talm

Talm

Manage Talos the GitOps Way!

Talm is just like Helm, but for Talos Linux

Features

While developing Talm, we aimed to achieve the following goals:

• Automatic Discovery: In a bare-metal environment, each server may vary slightly in aspects such as disks and network interfaces. Talm enables discovery of node information, which is then used to generate patches.

• Ease of Customization: You can customize templates to create your unique configuration based on your environment. The templates use the standard Go templates syntax, enhanced with widely-known Helm templating logic.

• GitOps Friendly: The patches generated do not contain sensitive data, allowing them to be stored in Git in an unencrypted, open format. For scenarios requiring complete configurations, the --full option allows the obtain a complete config that can be used for matchbox and other solutions.

• Simplicity of Use: You no longer need to pass connection options for each specific server; they are saved along with the templating results into a separate file. Per-node configuration sits in a single modeline-annotated nodes/<name>.yaml; the first -f file is the anchor and any subsequent -f files stack onto its rendered config as side-patches (see Applying with side-patches).

• Compatibility with talosctl: We strive to maintain compatibility with the upstream project in patches and configurations. The configurations you obtain can be used with the official tools like talosctl and Omni.

Installation

Homebrew

For macOS and Linux users, the recommended way to install talm is with Homebrew.

brew install talm

Binary

Download binary from Github releases page

Or use simple script to install it:

curl -sSL https://github.com/cozystack/talm/raw/refs/heads/main/hack/install.sh | sh -s

Windows

Windows is supported. Download the talm-windows-*.zip archive from the releases page and extract talm.exe. On Windows, template paths passed to the -t / --template flag accept either \ or / separators, so -t templates\controlplane.yaml and -t templates/controlplane.yaml are equivalent. Other path flags (--talosconfig, -f / --file) are delegated to the underlying OS file loader and follow standard Windows path rules.

Documentation

Full documentation lives at talm.cozystack.io.

• Quickstart — from an empty directory to a configured node.
• Initializing a project — --image, --cluster-endpoint, --root.
• Node files — the modeline, discovery comments, per-node overrides.
• Endpoints and VIPs — endpoint, floatingIP, vipLink.
• Talos versions and output format — which schema a render targets, and the version keys to pin.
• Templates and values — lookup, --set vs --set-string.
• Encryption — age-encrypted secrets and user values.
• Applying with side-patches — the -f chain.
• Apply-time safety gates — what apply and upgrade check.
• talosctl-compatible commands — what talm wraps and what it does not.
• Upgrading talm — keeping vendored charts in sync.
• CLI reference — commands and flags.

The site is built from docs/ in this repository; the CLI reference under docs/reference/ is generated from the command tree.

License

Apache-2.0, except for two files ported from siderolabs/talos, which is MPL-2.0: pkg/engine/talos_helpers.go and pkg/commands/talos_client.go carry Talos code that v1.14 stopped exporting, so they stay under MPL-2.0 and say so in their headers. MPL-2.0 section 3.3 covers distributing the combined work under Apache-2.0.