (table, json, yaml). (default "table")
      --schematic string       Schematic ID to fetch an artifact for.
      --talos-version string   Talos version to fetch an artifact for.
      --upgrade-paths          Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id).

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl security vex

Fetch the VEX document of a Talos version, or of every version a cluster runs.

Synopsis

Fetches the OpenVEX document of a Talos version, or of a cluster’s current version and (with —upgrade-paths) its upgrade targets. A VEX document covers a Talos version as a whole, not a specific schematic, so no —schematic/—arch is needed. Always prints a JSON array of {version, vex}, one entry per version fetched. Examples:

# Fetch the VEX document for a specific Talos version
omnictl security vex --talos-version 1.9.0

# Fetch the VEX documents for a cluster's current and upgrade-target versions
omnictl security vex --cluster-id my-cluster --upgrade-paths

omnictl security vex [flags]

Options

      --cluster-id string      Resolve versions from a cluster's current and upgrade-target Talos versions.
  -h, --help                   help for vex
  -o, --output string          Output format (json, yaml). (default "json")
      --talos-version string   Talos version to fetch an artifact for.
      --upgrade-paths          Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id).

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl security

Security artifact subcommands.

Synopsis

Commands to fetch vulnerability scans, SBOMs and VEX documents for a schematic, either named explicitly or resolved from a cluster’s installed schematics.

Options

  -h, --help   help for security

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl serviceaccount create

Create a service account

omnictl serviceaccount create <name> [flags]

Options

  -h, --help            help for create
  -r, --role string     role of the service account. only used when --use-user-role=false
  -t, --ttl duration    TTL for the service account key (default 8760h0m0s)
  -u, --use-user-role   use the role of the creating user. if true, --role is ignored (default true)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl serviceaccount destroy

Destroy a service account

omnictl serviceaccount destroy <name> [flags]

Options

  -h, --help   help for destroy

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl serviceaccount list

List service accounts

omnictl serviceaccount list [flags]

Options

  -h, --help   help for list

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl serviceaccount renew

Renew a service account by registering a new public key to it

omnictl serviceaccount renew <name> [flags]

Options

  -h, --help           help for renew
  -t, --ttl duration   TTL for the service account key (default 8760h0m0s)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl serviceaccount

Manage service accounts

Options

  -h, --help   help for serviceaccount

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl support

Download the support bundle for a cluster

Synopsis

The command collects all non-sensitive information for the cluster from the Omni state. By default, the generated bundle is encrypted using age encryption to the list of recipients set by the members of the ‘siderolabs’ GitHub organization. The encrypted bundle by default will only be decryptable by the Sidero Labs team, but you can also specify additional recipients using the —encryption-recipients flag, or disable encryption completely using the —no-encryption flag. Default encryption recipients can be removed by setting —encryption-no-default-recipients flag.

omnictl support [local-path] [flags]

Options

  -c, --cluster string                      cluster to use
      --encryption-no-default-recipients    do not encrypt to the default recipients, only to the ones provided via --encryption-recipients
      --encryption-recipients stringArray   additional age recipients (SSH or age public keys) to encrypt the support bundle to (can be specified multiple times)
  -h, --help                                help for support
      --no-encryption                       do not encrypt the support bundle (output is written as-is)
  -O, --output string                       support bundle output (default "support.zip.age", or "support.zip" with --no-encryption)
  -v, --verbose                             verbose output

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl talosconfig

Download an admin talosconfig.

Synopsis

Download the generic admin talosconfig of the Omni instance or the admin talosconfig of a cluster. Generic talosconfig can be used with any machine, including those in maintenance mode. If merge flag is defined, config will be merged with ~/.talos/config or [local-path] if specified. Otherwise talosconfig will be written to PWD or [local-path] if specified.

omnictl talosconfig [local-path] [flags]

Options

      --break-glass      get operator talosconfig that allows bypassing Omni (if enabled for the account)
  -c, --cluster string   cluster to use. If omitted, download the generic talosconfig for the Omni instance.
  -f, --force            force overwrite of talosconfig if already present
  -h, --help             help for talosconfig
  -m, --merge            merge with existing talosconfig (default true)

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl user create

Create a user.

Synopsis

Create a user with the specified email.

omnictl user create [email] [flags]

Options

  -h, --help          help for create
  -r, --role string   Role to use for the user creation

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl user delete

Delete users.

Synopsis

Delete users with the specified emails.

omnictl user delete [email1 email2] [flags]

Options

  -h, --help   help for delete

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl user list

List all users.

Synopsis

List all existing users on the Omni instance.

omnictl user list [flags]

Options

  -h, --help   help for list

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl user set-role

Update the role of the user.

Synopsis

Update the user role.

omnictl user set-role [email] [flags]

Options

  -h, --help          help for set-role
  -r, --role string   Role to use

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl user

User-related subcommands.

Synopsis

Commands to manage users.

Options

  -h, --help   help for user

Options inherited from parent commands

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

omnictl

A CLI for accessing Omni API.

Options

      --context string             The context to be used. Defaults to the selected context in the omniconfig file.
  -h, --help                       help for omnictl
      --insecure-skip-tls-verify   Skip TLS verification for the Omni GRPC and HTTP API endpoints.
      --omniconfig string          The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file.
      --siderov1-keys-dir string   The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'.

​omnictl apply

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl audit-log

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster delete

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster import abort

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster import

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster kubernetes manifest-sync

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster kubernetes upgrade-pre-checks

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster kubernetes

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster lock

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster machine delete

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster machine lock

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster machine unlock

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster machine

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster secret rotate kubernetes-ca

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster secret rotate status

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

​omnictl cluster secret rotate talos-ca

​Synopsis

​Options

​Options inherited from parent commands

​SEE ALSO

omnictl apply

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl audit-log

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster delete

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster import abort

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster import

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster kubernetes manifest-sync

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster kubernetes upgrade-pre-checks

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster kubernetes

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster lock

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster machine delete

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster machine lock

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster machine unlock

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster machine

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster secret rotate kubernetes-ca

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster secret rotate status

Synopsis

Options

Options inherited from parent commands

SEE ALSO

omnictl cluster secret rotate talos-ca

Synopsis

Options

Options inherited from parent commands

SEE ALSO