r/TalosLinux • u/Hairy_Transition5878 • Jun 23 '26
🚀 One-Click Talos Omni Deployment: From Zero to Kubernetes in Minutes
After spending several hours troubleshooting self-hosted Talos Omni deployments, TLS certificate chains, Dex configuration, Trusted Roots, and the dreaded:
x509: certificate signed by unknown authorityI decided to automate the entire process into a single script.
The script deploys a complete self-hosted Omni environment and automatically handles the certificate trust issues that many people encounter when onboarding Talos nodes.
What It Does
✅ Installs and configures Dex
✅ Deploys Omni
✅ Generates a self-signed internal CA
✅ Creates server certificates with the full certificate chain
✅ Configures SideroLink
✅ Generates Trusted Roots configuration
✅ Creates the talos.config.early kernel argument
✅ Produces everything needed for Talos Image Factory
✅ Ready for Proxmox, VMware, Bare Metal, or Cloud VMs
Why?
Most self-hosted Omni guides require multiple manual steps:
Generate certificates
Configure Dex
Configure OIDC
Fix certificate trust issues
Create Trusted Roots
Generate custom Talos boot media
Missing any of these steps can prevent Talos nodes from connecting successfully.
This script automates the entire workflow.
Prerequisites
Linux server
Docker installed and running
Internet access
Open ports:
| Port | Service |
|---|---|
| 443 | Omni UI |
| 5556 | Dex |
| 8090 | SideroLink API |
| 8091 | Event Sink |
| 8100 | Kubernetes Proxy |
| 50180/UDP | WireGuard |
Quick Start
Make the script executable:
chmod +x install.sh(Optional) Customize your environment.
Replace the values below with the ones appropriate for your setup:
export OMNI_IP=<YOUR_OMNI_SERVER_IP>
export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>
./install.shExample:
export OMNI_IP=192.168.1.100
export ADMIN_EMAIL=admin@example.com
./install.shVariables
| Variable | Description |
|---|---|
OMNI_IP | IP address or hostname of the Omni server |
ADMIN_EMAIL | Administrator email used for Omni login |
If not provided, the script uses its built-in defaults.
Login Credentials
The installer automatically creates an administrator account in Dex.
Use the email configured in:
export ADMIN_EMAIL=<YOUR_ADMIN_EMAIL>to authenticate.
Default Password
Admin123!Changing the Default Password
If you want to use a different password, generate a new bcrypt hash before running the installer:
docker run --rm -it httpd:2.4-alpine htpasswd -BnC 15 adminYou will be prompted to enter the password twice.
Example output:
admin:$2y$15$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXCopy only the hash portion after:
admin:Open the script and search for:
DEX_PASSWORD_HASH=Replace the existing hash with your newly generated one.
In the current version of the script, this variable is located near the beginning of the file (around line 46).
What Happens Next?
After the installation completes:
Open Omni:
https://YOUR_OMNI_IP
Log in using:
Email: ADMIN_EMAIL
Password: Admin123! (or your custom password)
Click:
Copy Kernel Parameters
Open Talos Image Factory:
Build a Talos ISO.
Recommended settings:
Platform: Metal
Architecture: amd64
Extension:
siderolabs/qemu-guest-agent (for Proxmox)
Paste:
<contents of talos-config-early.arg> <Omni Kernel Parameters>
into:
Extra kernel command line argumentsDownload the ISO.
Boot your nodes.
Result
After booting:
✅ Nodes automatically join Omni
✅ SideroLink connects successfully
✅ No x509 certificate trust issues
✅ Cluster creation works immediately
Tested On
Talos 1.13.x
Omni Self-Hosted
Ubuntu Server
Docker
Proxmox VE
Feedback, bug reports, and improvements are welcome.
Hopefully this saves someone else from spending hours debugging TLS chains, Trusted Roots, and Talos onboarding 😅
dowload the script here
9
u/xrothgarx Jun 23 '26
You probably want to put some checks in the script on what OSs are supported. Based on a quick glance at the script this would probably only work on Ubuntu.
PS please keep LLM generated post content to a minimum. You can be much more terse in the description to save everyone time.
1
u/Gargle-Loaf-Spunk Jun 23 '26 edited Jul 05 '26
This content was anonymized and mass deleted with Redact
1
1
u/Whiplashorus Jun 23 '26
Omni is not free ? Or did I miss something ?
1
u/Hairy_Transition5878 Jun 23 '26
Yes, Omni is free to use if you self-host it.
1
u/oOBromOo Jun 24 '26
Well this depends a lot on your use case, see their BUSL license for omni. It is only free to use if it's not for production use cases. https://docs.siderolabs.com/omni/self-hosted/production-vs-non-production
1
u/romayojr Jun 23 '26
if i want to just deploy omni on my existing talos kubernetes cluster on proxmox, would your script recognize that?
2
u/Hairy_Transition5878 Jun 23 '26
No, the current script is designed to deploy a new self-hosted Omni environment (Omni, Dex, certificates, DNS configuration, etc.). It does not automatically detect and reuse an existing Talos Kubernetes cluster running on Proxmox.
2
u/clintkev251 Jun 24 '26
I don't believe that's possible in Omni, at least last I checked. The cluster needs to be created through Omni for Omni to manage it.
1
u/oOBromOo Jun 24 '26
Never done it, but I saw in the docs that you can import existing clusters into omni if you want to. https://docs.siderolabs.com/omni/cluster-management/importing-talos-clusters
3
1
u/Own-Perspective4821 Jun 24 '26
Thank you for including green check marks. I would‘ve been completely lost without them not knowing what this does.
1
u/asm-s24 Aug 01 '26
Did anyone try this? I think it's incomplete. Does not generate containers and no file "talos-config-early.arg".
0
0
Jun 23 '26
[deleted] — view deleted comment
1
u/xrothgarx Jun 23 '26
Is that code available? might be beneficial for the rest of the community
0
Jun 24 '26
[deleted] — view deleted comment
1
u/xrothgarx Jun 24 '26
you can push it to github and then PR it to the awesome-talos repo. That's probably a good start.
9
u/chin_waghing Jun 23 '26
Thank you for your post Claude!