siderolabs/talos
Talos
Talos is a minimal, immutable Linux distribution designed specifically for deploying and managing Kubernetes clusters. It functions as an API-driven infrastructure manager that replaces traditional shell access with a declarative gRPC interface to control operating system state and configuration.
The system is distinguished by its use of a read-only root filesystem and a security-hardened kernel, which removes standard GNU utilities to reduce the attack surface. It ensures environment consistency by distributing the operating system as versioned, signed images and utilizes TPM-backed verified boot and mutual TLS for secure administrative communication.
Broad capabilities include the automated provisioning of clusters across bare metal, virtual machines, and cloud platforms. The project covers container runtime management, virtual machine execution and migration, distributed key-value storage for cluster quorum, and comprehensive network orchestration including mesh VPNs and VLAN tagging.
Administrative operations are performed programmatically through a unified interface that handles boot asset generation, atomic system updates, and hardware-backed security bootstrapping.
Features
- OS Management APIs - Provides a dedicated gRPC API for full operating system management, removing the need for traditional shell access.
- Declarative Configuration Management - Defines the entire operating system and cluster state using a single declarative YAML manifest.
- Kubernetes Cluster Management - Provides a minimal, immutable Linux environment specifically designed for provisioning and maintaining Kubernetes clusters.
- Linux Security Hardening - Ships a security-hardened Linux kernel configured to minimize the system attack surface for Kubernetes deployments.
- Layered Defense Strategies - Employs a layered defense strategy using build-time configurations and boot parameters to minimize vulnerabilities.
- Distributed Key-Value Stores - Implements a distributed key-value store with membership and quorum logic to ensure state integrity across control plane nodes.
- Infrastructure State Controllers - Uses a resource-controller pattern to capture and update system state in response to environmental changes.
- Operating System Deployment Tools - Performs critical node operations including bootstrapping, rebooting, shutting down, and resetting the operating system.
- API-Driven Infrastructure Managers - Functions as a declarative system managing host configuration and cluster state through a remote gRPC API.
- API Infrastructure Orchestration - Manages operating system and infrastructure state through a remote API to eliminate configuration drift.
- Cluster Node Management - Controls node-level operating system configurations and cluster membership via a dedicated management interface.
- Capacity Scaling - Provides automated scaling of control plane and worker nodes via machine configuration files.
- Containerized Service Runtimes - Uses a standardized container runtime to launch and isolate system services into distinct namespaces.
- Workload Scheduling and Scaling - Schedules and runs containerized applications across the cluster and exposes them via network ports.
- Container Runtime Managers - Manages the lifecycle, images, and log streaming of container runtimes via a declarative gRPC API.
- High Availability Clusters - Ensures continuous API service availability by distributing the server across multiple nodes using load balancers.
- Immutable Infrastructure - Operates a read-only Linux environment to eliminate configuration drift and reduce the system attack surface.
- Production Cluster Deployers - Provisions a minimal, immutable Linux environment to run a production-grade cluster using an API-driven approach.
- Bare Metal Orchestration - Bootstraps and manages physical servers and virtual machines using declarative manifests and automated image distribution.
- Kubernetes-Specific Distributions - Provides a minimal immutable Linux distribution designed specifically for deploying and managing Kubernetes clusters via a gRPC API.
- Managed Cluster Orchestration - Orchestrates the operational state and scaling of distributed clusters through a centralized management interface.
- Distributed Cluster Provisioners - Automates the deployment of Kubernetes clusters across diverse infrastructure including physical hardware and cloud platforms.
- Node State Configurations - Updates nodes with new configurations to define their operational state and system settings programmatically.
- Programmatic Infrastructure Lifecycles - Performs programmatic installations and upgrades through a unified interface that handles boot assets.
- System Image Generators - Builds tailored boot images with specific architectures and extensions for hardware compatibility.
- Cluster Network Orchestration - Configures cluster-wide network settings, including node IP subnets and advertised addresses.
- Network Configuration - Provides API-driven management of IP addresses, routing, and DNS resolvers to ensure a consistent network state.
- Overlay Networks - Establishes a secure point-to-point IPv6 overlay network for administrative management without requiring direct public IP access.
- VPN Controllers - Automates the orchestration of encrypted tunnels to connect distributed nodes into a private mesh overlay.
