```
$ talosctl gen secrets -o talos/$cluster-secrets.yaml
$ ansible-vault encrypt talos/$cluster-secrets.yaml
```