> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Knowledge Base

> Recipes for common configuration tasks with Talos Linux.

## Disabling `GracefulNodeShutdown` on a node

Talos Linux enables [Graceful Node Shutdown](https://kubernetes.io/docs/concepts/architecture/nodes/#graceful-node-shutdown) Kubernetes feature by default.

If this feature should be disabled, patch the [`KubeletConfig`](../reference/configuration/kubernetes/kubeletconfig) document of the machine configuration with:

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeletConfig
extraArgs:
  feature-gates: GracefulNodeShutdown=false
config:
  shutdownGracePeriod: 0s
  shutdownGracePeriodCriticalPods: 0s
```

## Generating Talos Linux ISO image with custom kernel arguments

Pass additional kernel arguments using `--extra-kernel-arg` flag:


  \$ docker run --rm -i ghcr.io/siderolabs/imager:v1.15.0-beta.0 iso --arch amd64 --tar-to-stdout --extra-kernel-arg console=ttyS1 --extra-kernel-arg console=tty0 | tar xz
  2022/05/25 13:18:47 copying /usr/install/amd64/vmlinuz to /mnt/boot/vmlinuz
  2022/05/25 13:18:47 copying /usr/install/amd64/initramfs.xz to /mnt/boot/initramfs.xz
  2022/05/25 13:18:47 creating grub.cfg
  2022/05/25 13:18:47 creating ISO
  

ISO will be output to the file `talos-<arch>.iso` in the current directory.

## Logging Kubernetes audit logs with loki

If using loki-stack helm chart to gather logs from the Kubernetes cluster, you can use the helm values to configure loki-stack to log Kubernetes API server audit logs:

```yaml theme={null}
promtail:
  extraArgs:
    - -config.expand-env
  # this is required so that the promtail process can read the kube-apiserver audit logs written as `nobody` user
  containerSecurityContext:
    capabilities:
      add:
        - DAC_READ_SEARCH
  extraVolumes:
    - name: audit-logs
      hostPath:
        path: /var/log/audit/kube
  extraVolumeMounts:
    - name: audit-logs
      mountPath: /var/log/audit/kube
      readOnly: true
  config:
    snippets:
      extraScrapeConfigs: |
        - job_name: auditlogs
          static_configs:
            - targets:
                - localhost
              labels:
                job: auditlogs
                host: ${HOSTNAME}
                __path__: /var/log/audit/kube/*.log
```

## Setting CPU scaling governor

While its possible to set [CPU scaling governor](https://kernelnewbies.org/Linux_5.9#CPU_Frequency_scaling) via the [`SysfsConfig`](../reference/configuration/runtime/sysfsconfig) document, it's sometimes cumbersome to set it for all CPU's individually.
A more elegant approach would be set it via a kernel commandline parameter.
This also means that the options are applied way early in the boot process.

Bake the argument into the boot asset and the installer image with an [Image Factory](https://docs.siderolabs.com/talos/v1.15/learn-more/image-factory.md) schematic instead:

```yaml theme={null}
customization:
  extraKernelArgs:
    - cpufreq.default_governor=performance
```

> Note: the node needs to be upgraded to (or installed from) an image built with this schematic for the argument to take effect.

## Disable `admissionControl` on control plane nodes

Talos Linux enables admission control in the API Server by default.

Each admission control plugin is configured with its own [`KubeAdmissionControlConfig`](../reference/configuration/kubernetes/kubeadmissioncontrolconfig) document, so removing the plugin means removing the document.

Although it is not recommended from a security point of view, the default `PodSecurity` plugin can be removed by patching your control plane machine configuration with:

```yaml theme={null}
# no-pod-security.yaml
apiVersion: v1alpha1
kind: KubeAdmissionControlConfig
name: PodSecurity
$patch: delete
```

```bash theme={null}
talosctl gen config \
    my-cluster https://mycluster.local:6443 \
    --config-patch-control-plane @no-pod-security.yaml
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.