> ## Documentation Index > Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt > Use this file to discover all available pages before exploring further. # omnictl CLI > omnictl CLI tool reference. ## omnictl apply Create or update resource using YAML file or directory as an input ### Synopsis Create or update resources using YAML file(s) as input. If a file is specified, only that file will be processed. If a directory is specified, all YAML files (\*.yaml, \*.yml) in the directory and its subdirectories will be processed recursively. Each file is processed independently, similar to kubectl behavior. ``` omnictl apply [flags] ``` ### Options ``` -d, --dry-run Dry run, implies verbose -f, --file string Resource file or directory to load and apply -h, --help help for apply -v, --verbose Verbose output ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl audit-log Read audit log from Omni ### Synopsis Read audit log from Omni. Optionally filter by date range using start and end arguments in YYYY-MM-DD format (date-only, interpreted in the server's local time, e.g. 2024-01-01). ``` omnictl audit-log [start] [end] [flags] ``` ### Options ``` --actor string filter events by actor email --cluster-id string filter events by cluster ID --event-type audit_log_access|create|destroy|k8s_access|talos_access|teardown|update|update_with_conflicts filter events by event type -f, --follow stream new events as they are written, starting at the current tail unless --since is given. Cannot be combined with filters. The stream is re-established transparently whenever the server ends it cleanly, while errors terminate the command. -h, --help help for audit-log --order-by-dir asc|desc sort direction --order-by-field actor|cluster_id|event_ts_ms|event_type|resource_id|resource_type field to sort results by --resource-id string filter events by resource ID --resource-type string filter events by resource type --search string filter events by a search string --since duration start from the given duration ago, e.g. 2h. More precise than the date-only start argument, and the only way to include history in follow mode. A duration reaching past the retention period returns everything still retained. ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl cluster delete Delete all cluster resources. ### Synopsis Delete all resources related to the cluster. The command waits for the cluster to be fully destroyed. ``` omnictl cluster delete cluster-name [flags] ``` ### Options ``` --destroy-disconnected-machines removes all disconnected machines which are part of the cluster from Omni -d, --dry-run dry run -h, --help help for delete -v, --verbose verbose output (show diff for each resource) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. ## omnictl cluster import abort Abort an ongoing cluster import operation ### Synopsis Abort an ongoing cluster import operation. This will clean up any resources created during the import process and will only work if the cluster is locked and tainted as "importing" ``` omnictl cluster import abort [flags] ``` ### Options ``` -h, --help help for abort ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster import](#omnictl-cluster-import) - Cluster import related commands. ## omnictl cluster import Cluster import related commands. ### Synopsis Commands to manage cluster import operation. ``` omnictl cluster import [flags] ``` ### Options ``` -O, --backup-output string backup file for storing node machine configs before import -d, --dry-run skip the actual import and show the import plan instead --force force import even if validations fail -h, --help help for import --initial-kubernetes-version string initial kubernetes version used on cluster creation, if not set current kubernetes version will be used --initial-talos-version string initial talos version used on cluster creation, if not set current talos version will be used --kubernetes-version string kubernetes version of the cluster, if not set, will be detected from the nodes -n, --nodes strings endpoints of all nodes to import --skip-health-check skip performing cluster health check before import --talos-context string the context to be used for accessing talos. defaults to the selected context in the Talos configuration file --talos-endpoints strings override default endpoints in Talos configuration file --talos-version string talos version of the cluster, if not set, will be detected from the nodes --talosconfig string The path to the Talos configuration file. Defaults to 'TALOSCONFIG' env variable if set, otherwise '$HOME/.talos/config'. --wait-timeout duration timeout to wait for the cluster import to complete (default 5m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl cluster import abort](#omnictl-cluster-import-abort) - Abort an ongoing cluster import operation ## omnictl cluster kubernetes manifest-sync Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API. ### Synopsis Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API. Bootstrap manifests might be updated with Talos version update, Kubernetes upgrade, and config patching. Talos never updates or deletes Kubernetes manifests, so this command fills the gap to keep manifests up-to-date. ``` omnictl cluster kubernetes manifest-sync cluster-name [flags] ``` ### Options ``` --dry-run don't actually sync manifests, just print what would be done (default true) -h, --help help for manifest-sync ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster kubernetes](#omnictl-cluster-kubernetes) - Cluster Kubernetes management subcommands. ## omnictl cluster kubernetes upgrade-pre-checks Run Kubernetes upgrade pre-checks for the cluster. ### Synopsis Verify that upgrading Kubernetes version is available for the cluster: version compatibility, deprecated APIs, etc. ``` omnictl cluster kubernetes upgrade-pre-checks cluster-name [flags] ``` ### Options ``` -h, --help help for upgrade-pre-checks --to string target Kubernetes version for the planned upgrade ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster kubernetes](#omnictl-cluster-kubernetes) - Cluster Kubernetes management subcommands. ## omnictl cluster kubernetes Cluster Kubernetes management subcommands. ### Synopsis Commands to render, validate, manage cluster templates. ### Options ``` -h, --help help for kubernetes ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl cluster kubernetes manifest-sync](#omnictl-cluster-kubernetes-manifest-sync) - Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API. * [omnictl cluster kubernetes upgrade-pre-checks](#omnictl-cluster-kubernetes-upgrade-pre-checks) - Run Kubernetes upgrade pre-checks for the cluster. ## omnictl cluster lock Lock the cluster ### Synopsis When locked, no config updates, upgrades and downgrades will be performed on the cluster nodes. ``` omnictl cluster lock cluster-id [flags] ``` ### Options ``` -h, --help help for lock ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. ## omnictl cluster machine delete Delete the machine from the cluster ### Synopsis Delete the machine from the cluster. The command waits for the machine to be fully deleted. ``` omnictl cluster machine delete machine-id [flags] ``` ### Options ``` -f, --force force delete the machine, skipping wipe --force-etcd-leave force leave etcd -h, --help help for delete -t, --timeout duration timeout for the machine deletion (default 5m0s) -y, --yes-i-am-really-sure do not ask for confirmation when using --force-etcd-leave ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster machine](#omnictl-cluster-machine) - Machine related commands. ## omnictl cluster machine lock Lock the machine ### Synopsis When locked, no config updates, upgrades and downgrades will be performed on the machine. ``` omnictl cluster machine lock machine-id [flags] ``` ### Options ``` -h, --help help for lock ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster machine](#omnictl-cluster-machine) - Machine related commands. ## omnictl cluster machine unlock Unlock the machine ### Synopsis Removes locked annotation from the machine. ``` omnictl cluster machine unlock machine-id [flags] ``` ### Options ``` -h, --help help for unlock ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster machine](#omnictl-cluster-machine) - Machine related commands. ## omnictl cluster machine Machine related commands. ### Synopsis Commands to manage cluster machines. ### Options ``` -h, --help help for machine ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl cluster machine delete](#omnictl-cluster-machine-delete) - Delete the machine from the cluster * [omnictl cluster machine lock](#omnictl-cluster-machine-lock) - Lock the machine * [omnictl cluster machine unlock](#omnictl-cluster-machine-unlock) - Unlock the machine ## omnictl cluster secret rotate kubernetes-ca Rotate Kubernetes CA certificate. ### Synopsis Rotate Kubernetes CA certificate for all nodes in the cluster. Kubernetes CA is used by the Kubernetes API server and kubelet for authenticating clients. ``` omnictl cluster secret rotate kubernetes-ca [flags] ``` ### Options ``` -h, --help help for kubernetes-ca ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. -n, --name string cluster name --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. -w, --wait wait for the secret rotation to complete (default true) -t, --wait-timeout duration wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s) ``` ### SEE ALSO * [omnictl cluster secret rotate](#omnictl-cluster-secret-rotate) - Rotate cluster secrets, wait for the rotation to complete. ## omnictl cluster secret rotate status Show secret rotation status, wait for the rotation to complete. ### Synopsis Shows current secret rotation status, if the terminal supports it, watch the status as it updates. The command waits for the secret to be fully rotated by default. ``` omnictl cluster secret rotate status [flags] ``` ### Options ``` -h, --help help for status ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. -n, --name string cluster name --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. -w, --wait wait for the secret rotation to complete (default true) -t, --wait-timeout duration wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s) ``` ### SEE ALSO * [omnictl cluster secret rotate](#omnictl-cluster-secret-rotate) - Rotate cluster secrets, wait for the rotation to complete. ## omnictl cluster secret rotate talos-ca Rotate Talos CA certificate. ### Synopsis Rotate Talos CA certificate for all nodes in the cluster. Talos CA is used by Talos API. ``` omnictl cluster secret rotate talos-ca [flags] ``` ### Options ``` -h, --help help for talos-ca ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. -n, --name string cluster name --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. -w, --wait wait for the secret rotation to complete (default true) -t, --wait-timeout duration wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s) ``` ### SEE ALSO * [omnictl cluster secret rotate](#omnictl-cluster-secret-rotate) - Rotate cluster secrets, wait for the rotation to complete. ## omnictl cluster secret rotate Rotate cluster secrets, wait for the rotation to complete. ### Synopsis Rotates specified cluster secret, if the terminal supports it, watch the secret update steps. The command waits for the secret to be fully rotated by default. ### Options ``` -h, --help help for rotate -w, --wait wait for the secret rotation to complete (default true) -t, --wait-timeout duration wait timeout for secret rotation, if zero, wait indefinitely (default 5m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. -n, --name string cluster name --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster secret](#omnictl-cluster-secret) - Cluster secret management subcommands. * [omnictl cluster secret rotate kubernetes-ca](#omnictl-cluster-secret-rotate-kubernetes-ca) - Rotate Kubernetes CA certificate. * [omnictl cluster secret rotate status](#omnictl-cluster-secret-rotate-status) - Show secret rotation status, wait for the rotation to complete. * [omnictl cluster secret rotate talos-ca](#omnictl-cluster-secret-rotate-talos-ca) - Rotate Talos CA certificate. ## omnictl cluster secret Cluster secret management subcommands. ### Synopsis Commands to manage cluster secrets. ### Options ``` -h, --help help for secret -n, --name string cluster name ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl cluster secret rotate](#omnictl-cluster-secret-rotate) - Rotate cluster secrets, wait for the rotation to complete. ## omnictl cluster status Show cluster status, wait for the cluster to be ready. ### Synopsis Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default. ``` omnictl cluster status cluster-name [flags] ``` ### Options ``` -h, --help help for status -q, --quiet suppress output -w, --wait duration wait timeout, if zero, report current status and exit (default 5m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. ## omnictl cluster template delete Delete all cluster template resources from Omni. ### Synopsis Delete all resources related to the cluster template. This command requires API access. ``` omnictl cluster template delete [flags] ``` ### Options ``` --destroy-disconnected-machines removes all disconnected machines which are part of the cluster from Omni -d, --dry-run dry run -f, --file string path to the cluster template file or directory. -h, --help help for delete -v, --verbose verbose output (show diff for each resource) ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template diff Show diff in resources if the template is synced. ### Synopsis Query existing resources for the cluster and compare them with the resources generated from the template. This command requires API access. ``` omnictl cluster template diff [flags] ``` ### Options ``` -f, --file string path to the cluster template file or directory. -h, --help help for diff ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template export Export a cluster template from an existing cluster on Omni. ### Synopsis Export a cluster template from an existing cluster on Omni. This command requires API access. ``` omnictl cluster template export cluster-name [flags] ``` ### Options ``` -c, --cluster string cluster name -f, --force overwrite output file if it exists -h, --help help for export --include-kernel-args include kernel arguments (KernelArgs resources) in the exported template -o, --output string output file (default: stdout) ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template render Render a cluster template to a set of resources. ### Synopsis Validate template contents, convert to resources and output resources to stdout as YAML. This command is offline (doesn't access API). ``` omnictl cluster