Skip to content

Why Talos Linux

Talos Linux is a Linux distribution built for one job: running Kubernetes. There is no shell, no SSH, no package manager and no writable root filesystem. The whole machine is described by a single machine configuration and managed over a gRPC API with talosctl, the same way you manage Kubernetes itself with kubectl.

taloscluster is a small tool that turns a cluster.yaml into a Talos cluster on OpenStack or Proxmox. If you want a supported product for managing many clusters, with a UI, access control and hosted or self-hosted control plane, use Sidero's Omni instead. taloscluster is for the case where you want the same Talos benefits on your own cloud with nothing but a git repo and a CLI.

Small attack surface

Talos ships only what Kubernetes needs: the kernel, containerd, kubelet and a handful of Go services. Because there is no shell or SSH daemon there is nothing to log in to, and the API only accepts mutual TLS with the cluster's own certificates. The root filesystem is read-only and squashfs, the image is signed, and every setting lives in the machine configuration rather than in files someone edited on the host. Anything extra, such as a GPU driver or the guest agent, is added as a signed system extension baked into the image. See the Talos security philosophy for the full argument.

taloscluster narrows the surface further. The security allowlists configure the selected provider's firewall (the OpenStack security group or the Proxmox per-VM firewall) and the per-node Talos ingress firewall. TCP ports 80 and 443 are open by default until claimed by a rule; intra-cluster traffic and required protocol exceptions are also allowed. API allowlists restrict other sources. On Proxmox, the operator must enable the datacenter firewall for the provider rules to take effect. The machines can also live on a private network with no public address at all, reachable for management only through tailscale, a WireGuard-based VPN mesh, while the API VIP and the ingress addresses stay the only things exposed. Day 0 walks through the address and port choices.

Upgrades are boring

An OS upgrade in Talos is talosctl upgrade to a new image: the node pulls it, switches the A/B boot partition, reboots, and rolls back on its own if the new system does not come up. A Kubernetes upgrade is talosctl upgrade-k8s, which walks the control plane and kubelets through the new version. Draining and restarting nodes can interrupt workloads; availability depends on replicas, disruption budgets, and spare capacity.

With taloscluster both are a one-line edit. Bump talos.version or kubernetes.version in cluster.yaml, run taloscluster converge, and existing nodes are upgraded one at a time before any new ones are added. Kubernetes moves one minor at a time and Talos goes first when both change. Talos publishes a support matrix of which Kubernetes versions each release supports.

Read more