- Atomic System Updates - Applies system updates as single, indivisible operations to ensure consistency across the cluster fleet.
- Immutable Operating Systems - Provides a read-only operating system that eliminates configuration drift by distributing the system as a single versioned image.
- TPM-Backed Measured Boot - Utilizes TPM-backed storage and SecureBoot to verify that the boot image has not been tampered with.
- Immutable Image Distribution - Distributes the operating system as a single, versioned image to eliminate configuration drift across nodes.
- Base Image Distributions - Deploys the operating system as a signed, read-only image to prevent configuration drift and harden security.
- API Access Security - Requires mutual TLS and gRPC communication via load balancers to secure access to the node system API.
- Mutual TLS Authentication - Enforces mutual TLS authentication for all administrative API interactions to harden system security.
- API Security Management - Secures the management interface by rotating certificates and restricting access to sensitive configuration files.
- Configuration Encryption - Encrypts sensitive machine configuration data and certificates to prevent unauthorized access to system secrets.
- API Access Restrictions - Protects the initial boot process by restricting maintenance API access via user-data or firewall rules.
- Orchestration Admission Controllers - Intercepts and validates API requests against authorization rules before they are persisted to the system state.
- Network Encryption - Secures all network traffic using rotating certificates and key-based authentication for administrative communication.
- Private Network Security - Isolates the maintenance API within a private overlay network to protect sensitive system resources.
- Role-Based Access Control - Assigns permission levels to users via certificate fields to restrict which API methods they can execute.
- Container Privilege Restrictions - Reduces the host attack surface by blocking processes from performing critical actions like loading kernel modules.
- Read-Only Filesystem Enforcement - Provides read-only access to exposed filesystem paths to eliminate configuration drift and reduce attack surface.
- Trust Verification Daemons - Implements a dedicated daemon to verify the trust relationships required to operate a secure cluster.
- YAML Configuration Files - Uses YAML-formatted files to define the entire system state and prevent configuration drift.
- Initial Boot Configurations - Injects machine configuration and authentication files via the boot command line for initial setup.
- Declarative Configuration Systems - Implements a gRPC-based declarative system for managing host and cluster configuration without manual file editing.
- Cluster Bootstrapping Mechanisms - Initiates the initial setup of the cluster by triggering a control plane node to start.
- Resource-Based State Machines - Implements a resource-based state machine to apply desired system configurations through internal controllers.
- System Configuration Management - Automates and enforces consistent system-wide and cluster-level configuration settings through an API.
- Cluster Initialization - Initializes a single-node cluster and restores data from snapshots to enable other nodes to join.
- Disk Image Imports - Loads virtual disk images in qcow2, raw, or iso formats from remote sources or uploads.
- Authenticated Access Configs - Creates authenticated configuration files with specific roles to grant administrative or user access to the cluster.
- Environment Bootstrapping - Initializes system configuration by passing files through cloud-init or user-data fields during instance creation.
- Kernel Module Loaders - Allows specifying which Linux kernel modules to load and defining their startup parameters via the system API.
- Security Module Management - Toggles between permissive and enforcing modes for system security modules using kernel parameters.
- Node Retirement - Cordon, drains, and erases local disks to permanently retire cluster hardware.
- Image Integrity Verification - Evaluates public key policies to verify or reject container images based on digital signatures.
- Container Management Systems - Runs core operating system components as isolated containerized workloads using a standardized runtime.
- Workload Scheduling - Allows user applications to run on management hardware by removing default control plane taints.
- Deployment Targets - Specifies the target cloud provider or hardware board to ensure the correct platform-specific drivers are loaded.
- Kernel Parameter Tuning - Passes specific parameters to the kernel during boot to configure system behavior and hardware scaling.
- High-Availability Request Routing - Provides cluster-aware request routing and load balancing to ensure high availability of the system API across multiple nodes.
- Air-Gapped Deployments - Runs the management layer locally to maintain data sovereignty in environments without internet access.
- Kubeconfig Management Tools - Configures certificate lifetimes and parameters for the administrative kubeconfig used to manage the cluster.
- Bootstrap Manifests - Deploys additional configuration manifests via external URLs or inline content during the initial cluster setup.