template render [flags] ``` ### Options ``` -f, --file string path to the cluster template file or directory. -h, --help help for render ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template status Show template cluster status, wait for the cluster to be ready. ### Synopsis Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default. ``` omnictl cluster template status [flags] ``` ### Options ``` -f, --file string path to the cluster template file or directory. -h, --help help for status -q, --quiet suppress output -w, --wait duration wait timeout, if zero, report current status and exit (default 5m0s) ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template sync Apply template to the Omni. ### Synopsis Query existing resources for the cluster and compare them with the resources generated from the template, create/update/delete resources as needed. This command requires API access. If a file is specified, only that file will be processed. If a directory is specified, all YAML files (\*.yaml, \*.yml) in the directory and its subdirectories will be processed recursively. Each template file is processed independently, allowing management of multiple clusters. ``` omnictl cluster template sync [flags] ``` ### Options ``` -d, --dry-run dry run -f, --file string path to the cluster template file or directory. -h, --help help for sync -v, --verbose verbose output (show diff for each resource) ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template validate Validate a cluster template. ### Synopsis Validate that template contains valid structures, and there are no other warnings. This command is offline (doesn't access API). ``` omnictl cluster template validate [flags] ``` ### Options ``` -f, --file string path to the cluster template file or directory. -h, --help help for validate ``` ### Options inherited from parent commands ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. ## omnictl cluster template Cluster template management subcommands. ### Synopsis Commands to render, validate, manage cluster templates. ### Options ``` --allowed-dir string allowed directory for file access in the template; relative paths are resolved against the template file's directory. (default "./") -h, --help help for template ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl cluster template delete](#omnictl-cluster-template-delete) - Delete all cluster template resources from Omni. * [omnictl cluster template diff](#omnictl-cluster-template-diff) - Show diff in resources if the template is synced. * [omnictl cluster template export](#omnictl-cluster-template-export) - Export a cluster template from an existing cluster on Omni. * [omnictl cluster template render](#omnictl-cluster-template-render) - Render a cluster template to a set of resources. * [omnictl cluster template status](#omnictl-cluster-template-status) - Show template cluster status, wait for the cluster to be ready. * [omnictl cluster template sync](#omnictl-cluster-template-sync) - Apply template to the Omni. * [omnictl cluster template validate](#omnictl-cluster-template-validate) - Validate a cluster template. ## omnictl cluster unlock Unlock the cluster ### Synopsis Removes locked annotation from the cluster. ``` omnictl cluster unlock cluster-id [flags] ``` ### Options ``` -h, --help help for unlock ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. ## omnictl cluster Cluster-related subcommands. ### Synopsis Commands to destroy clusters and manage cluster templates. ### Options ``` -h, --help help for cluster ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl cluster delete](#omnictl-cluster-delete) - Delete all cluster resources. * [omnictl cluster import](#omnictl-cluster-import) - Cluster import related commands. * [omnictl cluster kubernetes](#omnictl-cluster-kubernetes) - Cluster Kubernetes management subcommands. * [omnictl cluster lock](#omnictl-cluster-lock) - Lock the cluster * [omnictl cluster machine](#omnictl-cluster-machine) - Machine related commands. * [omnictl cluster secret](#omnictl-cluster-secret) - Cluster secret management subcommands. * [omnictl cluster status](#omnictl-cluster-status) - Show cluster status, wait for the cluster to be ready. * [omnictl cluster template](#omnictl-cluster-template) - Cluster template management subcommands. * [omnictl cluster unlock](#omnictl-cluster-unlock) - Unlock the cluster ## omnictl completion bash Generate the autocompletion script for bash ### Synopsis Generate the autocompletion script for the bash shell. This script depends on the 'bash-completion' package. If it is not installed already, you can install it via your OS's package manager. To load completions in your current shell session: ``` source <(omnictl completion bash) ``` To load completions for every new session, execute once: #### Linux: ``` omnictl completion bash > /etc/bash_completion.d/omnictl ``` #### macOS: ``` omnictl completion bash > $(brew --prefix)/etc/bash_completion.d/omnictl ``` You will need to start a new shell for this setup to take effect. ``` omnictl completion bash ``` ### Options ``` -h, --help help for bash --no-descriptions disable completion descriptions ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl completion](#omnictl-completion) - Generate the autocompletion script for the specified shell ## omnictl completion fish Generate the autocompletion script for fish ### Synopsis Generate the autocompletion script for the fish shell. To load completions in your current shell session: ``` omnictl completion fish | source ``` To load completions for every new session, execute once: ``` omnictl completion fish > ~/.config/fish/completions/omnictl.fish ``` You will need to start a new shell for this setup to take effect. ``` omnictl completion fish [flags] ``` ### Options ``` -h, --help help for fish --no-descriptions disable completion descriptions ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl completion](#omnictl-completion) - Generate the autocompletion script for the specified shell ## omnictl completion powershell Generate the autocompletion script for powershell ### Synopsis Generate the autocompletion script for powershell. To load completions in your current shell session: ``` omnictl completion powershell | Out-String | Invoke-Expression ``` To load completions for every new session, add the output of the above command to your powershell profile. ``` omnictl completion powershell [flags] ``` ### Options ``` -h, --help help for powershell --no-descriptions disable completion descriptions ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl completion](#omnictl-completion) - Generate the autocompletion script for the specified shell ## omnictl completion zsh Generate the autocompletion script for zsh ### Synopsis Generate the autocompletion script for the zsh shell. If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once: ``` echo "autoload -U compinit; compinit" >> ~/.zshrc ``` To load completions in your current shell session: ``` source <(omnictl completion zsh) ``` To load completions for every new session, execute once: #### Linux: ``` omnictl completion zsh > "${fpath[1]}/_omnictl" ``` #### macOS: ``` omnictl completion zsh > $(brew --prefix)/share/zsh/site-functions/_omnictl ``` You will need to start a new shell for this setup to take effect. ``` omnictl completion zsh [flags] ``` ### Options ``` -h, --help help for zsh --no-descriptions disable completion descriptions ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl completion](#omnictl-completion) - Generate the autocompletion script for the specified shell ## omnictl completion Generate the autocompletion script for the specified shell ### Synopsis Generate the autocompletion script for omnictl for the specified shell. See each sub-command's help for details on how to use the generated script. ### Options ``` -h, --help help for completion ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl completion bash](#omnictl-completion-bash) - Generate the autocompletion script for bash * [omnictl completion fish](#omnictl-completion-fish) - Generate the autocompletion script for fish * [omnictl completion powershell](#omnictl-completion-powershell) - Generate the autocompletion script for powershell * [omnictl completion zsh](#omnictl-completion-zsh) - Generate the autocompletion script for zsh ## omnictl config add Add a new context ``` omnictl config add [flags] ``` ### Options ``` -h, --help help for add --identity string identity to use for authentication --url string URL of the server (default "grpc://127.0.0.1:8080") ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config context Set the current context ``` omnictl config context [flags] ``` ### Options ``` -h, --help help for context ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config contexts List defined contexts ``` omnictl config contexts [flags] ``` ### Options ``` -h, --help help for contexts ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config identity Set the auth identity for the current context ``` omnictl config identity [flags] ``` ### Options ``` -h, --help help for identity ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config info Show information about the current context ``` omnictl config info [flags] ``` ### Options ``` -h, --help help for info ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config merge Merge additional contexts from another client configuration file ### Synopsis Contexts with the same name are renamed while merging configs. ``` omnictl config merge [flags] ``` ### Options ``` -h, --help help for merge ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config new Generate a new client configuration file ``` omnictl config new [] [flags] ``` ### Options ``` -h, --help help for new --identity string identity to use for authentication --url string URL of the server (default "grpc://127.0.0.1:8080") ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config url Set the URL for the current context ``` omnictl config url [flags] ``` ### Options ``` -h, --help help for url ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) ## omnictl config Manage the client configuration file (omniconfig) ### Options ``` -h, --help help for config ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl config add](#omnictl-config-add) - Add a new context * [omnictl config context](#omnictl-config-context) - Set the current context * [omnictl config contexts](#omnictl-config-contexts) - List defined contexts * [omnictl config identity](#omnictl-config-identity) - Set the auth identity for the current context * [omnictl config info](#omnictl-config-info) - Show information about the current context * [omnictl config merge](#omnictl-config-merge) - Merge additional contexts from another client configuration file * [omnictl config new](#omnictl-config-new) - Generate a new client configuration file * [omnictl config url](#omnictl-config-url) - Set the URL for the current context ## omnictl configure machine Machine configuration command. ``` omnictl configure machine [flags] ``` ### Options ``` -h, --help help for machine --reset-node-unique-token reset the node unique token for the machine --siderolink-connection one of [udp,http-tunnel,auto] configure SideroLink connection mode ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl configure](#omnictl-configure) - Configuration subcommands. ## omnictl configure Configuration subcommands. ### Options ``` -h, --help help for configure ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl configure machine](#omnictl-configure-machine) - Machine configuration command. ## omnictl delete Delete a specific resource by ID or all resources of the type. ### Synopsis Similar to 'kubectl delete', 'omnictl delete' initiates resource deletion and waits for the operation to complete. ``` omnictl delete [] [flags] ``` ### Options ``` --all Delete all resources of the type. -h, --help help for delete -n, --namespace string The resource namespace. (default "default") -l, --selector string Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl edit Edit Omni resources with the default editor. ### Synopsis The edit command allows you to directly edit the resources of an Omni instance using your preferred text editor. It will open the editor defined by your OMNI\_EDITOR, TALOS\_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. ``` omnictl edit [] [flags] ``` ### Options ``` --dry-run do not apply the change after editing and print the change summary instead -h, --help help for edit --id-match-regexp string Match resource ID against a regular expression. --namespace string resource namespace (default is to use default namespace per resource) --selector string Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2) -v, --verbose Verbose output ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl get Get a specific resource or list of resources. ### Synopsis Similar to 'kubectl get', 'omnictl get' returns a set of resources from the OS. To get a list of all available resource definitions, issue 'omnictl get rd' ``` omnictl get [] [flags] ``` ### Options ``` -h, --help help for get --id-match-regexp string Match resource ID against a regular expression. -n, --namespace string The resource namespace. -o, --output string Output format (json, table, yaml, jsonpath). (default "table") -l, --selector string Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2) -w, --watch Watch the resource state. ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl infraprovider create Create an infra provider ``` omnictl infraprovider create [flags] ``` ### Options ``` -h, --help help for create -t, --ttl duration TTL for the infra provider service account key (default 8760h0m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl infraprovider](#omnictl-infraprovider) - Manage infra providers ## omnictl infraprovider delete Delete an infra provider ``` omnictl infraprovider delete [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl infraprovider](#omnictl-infraprovider) - Manage infra providers ## omnictl infraprovider list List infra providers ``` omnictl infraprovider list [flags] ``` ### Options ``` -h, --help help for list ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl infraprovider](#omnictl-infraprovider) - Manage infra providers ## omnictl infraprovider renewkey Renew an infra provider service account by registering a new public key to it ``` omnictl infraprovider renewkey [flags] ``` ### Options ``` -h, --help help for renewkey -t, --ttl duration TTL for the infra provider service account key (default 8760h0m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl infraprovider](#omnictl-infraprovider) - Manage infra providers ## omnictl