{"id":4805,"date":"2025-04-16T21:15:44","date_gmt":"2025-04-17T01:15:44","guid":{"rendered":"https:\/\/dft.wiki\/?p=4805"},"modified":"2026-06-08T09:49:54","modified_gmt":"2026-06-08T13:49:54","slug":"talos-linux-a-kubernetes-appliance","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=4805","title":{"rendered":"Talos Linux, a Kubernetes Appliance"},"content":{"rendered":"

Talos Linux is Linux designed to be secure, immutable, and minimal [Link<\/strong>]. Its only purpose is to be a Kubernetes appliance that can be installed on bare metal or virtual environments [Link<\/a>].<\/p>\n

Talos is production-ready, capable of running large clusters while simplifying deployment and management via an API with no shell or console access. It is completely locked down!<\/p>\n

The latest ISO is 100 MB, and upgrades are atomic since it is an immutable image-based distro.<\/p>\n

\n

PREREQUISITES<\/strong><\/p>\n

Easy install on Ubuntu:<\/p>\n

sudo snap install kubectl --classic\r\ncurl -sL https:\/\/talos.dev\/install | sh<\/pre>\n
Both kubectl<\/code> and talosctl<\/code> are binaries that can also be manually downloaded and executed directly.<\/p>\n
\n
INSTANCES DEPLOYMENT<\/strong><\/p>\n
Download the ISO, boot instances with it, and allocate a few IPs in the DHCP server to the cluster.<\/p>\n
\"\"
\n\"\"
\n\"\"
\n\"\"<\/p>\n
\n
INSTALLATION<\/strong><\/p>\n
For simplicity, this post uses 1 Control<\/strong> node (production environments require at least three) and 3 Worker<\/strong> nodes.<\/p>\n
Set the environment variables.<\/p>\n
export CLUSTER_NAME=k8s<\/strong>\r\nexport CONTROL=192.168.1.210\r\n<\/strong>export WORKER1=192.168.1.211\r\n<\/strong>export WORKER2=192.168.1.212\r\n<\/strong>export WORKER3=192.168.1.213<\/strong><\/pre>\n
Generate the machine configurations for the cluster (three files will be created locally).<\/p>\n
talosctl gen config $CLUSTER_NAME https:\/\/$CONTROL:6443<\/pre>\n
Apply the configuration to the Control and Worker nodes.<\/p>\n
talosctl apply-config --insecure -n $CONTROL --file controlplane.yaml\r\ntalosctl apply-config --insecure -n $WORKER1 --file worker.yaml \r\ntalosctl apply-config --insecure -n $WORKER2 --file worker.yaml \r\ntalosctl apply-config --insecure -n $WORKER3 --file worker.yaml<\/pre>\n
\"\"<\/p>\n
Set the local context for talosctl<\/code> and bootstrap the cluster.<\/p>\n
export TALOSCONFIG=\"talosconfig\"\r\ntalosctl config endpoint $CONTROL\r\ntalosctl config node $CONTROL\r\ntalosctl bootstrap<\/pre>\n
\"\"<\/p>\n
Wait a minute, then test and download ~\/.kube\/config<\/code>.<\/p>\n
talosctl -e $CONTROL containers\r\ntalosctl -e $CONTROL kubeconfig\r\nchmod 600 ~\/.kube\/config<\/pre>\n
Test using kubectl<\/code>.<\/p>\n
kubectl get pods -A\r\nkubectl get nodes -A\r\nkubectl get services -A\r\nkubectl get ingress -A<\/pre>\n
Check health and real-time metrics.<\/p>\n
talosctl health\r\ntalosctl dashboard<\/pre>\n
Use F2<\/strong> and F1<\/strong> to switch between Monitor and Summary.<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\n
UPGRADING<\/strong><\/p>\n
Upgrade Talos.<\/p>\n
talosctl upgrade -n 192.168.1.210 --preserve --wait --debug --image ghcr.io\/siderolabs\/installer:v1.x.x<\/pre>\n
Note:<\/strong> the --preserve<\/code> flag should be used with a single Control node cluster. It prevents wiping ephemeral data since there is no other Control node to retain the cluster state.<\/p>\n
Upgrade Kubernetes.<\/p>\n
talosctl upgrade-k8s --to 1.y.y<\/pre>\n
Troubleshooting tools.<\/p>\n
talosctl netstat\r\ntalosctl dmesg\r\ntalosctl pcap\r\ntalosctl memory\r\ntalosctl processes<\/pre>\n
\n
BONUS<\/strong><\/p>\n
IncusOS<\/strong> is a similar purpose-built Linux appliance for running system containers (LXC) and virtual machines (KVM) on x64 or ARM hardware [Link<\/a>].<\/p>\n
It can be installed on local storage or run from a live USB stick [Link<\/a>]. See installation options for physical or virtualized deployments [Link<\/a>].<\/p>\n
Getting started requires creating a TLS client certificate for the initial trusted client.<\/p>\n
sudo apt install incus-client -y\r\nincus remote generate-certificate\r\ncd ~\/.config\/incus\/\r\ncat client.crt<\/pre>\n
Then insert it into the media download wizard to embed it in the image.<\/p>\n
\n
OTHER POSTS<\/strong><\/p>\n
MicroK8S<\/strong> on Ubuntu [Link<\/a>].<\/p>\n
Minikube<\/strong> on Ubuntu [Link<\/a>].<\/p>\n
K3s<\/strong> on Ubuntu [Link<\/a>].<\/p>\n
K8s<\/strong> Persistent Volumes [Link<\/a>].<\/p>\n
K8s<\/strong> Cheat Sheet [Link<\/a>].<\/p>\n
K8s<\/strong> Dashboard [Link<\/a>].<\/p>\n","protected":false},"excerpt":{"rendered":"
Talos Linux is Linux designed to be secure, immutable, and minimal [Link]. Its only purpose […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4805","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/4805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4805"}],"version-history":[{"count":7,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/4805\/revisions"}],"predecessor-version":[{"id":5610,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/4805\/revisions\/5610"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}