---
title: "Talos"
description: "Run simplyblock on Talos Linux: required kernel modules, huge pages, CPU topology, privileged namespace, and the Talos environment setting."
source: "https://docs.simplyblock.io/latest/kubernetes/installation/talos/"
---

# Talos

[Talos Linux](https://www.talos.dev/){:target="_blank" rel="noopener"} is a minimal Linux distribution optimized for Kubernetes. Built as an immutable
distribution image, it provides a minimal attack surface but requires some changes to the image to run simplyblock.

Simplyblock requires a set of additional Linux kernel modules, as well as tools being available in the Talos image.
That means that a custom Talos image has to be built to run simplyblock. The following section explains the required
changes to make Talos compliant.

## Required Kernel Modules (Worker Node)

On Kubernetes worker nodes, simplyblock requires a few kernel modules to be loaded.

```yaml title="Content of kernel-module-config.yaml"
machine:
  kernel:
    modules:
      - name: nbd
      - name: uio_pci_generic
      - name: vfio_pci
      - name: vfio_iommu_type1
```

## Huge Pages Reservations

Simplyblock requires huge pages memory to operate. The storage engine expects to find huge pages of 2 MiB page size. The
required amount of huge pages depends on a number of factors.

After [installing the Simplyblock Operator](k8s-control-plane.md) and waiting for the control plane to become
`Available`, the required huge pages can be calculated from the `simplyblock-admin-control` pod of the control plane.

Run the following command on the admin control pod to calculate the huge pages required on the host:

```bash title="Run the huge memory calculator"
sbctl storage-node configure \
  --calculate-hp-only \
  --number-of-devices <NUMBER_OF_DEVICES>
```

The following flags also affect the huge page calculation:

- `--nodes-per-socket (default: 1)`
- `--sockets-to-use (default: 0)`

The maximum number of subsystems and the vCPU count are cluster-level settings (`maxSubsystemCount` and `vcpuCount`
of the `StorageCluster`), which the host does not know before it joins the cluster. The calculator therefore sizes
the host for the maximum of 75 subsystems and its default core layout, so the result is enough for any cluster
setting.

```plain title="Example output of huge pages calculator"
[demo@demo ~]# sbctl storage-node configure \
  --calculate-hp-only --number-of-devices 4
INFO: The required number of huge pages on this host is: <NUMBER_OF_PAGES> (<SIZE> MB)
True
```

To apply the change to Talos' worker nodes, a YAML configuration file with the following content is required. The number
of pages is to be replaced with the number calculated above.

```yaml title="Content of huge-pages-config.yaml"
machine:
  sysctls:
     vm.nr_hugepages: "<number-of-pages>"
```

To activate the huge pages, the `talosctl` command should be used.

```bash title="Enable Huge Pages in Talos"
[demo@demo ~]# talosctl patch mc --nodes <WORKER_NODE_IP> \
    --path @huge-pages-config.yaml
[demo@demo ~]# talosctl reboot --nodes <WORKER_NODE_IP>
```

## Configuring CPU Topology

To ensure highest performance, simplyblock requires the Kubernetes kubelet on Talos to be configured to use a static
CPU manager and to use a single NUMA node topology manager.

Because Talos has no writable kubelet configuration, the storage nodes do not configure the kubelet themselves on
Talos, and the configuration has to be applied through the Talos machine configuration.

```yaml title="Content of enable-cpu-topology.yaml"
machine:
  kubelet:
    extraArgs:
      cpu-manager-policy: static
      cpu-manager-reconcile-period: "5s"
      topology-manager-policy: "single-numa-node"
      topology-manager-scope: "pod"
```

To activate the CPU topology configuration, the `talosctl` command should be used.

```bash title="Enable CPU Topology Manager"
[demo@demo ~]# talosctl patch mc --nodes <WORKER_NODE_IP> \
    --path @enable-cpu-topology.yaml
[demo@demo ~]# talosctl reboot --nodes <WORKER_NODE_IP>
```

## Required Talos Permissions

Simplyblock's CSI driver requires connecting NVMe over Fabrics devices, as well as mounting and formatting them.
Therefore, the CSI driver has to run as a privileged container. Hence, Talos must be configured to start the
simplyblock's CSI driver in privileged mode.

Talos allows overriding the pod security admission settings at a Kubernetes namespace level. To enable privileged mode
and grant the required access to the simplyblock CSI driver, a specific simplyblock namespace with the appropriate
security exemptions must be created:

```yaml title="Content of simplyblock-namespace.yaml"
apiVersion: v1
kind: Namespace
metadata:
  name: simplyblock
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: privileged
    pod-security.kubernetes.io/warn-version: latest
```

To enable the required permissions, apply the namespace configuration using `kubectl`.

```bash title="Enabled privileged mode for simplyblock"
[demo@demo ~]# kubectl apply -f simplyblock-namespace.yaml
```

The namespace is created before the operator is installed. Otherwise, the Helm chart creates an unlabeled namespace of
its own, and the exemptions never take effect.

## Talos Environment

The `ClusterDeploymentConfig` that describes the storage cluster must name the environment `Talos`. Discovery writes
the detected distribution into the draft, but it should be checked during the review:

```yaml title="ClusterDeploymentConfig for Talos (excerpt)"
apiVersion: storage.simplyblock.io/v1alpha2
kind: ClusterDeploymentConfig
metadata:
  name: simplyblock-deployment
  namespace: simplyblock
spec:
  approved: false
  environment: Talos
  cluster:
    name: simplyblock-cluster
    maxSubsystemCount: 50
    vcpuCount: 8
  nodeSets:
    - name: storage
      groups:
        - name: default
          workers: [worker-1, worker-2, worker-3]
          devices:
            nvme: ["0000:01:00.0", "0000:02:00.0"]
```

With `environment: Talos`, the expansion sets `enableKubeletConfiguration: false` on
`StorageCluster.spec.storageNodes`, so the storage nodes rely on the kubelet configuration applied above.

## Installation of Simplyblock

To install the simplyblock components on Talos, follow the instructions to
[install the Simplyblock Operator](k8s-control-plane.md) and to [create a storage cluster](k8s-storage-plane.md).