KUBICAST #186 - Talos Kubernetes

We welcomed Victor Carvalho for a straight-to-the-point chat about Talos Linux as a minimalist base for Kubernetes. Throughout the conversation, we broke down why a "Kubernetes-first" OS simplifies daily platform operations, the real security gains of an immutable, API-driven system, and how to set up a provisioning and upgrade pipeline without opening unnecessary ports on the cluster.

Why Talos?

Talos is Linux reduced to the essentials for running Kubernetes. No extra packages or user utilities — the goal is to reduce the attack surface and standardize cluster operation. Instead of accessing nodes via SSH, we control everything through its own API, with authentication, RBAC, and an auditable workflow. This enforces best practices and eliminates the typical "drift" of servers that receive manual commands over time.

“Without SSH and with a dedicated API, we gain predictability and security when operating Kubernetes.”

Security: from disk to supply chain

• Disk encryption: keys via TPM or integrated with an external KMS, reducing the risk of unauthorized physical access.

• Immutability: read-only root system; changes are declarative and reproducible.

• SBOM: software inventory available for inspection, helping with compliance and response to CVEs.

• Less surface area: because the userland is minimal, there are fewer binaries and services exposed.

API-first and painless operation

• Talos Factory: image building with embedded configuration — great for standardizing environments and accelerating bootstrap.

• Terraform: using the provider to define Talos VMs, networks, and parameters as code; fits well with Proxmox and other platforms.

• Omni: centralized management layer for Talos clusters (offered as a product), useful for those who need coordinated visibility and action.

• Backups and upgrades: focus on etcd (backup, restore, and certificate rotation) and API-controlled upgrades with less manual intervention.

• S3 Storage: ability to direct artifacts/backups to a well-configured S3-compatible backend (e.g., MinIO).

Lessons from the homelab for production

Starting in the homelab, the first pain points appear in certificates and connectivity. The good news is that, when migrating those learnings to production, the predictability gain pays off: standardized images, reproducible provisioning, and audit trails right from bootstrap. From there, it becomes simpler to introduce additional controls (policies, network segmentation, key rotation) without losing track.

Recommended path to get started

1. Define the target: choose the platform (bare metal, Proxmox, or cloud) and standardize the VMs/hosts.

2. Generate images in the Talos Factory with minimal settings (network, control-plane/endpoints, certificates).

3. Provision via Terraform: describe the desired state, including disk mapping, CPU/memory, and networks.

4. Bootstrap the cluster: initialize the control-plane, join the workers, and validate the health of the etcd.

5. Automate backups (etcd and config) to an S3-compatible backend (e.g., MinIO) and establish predictable upgrade windows.

6. Observability and policies: enable metrics/logs and security policies from day zero; avoid manual adjustments on the nodes.

Questions we answered in the episode

• Is Talos for everyone or does it make more sense for platform teams?

• How to operate without SSH in daily tasks and what changes in troubleshooting?

• Is it worth investing in Omni right now or sticking with API/CLI and automation?

• What are the precautions to take regarding certificates, endpoints, and etcd backup?

• How to fit Terraform and Proxmox into a declarative infrastructure workflow?

Important Links:

- Victor Cardoso - https://www.linkedin.com/in/victorbmcarvalho/

- João Brito - https://www.linkedin.com/in/juniorjbn/

- Official Talos Linux Site - https://talos.dev

- Watch the Movie TEArapia - https://youtu.be/M4QFmW_HZh0?si=HIXBDWZJ8yPbpflM

🎧 Listen also to Kubicast on Spotify, and share it with everyone who is upgrading Oracle Linux at this very moment :D