infraprovider Manage infra providers ### Options ``` -h, --help help for infraprovider ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl infraprovider create](#omnictl-infraprovider-create) - Create an infra provider * [omnictl infraprovider delete](#omnictl-infraprovider-delete) - Delete an infra provider * [omnictl infraprovider list](#omnictl-infraprovider-list) - List infra providers * [omnictl infraprovider renewkey](#omnictl-infraprovider-renewkey) - Renew an infra provider service account by registering a new public key to it ## omnictl jointoken create Create a join token ``` omnictl jointoken create [flags] ``` ### Options ``` -h, --help help for create -t, --ttl duration TTL for the join token ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken delete Delete a join token ``` omnictl jointoken delete [flags] ``` ### Options ``` -f, --force Delete the token even if it is going to make the machines to disconnect -h, --help help for delete ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken kernel-args Get Talos kernel args to make a machine join Omni ``` omnictl jointoken kernel-args [flags] ``` ### Options ``` -h, --help help for kernel-args --token-id string Generate using specific token ID (uses default if empty) --token-name string Looks up the token by name and generates the config using the token (uses default if empty) --use-grpc-tunnel Use gRPC tunnel in the config ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken list List join tokens ``` omnictl jointoken list [flags] ``` ### Options ``` -h, --help help for list ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken machine-config Get partial machine config to make a machine join Omni ``` omnictl jointoken machine-config [flags] ``` ### Options ``` -h, --help help for machine-config --token-id string Generate using specific token ID (uses default if empty) --token-name string Looks up the token by name and generates the config using the token (uses default if empty) --use-grpc-tunnel Use gRPC tunnel in the config ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken make-default Make the token default one ``` omnictl jointoken make-default [flags] ``` ### Options ``` -h, --help help for make-default ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken omni-endpoint Get the Omni endpoint URL with the join token ``` omnictl jointoken omni-endpoint [flags] ``` ### Options ``` -h, --help help for omni-endpoint --token-id string Generate using specific token ID (uses default if empty) --token-name string Looks up the token by name and generates the config using the token (uses default if empty) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken renew Renew a join token ``` omnictl jointoken renew [flags] ``` ### Options ``` -h, --help help for renew -t, --ttl duration TTL for the join token ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken revoke Revoke a join token ``` omnictl jointoken revoke [flags] ``` ### Options ``` -f, --force Revoke the token even if it is going to make the machines to disconnect -h, --help help for revoke ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken unrevoke Unrevoke a join token ``` omnictl jointoken unrevoke [flags] ``` ### Options ``` -h, --help help for unrevoke ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens ## omnictl jointoken Manage join tokens ### Options ``` -h, --help help for jointoken ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl jointoken create](#omnictl-jointoken-create) - Create a join token * [omnictl jointoken delete](#omnictl-jointoken-delete) - Delete a join token * [omnictl jointoken kernel-args](#omnictl-jointoken-kernel-args) - Get Talos kernel args to make a machine join Omni * [omnictl jointoken list](#omnictl-jointoken-list) - List join tokens * [omnictl jointoken machine-config](#omnictl-jointoken-machine-config) - Get partial machine config to make a machine join Omni * [omnictl jointoken make-default](#omnictl-jointoken-make-default) - Make the token default one * [omnictl jointoken omni-endpoint](#omnictl-jointoken-omni-endpoint) - Get the Omni endpoint URL with the join token * [omnictl jointoken renew](#omnictl-jointoken-renew) - Renew a join token * [omnictl jointoken revoke](#omnictl-jointoken-revoke) - Revoke a join token * [omnictl jointoken unrevoke](#omnictl-jointoken-unrevoke) - Unrevoke a join token ## omnictl kubeconfig Download the admin kubeconfig of a cluster ### Synopsis Download the admin kubeconfig of a cluster. If merge flag is defined, config will be merged with \~/.kube/config or \[local-path] if specified. Otherwise kubeconfig will be written to PWD or \[local-path] if specified. ``` omnictl kubeconfig [local-path] [flags] ``` ### Options ``` --break-glass get kubeconfig that allows accessing nodes bypasing Omni (if enabled for the account) -c, --cluster string cluster to use -f, --force force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge --force-context-name string force context name in the resulting kubeconfig --grant-type string Authorization grant type to use. One of (auto|authcode|authcode-keyboard) --groups strings group to be used in the service account token (groups). only used when --service-account is set to true (default [system:masters]) -h, --help help for kubeconfig -m, --merge merge with existing kubeconfig (default true) --oidc-cache-base-dir string override the base cache directory for kubelogin in the generated kubeconfig --oidc-cache-isolation isolate OIDC token caches across clusters by appending a per-context subdirectory to the cache directory --service-account create a service account type kubeconfig instead of a OIDC-authenticated user type --ttl duration ttl for the service account token. only used when --service-account is set to true (default 8760h0m0s) --user string user to be used in the service account token (sub). required when --service-account is set to true ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl machine install Install Talos to disk on a machine running in maintenance mode ### Synopsis Install Talos to disk on a machine that is running in maintenance mode. This requires the machine to be running Talos 1.13 or newer. The target disk must be specified with --disk (e.g. /dev/sda); use 'omnictl get machinestatus \ -o yaml' to inspect the available block devices. When --version is omitted, the version Talos is currently running in memory on the machine is installed. Installer progress is streamed to the terminal; on success the machine is rebooted so it boots from disk into the freshly installed Talos. ``` omnictl machine install machine-id [flags] ``` ### Options ``` --disk string target install disk (e.g. /dev/sda) -h, --help help for install --version string Talos version to install; defaults to the version running in memory on the machine ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl machine](#omnictl-machine) - Machine related commands. ## omnictl machine power-on Power on a machine ### Synopsis Power on a machine managed by an infra provider. This clears the power off request and allows the provider to power the machine on. ``` omnictl machine power-on machine-id [flags] ``` ### Options ``` -h, --help help for power-on ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl machine](#omnictl-machine) - Machine related commands. ## omnictl machine shutdown Shut