- Remote Cluster Access - Enables administrative access to remote clusters by exporting necessary configuration and credentials to local files.
- Security Profiles - Assigns custom security profiles to restrict the system calls available to processes.
- Unified Multi-Platform Deployment - Runs on bare metal, virtual machines, and cloud providers using a unified set of tools.
- Host Resource Isolation Policies - Employs security policies to block workloads from accessing sensitive machine configurations or core system processes.
- Cluster Discovery Services - Runs a local instance of a node discovery mechanism to facilitate the bootstrapping of cluster members.
- Connection Management - Discovers and rotates IP and port pairs to maintain stable connectivity across diverse network environments.
- Runtime Network Updates - Modifies network machine configuration through the API to apply changes without restarting the system.
- CIDR Advertisement Filtering - Manages network settings and filters advertised CIDRs to control traffic routing between peers.
- Network Policy Enforcement - Provides a network plugin that enforces communication rules and policies to control traffic flow between pods.
- Peer Discovery - Identifies public keys and network addresses for WireGuard nodes using external discovery services.
- Subnet Routing - Directs traffic for pod networks across disparate network segments when standard container interfaces are insufficient.
- In-Cluster Traffic Steering - Uses kernel IP sets and packet marking to efficiently direct internal cluster traffic.
- Boot Configuration Injection - Injects machine configuration and authentication files directly via the boot command line or user-data fields.
- GPU Acceleration - Configures GPU support through a device interface to enable hardware acceleration for workloads.
- Secure Bootstrapping - Initializes system trust and connectivity using TPM-backed encryption, verified boot paths, and mutual TLS authentication.
- Disk Installers - Specifies installation disks and system images while managing disk wiping and BIOS boot settings.
- Minimalist Boot Processes - Executes a specialized init process that limits activity to only required services.
- Custom Image Builders - Creates custom OS installation images from raw disk snapshots to ensure specific versioning.
- Boot Asset Mirrors - Serves customized OS images and installer assets via HTTP, PXE, or container registries for reliable booting.
- Boot Image Generation - Produces boot images and ISOs tailored with specific extensions and kernel arguments for various architectures.
- Partition Managers - Creates system partitions during installation and automatically expands ephemeral storage to occupy available space.
- System Recovery Tools - Controls reboot behavior after kernel panics and triggers full disk wipes to restore system functionality.
- Virtual Machines - Executes virtual machines alongside containerized workloads using an integrated hypervisor.
- Live Migrations - Moves running virtual machines between nodes without downtime to balance workloads.
- Attack Surface Analysis - Reduces the system attack surface by removing shells and GNU utilities from the OS image.
- Certificate Renewal Managers - Automatically manages and renews certificates for API components to ensure continuous secure communication.
- Encrypted Persistence - Protects data on local disks through TPM-backed encryption and verified boot paths.
- Cloud Credential Providers - Integrates with external OIDC providers to inject temporary cloud credentials into running pods.
- Identity Provider Integrations - Centralizes authentication by integrating cluster and system APIs with enterprise identity providers.
- Network Access Restrictions - Enforces outbound network restrictions by whitelisting specific external domains to ensure communication only with trusted sources.
- Reproducible Build Systems - Verifies build integrity by rebuilding system components from source to ensure binaries match official releases.
- Certificate Trust Managers - Manages the system trust store by appending custom certificate authorities to establish trust with external services.
- Traffic Filtering - Implements an ingress firewall at the OS layer to restrict incoming traffic and reduce the system attack surface.
- Service Initialization - Configures core control plane services and resource limits to initialize the environment before deploying workloads.
- User Namespace Mappings - Translates container user and group IDs to specific host identifiers to manage system-level permissions.
- Infrastructure and Runtime Adapters - Provides compatibility layers and configuration handlers that adapt the system for specific cloud and hardware deployment environments.
- System Configuration Schemas - Defines content-addressable schemas to standardize system extensions across different image models.
- Automated Certificate Rotation - Provides automated lifecycle management for root certificate authorities to recover from key compromises.
- Kernel Updaters - Applies kernel security patches and container runtime updates through a regular release cycle.
- Cluster Provisioning - Minimal, immutable OS designed specifically for Kubernetes.
- Infraestructura y contenedores - Modern Linux distribution built for Kubernetes.
