stackconf 2024 | Talos Linux One (Immutable) OS to Rule Them All by Pip Oomen.pdf

Talos Linux is Linux designed for Kubernetes – secure, immutable, and minimal. It is based on a hardened kernel and a minimal user space, ie. no SSH, shell or console. All system management is done via a gRPC API. In this presentation the audience will be introduced to Talos Linux and be shown how to get a full-blown Kubernetes cluster up and running within minutes on a Cloud Platform, as well as on a developer workstation.

1. Emerging container technologies
Talos Linux
one (immutable) OS to rule them all
Pip Oomen
Platform engineer
Kubestronaut (KCNA/KCSA/CKA/CKAD/CKS)

2. Building the Nordic digital society

3. What is Talos Linux?
Talos is built for running Kubernetes
●Minimal
●Immutable
●Secure
●gRPC API w/ mTLS

4. Designed for Kubernetes
●Do one thing, and do it very, very well
●There is only the cluster
●Self-healing
●Replace misbehaving parts
●Noflake (né cattle) computing FTW

5. Not based on X distro
●Not Yet Another Linux Distribution (YALD)
●2nd generation container optimised OS
●Userspace rewrite from scratch in GoLang
●Published as a signed and versioned image
●machined replaces systemd (PID 1)

6. Minimal
●Built from scratch
●No shell
●No SSH
●No GNU utilities
●Only 80MB, 12 executables (as of v1.7.0)!

7. Immutable
●Runs from SquashFS
●Image delivery through single and versioned files
●Reproducible builds
●Highly controlled write points

8. Secure
●Signed images
●No passwords
●Encrypted and authenticated networking
●Short lived certificates
●Enforced Kubernetes PKI

9. Ephemeral
●Read only
●Replicated
●Reconstructable

10. Declarative
●No scripting
●No procedural steps
●No imperative configuration

11. Distributed
●High available dataplane
●Ad-hoc etcd cluster (w/o sacrificing security)
●Workloads intended to be distributed
●Preventing SPoFs

12. Where to run Talos Linux?
●Bare metal
●Virtualised
●Cloud
●Local
●Single board

13. Demo
Creating clusters
●Cloud cluster on OpenStack
●Local cluster on Podman

14. Configuration
% talosctl gen secrets
% talosctl gen config openstack
> https://k8s.talos.rlnc.eu:6443 --with-secrets secrets.yaml
% ls -1 *.yaml
controlplane.yaml
secrets.yaml
worker.yaml

15. Virtual machines
% openstack server create controlplane-0
> --flavor gXcd.small --image talos-1.6.6 --user-data controlplane.yaml
% openstack server create worker-0
> --flavor gXcd.small --image talos-1.6.6 --user-data worker.yaml

16. Demo

17. Links
●Homepage: www.talos.dev
●GitHub: github.com/siderolabs/talos
●Documentation: www.talos.dev/v1.7
●Slack: https://slack.dev.talos-systems.io/
●www.siderolabs.com