down a machine ### Synopsis Shut down a machine. For machines managed by an infra provider, this also prevents the provider from automatically powering the machine back on. ``` omnictl machine shutdown machine-id [flags] ``` ### Options ``` -h, --help help for shutdown ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl machine](#omnictl-machine) - Machine related commands. ## omnictl machine upgrade Upgrade the on-disk Talos on a machine running in maintenance mode ### Synopsis Upgrade the on-disk Talos on a machine that is running in maintenance mode and already has Talos installed. This requires the machine to be running Talos 1.13 or newer. --version is required and specifies the Talos version to write to disk. Installer progress is streamed to the terminal; on success the machine is rebooted so it boots from disk into the upgraded Talos. ``` omnictl machine upgrade machine-id [flags] ``` ### Options ``` -h, --help help for upgrade --version string Talos version to upgrade to ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl machine](#omnictl-machine) - Machine related commands. ## omnictl machine Machine related commands. ### Synopsis Commands to manage machines. ### Options ``` -h, --help help for machine ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl machine install](#omnictl-machine-install) - Install Talos to disk on a machine running in maintenance mode * [omnictl machine power-on](#omnictl-machine-power-on) - Power on a machine * [omnictl machine shutdown](#omnictl-machine-shutdown) - Shut down a machine * [omnictl machine upgrade](#omnictl-machine-upgrade) - Upgrade the on-disk Talos on a machine running in maintenance mode ## omnictl machine-logs Get logs for a machine ### Synopsis Get logs for a provided machine id ``` omnictl machine-logs machineID [flags] ``` ### Options ``` -f, --follow specify if the logs should be streamed -h, --help help for machine-logs --log-format string log format (raw, omni, dmesg) to display (default is to display in raw format) (default "raw") --tail int32 lines of log file to display (default is to show from the beginning) (default -1) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl media download Download installation media from a preset. ### Synopsis Download installation media using a saved preset configuration. Flags here override the corresponding values from the preset, but cannot change the preset's platform, overlay, or bootloader: those define the preset itself. To use different settings, create a new preset. The format flag determines the output file type for metal presets: * iso - ISO image (default) * raw - Raw disk image (.raw\.xz) * qcow2 - QEMU disk image (.qcow2) * pxe - Print PXE boot URL (no file downloaded) For cloud presets, the format is automatically determined by the platform. For SBC presets, a raw disk image is always produced. Examples: ``` # Download from a preset (format is auto-detected from the preset type) omnictl media download my-preset # Force raw disk image for a metal preset omnictl media download my-preset --format raw # Get PXE boot URL for a metal preset omnictl media download my-preset --format pxe # Override extensions for a one-off download omnictl media download my-preset --extensions qemu-guest-agent # Download to a specific directory omnictl media download my-preset --output /tmp/images/ ``` ``` omnictl media download [flags] ``` ### Options ``` --arch string Image architecture override (amd64, arm64; uses preset value if empty) --embedded-machine-config-file string Override the embedded machine config, reading it from a file or "-" for stdin --extensions strings Override extensions to pre-install --extra-kernel-args stringArray Override extra kernel args --format string Output format for metal presets: iso, raw, qcow2, pxe (auto-detected if omitted) -h, --help help for download --initial-labels strings Override initial machine labels (key=value) --join-token string Join token ID override (uses preset token if empty) --output string Output file or directory, defaults to current working directory (default ".") --secureboot Override secure boot setting --talos-version string Talos version override (uses preset value if empty) --use-siderolink-grpc-tunnel Configure Talos to use the SideroLink (WireGuard) gRPC tunnel over HTTP/2 for Omni management traffic, instead of UDP. Only enable this if the network blocks UDP packets, as HTTP tunneling adds significant overhead for communications. ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl media](#omnictl-media) - Manage installation media presets. ## omnictl media preset create Create an installation media preset. ### Synopsis Create a new installation media preset that can be used for downloading installation media. Examples: ``` # Create a basic metal preset omnictl media preset create my-preset --arch amd64 # Create a cloud preset for AWS omnictl media preset create aws-preset --arch amd64 --platform aws # Create an SBC preset for Raspberry Pi omnictl media preset create rpi-preset --arch arm64 --overlay rpi_generic # Create a preset with extensions and labels omnictl media preset create full-preset --arch amd64 \ --extensions qemu-guest-agent --extensions intel-ucode \ --initial-labels env=production --initial-labels team=infra # Create a preset with an embedded machine config read from a file omnictl media preset create embedded-preset --arch amd64 \ --embedded-machine-config-file ./machine-config.yaml ``` ``` omnictl media preset create [flags] ``` ### Options ``` --arch string Image architecture (amd64, arm64) (default "amd64") --bootloader string Bootloader type (auto, uefi, bios, dual) (default "auto") --embedded-machine-config-file string Embedded machine config read from a file, or "-" for stdin --extensions strings Extensions to pre-install in the preset --extra-kernel-args stringArray Extra kernel args to include in the preset -h, --help help for create --initial-labels strings Initial machine labels in key=value format --join-token string Join token ID (uses default token if empty) --overlay string SBC overlay name (e.g., rpi_generic, rockpi_4c) --overlay-options string SBC overlay options (YAML string) --platform string Cloud platform (e.g., aws, gcp, azure, vultr) --secureboot Enable SecureBoot in the preset --talos-version string Talos version for the preset (leave empty to track the server's default at download time) --use-siderolink-grpc-tunnel Configure Talos to use the SideroLink (WireGuard) gRPC tunnel over HTTP/2 for Omni management traffic, instead of UDP. Only enable this if the network blocks UDP packets, as HTTP tunneling adds significant overhead for communications. ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl media preset](#omnictl-media-preset) - Manage installation media presets. ## omnictl media preset delete Delete an installation media preset. ``` omnictl media preset delete [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl media preset](#omnictl-media-preset) - Manage installation media presets. ## omnictl media preset list List installation media presets. ``` omnictl media preset list [flags] ``` ### Options ``` -h, --help help for list -o, --output string Output format. One of: wide ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl media preset](#omnictl-media-preset) - Manage installation media presets. ## omnictl media preset Manage installation media presets. ### Synopsis Commands to create, list, and delete installation media presets. ### Options ``` -h, --help help for preset ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl media](#omnictl-media) - Manage installation media presets. * [omnictl media preset create](#omnictl-media-preset-create) - Create an installation media preset. * [omnictl media preset delete](#omnictl-media-preset-delete) - Delete an installation media preset. * [omnictl media preset list](#omnictl-media-preset-list) - List installation media presets. ## omnictl media Manage installation media presets. ### Synopsis Commands to create, list, delete, and download from installation media presets. ### Options ``` -h, --help help for media ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl media download](#omnictl-media-download) - Download installation media from a preset. * [omnictl media preset](#omnictl-media-preset) - Manage installation media presets. ## omnictl security sbom Fetch the SPDX bundle of a schematic, or of every schematic in a cluster. ### Synopsis Fetches the SPDX bundle of a schematic, or of every schematic installed across a cluster's machines, including upgrade targets with --upgrade-paths. Always prints a JSON array of \{schematicId, arch, version, sbom}, one entry per bundle fetched. Examples: ``` # Fetch the SBOM of a specific schematic build omnictl security sbom --schematic \ --talos-version 1.9.0 --arch amd64 # Fetch the SBOM of every schematic a cluster's machines are running, including upgrade targets omnictl security sbom --cluster-id my-cluster --upgrade-paths ``` ``` omnictl security sbom [flags] ``` ### Options ``` --arch string Architecture to fetch an artifact for (amd64, arm64). --cluster-id string Resolve targets from a cluster's installed schematics. -h, --help help for sbom -o, --output string Output format (json, yaml). (default "json") --schematic string Schematic ID to fetch an artifact for. --talos-version string Talos version to fetch an artifact for. --upgrade-paths Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id). ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl security](#omnictl-security) - Security artifact subcommands. ## omnictl security scan Fetch the vulnerability scan report of a schematic, or of every schematic in a cluster. ### Synopsis Fetches the vulnerability scan report of a schematic, or of every schematic installed across a cluster's machines. By default, prints a table of findings by severity. With -o json or -o yaml, prints a JSON array of \{schematicId, arch, version, report, upgradeCandidates}, one entry per target fetched: report is the factory's report embedded verbatim, and upgradeCandidates lists \{version, report} for each upgrade-target version --upgrade-paths also fetched. \--format selects the report format fetched from the factory (json, sarif, cyclonedx - all of which are themselves JSON, so any embeds cleanly under -o json/yaml). There is no "table" format value here - that's Grype's own preformatted text table, a separate thing from -o table's severity summary, and can't be embedded in -o json/yaml output. The default -o table only works with \--format json: its severity counts are read from Grype's own JSON schema, which sarif/cyclonedx don't share - pass -o json/yaml to fetch a report in another format. Examples: ``` # Scan a specific schematic build omnictl security scan --schematic \ --talos-version 1.9.0 --arch amd64 # Scan every schematic a cluster's machines are running, including upgrade targets omnictl security scan --cluster-id my-cluster --upgrade-paths # Print the full reports as JSON instead of the severity table omnictl security scan --cluster-id my-cluster -o json # Print SARIF reports instead of Grype's native JSON omnictl security scan --cluster-id my-cluster -o json --format sarif ``` ``` omnictl security scan [flags] ``` ### Options ``` --arch string Architecture to fetch an artifact for (amd64, arm64). --cluster-id string Resolve targets from a cluster's installed schematics. --format string Report format to fetch (json, sarif, cyclonedx). (default "json") -h, --help help for scan -o, --output string Output format (table, json, yaml). (default "table") --schematic string Schematic ID to fetch an artifact for. --talos-version string Talos version to fetch an artifact for. --upgrade-paths Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id). ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl security](#omnictl-security) - Security artifact subcommands. ## omnictl security vex Fetch the VEX document of a Talos version, or of every version a cluster runs. ### Synopsis Fetches the OpenVEX document of a Talos version, or of a cluster's current version and (with --upgrade-paths) its upgrade targets. A VEX document covers a Talos version as a whole, not a specific schematic, so no --schematic/--arch is needed. Always prints a JSON array of \{version, vex}, one entry per version fetched. Examples: ``` # Fetch the VEX document for a specific Talos version omnictl security vex --talos-version 1.9.0 # Fetch the VEX documents for a cluster's current and upgrade-target versions omnictl security vex --cluster-id my-cluster --upgrade-paths ``` ``` omnictl security vex [flags] ``` ### Options ``` --cluster-id string Resolve versions from a cluster's current and upgrade-target Talos versions. -h, --help help for vex -o, --output string Output format (json, yaml). (default "json") --talos-version string Talos version to fetch an artifact for. --upgrade-paths Also fetch the cluster's upgrade-target versions, not just the current one (requires --cluster-id). ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl security](#omnictl-security) - Security artifact subcommands. ## omnictl security Security artifact subcommands. ### Synopsis Commands to fetch vulnerability scans, SBOMs and VEX documents for a schematic, either named explicitly or resolved from a cluster's installed schematics. ### Options ``` -h, --help help for security ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl security sbom](#omnictl-security-sbom) - Fetch the SPDX bundle of a schematic, or of every schematic in a cluster. * [omnictl security scan](#omnictl-security-scan) - Fetch the vulnerability scan report of a schematic, or of every schematic in a cluster. * [omnictl security vex](#omnictl-security-vex) - Fetch the VEX document of a Talos version, or of every version a cluster runs. ## omnictl serviceaccount create Create a service account ``` omnictl serviceaccount create [flags] ``` ### Options ``` -h, --help help for create -r, --role string role of the service account. only used when --use-user-role=false -t, --ttl duration TTL for the service account key (default 8760h0m0s) -u, --use-user-role use the role of the creating user. if true, --role is ignored (default true) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl serviceaccount](#omnictl-serviceaccount) - Manage service accounts ## omnictl serviceaccount destroy Destroy a service account ``` omnictl serviceaccount destroy [flags] ``` ### Options ``` -h, --help help for destroy ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl serviceaccount](#omnictl-serviceaccount) - Manage service accounts ## omnictl serviceaccount list List service accounts ``` omnictl serviceaccount list [flags] ``` ### Options ``` -h, --help help for list ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl serviceaccount](#omnictl-serviceaccount) - Manage service accounts ## omnictl serviceaccount renew Renew a service account by registering a new public key to it ``` omnictl serviceaccount renew [flags] ``` ### Options ``` -h, --help help for renew -t, --ttl duration TTL for the service account key (default 8760h0m0s) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl serviceaccount](#omnictl-serviceaccount) - Manage service accounts ## omnictl serviceaccount Manage service accounts ### Options ``` -h, --help help for serviceaccount ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl serviceaccount create](#omnictl-serviceaccount-create) - Create a service account * [omnictl serviceaccount destroy](#omnictl-serviceaccount-destroy) - Destroy a service account * [omnictl serviceaccount list](#omnictl-serviceaccount-list) - List service accounts * [omnictl serviceaccount renew](#omnictl-serviceaccount-renew) - Renew a service account by registering a new public key to it ## omnictl support Download the support bundle for a cluster ### Synopsis The command collects all non-sensitive information for the cluster from the Omni state. By default, the generated bundle is encrypted using age encryption to the list of recipients set by the members of the 'siderolabs' GitHub organization. The encrypted bundle by default will only be decryptable by the Sidero Labs team, but you can also specify additional recipients using the \--encryption-recipients flag, or disable encryption completely using the --no-encryption flag. Default encryption recipients can be removed by setting --encryption-no-default-recipients flag. ``` omnictl support [local-path] [flags] ``` ### Options ``` -c, --cluster string cluster to use --encryption-no-default-recipients do not encrypt to the default recipients, only to the ones provided via --encryption-recipients --encryption-recipients stringArray additional age recipients (SSH or age public keys) to encrypt the support bundle to (can be specified multiple times) -h, --help help for support --no-encryption do not encrypt the support bundle (output is written as-is) -O, --output string support bundle output (default "support.zip.age", or "support.zip" with --no-encryption) -v, --verbose verbose output ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl talosconfig Download an admin talosconfig. ### Synopsis Download the generic admin talosconfig of the Omni instance or the admin talosconfig of a cluster. Generic talosconfig can be used with any machine, including those in maintenance mode. If merge flag is defined, config will be merged with \~/.talos/config or \[local-path] if specified. Otherwise talosconfig will be written to PWD or \[local-path] if specified. ``` omnictl talosconfig [local-path] [flags] ``` ### Options ``` --break-glass get operator talosconfig that allows bypassing Omni (if enabled for the account) -c, --cluster string cluster to use. If omitted, download the generic talosconfig for the Omni instance. -f, --force force overwrite of talosconfig if already present -h, --help help for talosconfig -m, --merge merge with existing talosconfig (default true) ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. ## omnictl user create Create a user. ### Synopsis Create a user with the specified email. ``` omnictl user create [email] [flags] ``` ### Options ``` -h, --help help for create -r, --role string Role to use for the user creation ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl user](#omnictl-user) - User-related subcommands. ## omnictl user delete Delete users. ### Synopsis Delete users with the specified emails. ``` omnictl user delete [email1 email2] [flags] ``` ### Options ``` -h, --help help for delete ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl user](#omnictl-user) - User-related subcommands. ## omnictl user list List all users. ### Synopsis List all existing users on the Omni instance. ``` omnictl user list [flags] ``` ### Options ``` -h, --help help for list ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl user](#omnictl-user) - User-related subcommands. ## omnictl user set-role Update the role of the user. ### Synopsis Update the user role. ``` omnictl user set-role [email] [flags] ``` ### Options ``` -h, --help help for set-role -r, --role string Role to use ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl user](#omnictl-user) - User-related subcommands. ## omnictl user User-related subcommands. ### Synopsis Commands to manage users. ### Options ``` -h, --help help for user ``` ### Options inherited from parent commands ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl](#omnictl) - A CLI for accessing Omni API. * [omnictl user create](#omnictl-user-create) - Create a user. * [omnictl user delete](#omnictl-user-delete) - Delete users. * [omnictl user list](#omnictl-user-list) - List all users. * [omnictl user set-role](#omnictl-user-set-role) - Update the role of the user. ## omnictl A CLI for accessing Omni API. ### Options ``` --context string The context to be used. Defaults to the selected context in the omniconfig file. -h, --help help for omnictl --insecure-skip-tls-verify Skip TLS verification for the Omni GRPC and HTTP API endpoints. --omniconfig string The path to the omni configuration file. Defaults to 'OMNICONFIG' env variable if set, otherwise '$HOME/.talos/omni/config'. '$XDG_CONFIG_HOME/omni/config' is Deprecated and only used as a last resort for reading existing configuration file. --siderov1-keys-dir string The path to the SideroV1 auth PGP keys directory. Defaults to 'SIDEROV1_KEYS_DIR' env variable if set, otherwise '$HOME/.talos/keys'. ``` ### SEE ALSO * [omnictl apply](#omnictl-apply) - Create or update resource using YAML file or directory as an input * [omnictl audit-log](#omnictl-audit-log) - Read audit log from Omni * [omnictl cluster](#omnictl-cluster) - Cluster-related subcommands. * [omnictl completion](#omnictl-completion) - Generate the autocompletion script for the specified shell * [omnictl config](#omnictl-config) - Manage the client configuration file (omniconfig) * [omnictl configure](#omnictl-configure) - Configuration subcommands. * [omnictl delete](#omnictl-delete) - Delete a specific resource by ID or all resources of the type. * [omnictl edit](#omnictl-edit) - Edit Omni resources with the default editor. * [omnictl get](#omnictl-get) - Get a specific resource or list of resources. * [omnictl infraprovider](#omnictl-infraprovider) - Manage infra providers * [omnictl jointoken](#omnictl-jointoken) - Manage join tokens * [omnictl kubeconfig](#omnictl-kubeconfig) - Download the admin kubeconfig of a cluster * [omnictl machine](#omnictl-machine) - Machine related commands. * [omnictl machine-logs](#omnictl-machine-logs) - Get logs for a machine * [omnictl media](#omnictl-media) - Manage installation media presets. * [omnictl security](#omnictl-security) - Security artifact subcommands. * [omnictl serviceaccount](#omnictl-serviceaccount) - Manage service accounts * [omnictl support](#omnictl-support) - Download the support bundle for a cluster * [omnictl talosconfig](#omnictl-talosconfig) - Download an admin talosconfig. * [omnictl user](#omnictl-user) - User-related subcommands. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.