Knowledge Base

Disabling `GracefulNodeShutdown` on a node

Talos Linux enables Graceful Node Shutdown Kubernetes feature by default. If this feature should be disabled, patch the KubeletConfig document of the machine configuration with:

apiVersion: v1alpha1
kind: KubeletConfig
extraArgs:
  feature-gates: GracefulNodeShutdown=false
config:
  shutdownGracePeriod: 0s
  shutdownGracePeriodCriticalPods: 0s

Generating Talos Linux ISO image with custom kernel arguments

Pass additional kernel arguments using --extra-kernel-arg flag: ISO will be output to the file talos-<arch>.iso in the current directory.

Logging Kubernetes audit logs with loki

If using loki-stack helm chart to gather logs from the Kubernetes cluster, you can use the helm values to configure loki-stack to log Kubernetes API server audit logs:

promtail:
  extraArgs:
    - -config.expand-env
  # this is required so that the promtail process can read the kube-apiserver audit logs written as `nobody` user
  containerSecurityContext:
    capabilities:
      add:
        - DAC_READ_SEARCH
  extraVolumes:
    - name: audit-logs
      hostPath:
        path: /var/log/audit/kube
  extraVolumeMounts:
    - name: audit-logs
      mountPath: /var/log/audit/kube
      readOnly: true
  config:
    snippets:
      extraScrapeConfigs: |
        - job_name: auditlogs
          static_configs:
            - targets:
                - localhost
              labels:
                job: auditlogs
                host: ${HOSTNAME}
                __path__: /var/log/audit/kube/*.log

Setting CPU scaling governor

While its possible to set CPU scaling governor via the SysfsConfig document, it’s sometimes cumbersome to set it for all CPU’s individually. A more elegant approach would be set it via a kernel commandline parameter. This also means that the options are applied way early in the boot process. Bake the argument into the boot asset and the installer image with an Image Factory schematic instead:

customization:
  extraKernelArgs:
    - cpufreq.default_governor=performance

Note: the node needs to be upgraded to (or installed from) an image built with this schematic for the argument to take effect.

Disable `admissionControl` on control plane nodes

Talos Linux enables admission control in the API Server by default. Each admission control plugin is configured with its own KubeAdmissionControlConfig document, so removing the plugin means removing the document. Although it is not recommended from a security point of view, the default PodSecurity plugin can be removed by patching your control plane machine configuration with:

# no-pod-security.yaml
apiVersion: v1alpha1
kind: KubeAdmissionControlConfig
name: PodSecurity
$patch: delete

talosctl gen config \
    my-cluster https://mycluster.local:6443 \
    --config-patch-control-plane @no-pod-security.yaml

⌘I

Overview

Getting Started

Platform specific installation

Deploying and managing workloads

Networking

Security

Build and extend Talos

Configure your Talos cluster

Advanced guides

Reference

Troubleshooting and support

Learn more

Disabling `GracefulNodeShutdown` on a node

Generating Talos Linux ISO image with custom kernel arguments

Logging Kubernetes audit logs with loki

Setting CPU scaling governor

Disable `admissionControl` on control plane nodes

​Disabling GracefulNodeShutdown on a node

​Generating Talos Linux ISO image with custom kernel arguments

​Logging Kubernetes audit logs with loki

​Setting CPU scaling governor

​Disable admissionControl on control plane nodes

Disabling `GracefulNodeShutdown` on a node

Generating Talos Linux ISO image with custom kernel arguments

Logging Kubernetes audit logs with loki

Setting CPU scaling governor

Disable `admissionControl` on control plane nodes