Install the following tools on your workstation:

• omnictl - Sidero Omni CLI
• helmfile - declarative Helm chart management
• helm - Kubernetes package manager
• kubectl - Kubernetes CLI
• sops - secrets encryption
• age - encryption tool used by SOPS
• task - task runner (optional, for automation)

Download a custom Talos ISO with required extensions:

omnictl download iso \
  --arch amd64 \
  --secureboot \
  --extensions amdgpu,amd-ucode,i915,intel-ice-firmware,intel-ucode,iscsi-tools,realtek-firmware \
  --extra-kernel-args -lockdown,lockdown=integrity,mitigations=off \
  --output /tmp/talos.iso

Boot all three nodes from this ISO. They will register with Omni automatically.

The cluster is defined in talos/homelab.yaml. This template configures:

• 3-node control plane (no dedicated workers, scheduling on control planes enabled)
• No built-in CNI (Cilium installed separately)
• kube-proxy disabled (Cilium replaces it)
• Static IPs for each node

omnictl cluster template sync -f talos/homelab.yaml

Wait for all nodes to join and become ready in Omni.

omnictl kubeconfig -c homelab

Verify the nodes are ready:

kubectl get nodes
NAME    STATUS     ROLES           AGE   VERSION
node1   NotReady   control-plane   1m    v1.35.0
node2   NotReady   control-plane   1m    v1.35.0
node3   NotReady   control-plane   1m    v1.35.0

Nodes will be NotReady until Cilium is installed.

helmfile installs components in order:

1. prometheus-operator-crds - CRDs needed by ServiceMonitors
2. cilium - CNI with kube-proxy replacement, Wireguard, Hubble
3. flux-operator - Flux lifecycle manager
4. flux-instance - Flux deployment pointing to this Git repository

helmfile --file talos/helmfile.yaml apply --skip-diff-on-install --suppress-diff

This will take a few minutes. After completion, nodes should become Ready:

kubectl get nodes
NAME    STATUS   ROLES           AGE   VERSION
node1   Ready    control-plane   5m    v1.35.0
node2   Ready    control-plane   5m    v1.35.0
node3   Ready    control-plane   5m    v1.35.0

Verify Cilium is healthy:

cilium status
    /¯¯\
 /¯¯\__/¯¯\    Cilium:             OK
 \__/¯¯\__/    Operator:           OK
 /¯¯\__/¯¯\    Envoy DaemonSet:    OK
 \__/¯¯\__/    Hubble Relay:       OK
    \__/       ClusterMesh:        disabled

Flux is now running but needs secrets to decrypt SOPS-encrypted values and access the Git repository.

Make sure your AGE key file is available:

export SOPS_AGE_KEY_FILE=~/AGE/sops-key.txt

Apply the SOPS decryption key:

kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=$SOPS_AGE_KEY_FILE

Apply cluster secrets and settings:

sops --decrypt cluster/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
kubectl apply -f cluster/flux/vars/cluster-settings.yaml

Flux will now start reconciling all resources from this repository. Monitor progress:

flux get kustomization

All kustomizations should eventually show Ready: True. The dependency chain ensures components are installed in the correct order (tns-csi -> databases -> applications).

If you have task installed, steps 1-4 can be run with a single command from the repo root:

task bootstrap

This runs: download-iso -> template-sync -> kubeconfig -> helmfile-apply

Step 5 (Flux secrets) can also be automated:

export SOPS_AGE_KEY_FILE=~/AGE/sops-key.txt
task flux:bootstrap

Generate a new AGE key (only needed once):

age-keygen -o sops-key.txt

Encrypt/decrypt the cluster secrets file:

# Decrypt (to edit)
sops cluster/flux/vars/cluster-secrets.sops.yaml

# The .sops.yaml file at the repo root defines encryption rules