```
$ talosctl gen secrets -o talos/secrets.yaml
$ ansible-vault encrypt talos/secrets.yaml
```