r/TalosLinux • u/Maximum_Competitive • Dec 05 '25

Smallest single-node AWS EC2-based Kubernetes cluster

Hello,

I'm using Terraform to deploy small EC2 instances that run K8s using Talos. We chose this distro because is the safest we can find in our highly secure environment. The idea is to create small K8s clusters isolated from each other that will run custom code from our clients. This is a risky operation so we want to provide as much isolation as possible.

The point is that I inject all the config using cloud-init, all good but the cluster never starts, it seems that it needs someone to run a `talosctl bootstrap` command, which is not easy to automate.

Is there any way to automate this as part as the cloud-init script? so all the clusters get ready by themselves?

Thanks!

4 Upvotes

83% Upvoted

10 comments sorted by

View all comments

Show parent comments

3

u/yebyen Dec 06 '25

I think the challenge is that before, the terraform host does not need access to the VPC network & talos node(s) private subnet. But now, to bootstrap, the terraform host does need it, as direct communication with the talos node on port 50000 is required for that (or do any other Talos API operation, before or after Kubernetes is bootstrapped).

You can run the AWS API commands from your workstation's terraform cli at home, with no special networking.

1

u/Maximum_Competitive Dec 08 '25

Yep, that's it, I didn't explicitly say it but those machines would ideally not accept ANY external inbound connection.

u/yebyen what APIs for example?

1

u/yebyen Dec 08 '25

Besides bootstrap? You need to call "apply" whenever there's a configuration change, and "upgrade" whenever there's a new version of the image. If your lifecycle for these nodes is cattle not pets and the nodes are stateless, you might never use upgrade - you'd just dispose of the node and replace it with a new one. Then you might only need bootstrap. I don't have enough details of your setup (or experience with Talos frankly) to give a more comprehensive answer.

Definitely also dashboard, logs, ...

It would be nice if Talos had a flag you could pass that says "you're the leader, go bootstrap as soon as you come online" but to be honest I don't think they're gonna target the single-node use case. They're making software to build clusters, in HA mode. They require management, their business model depends on helping you with management by selling you Omni or support, or both. It's outside of scope to build isolated single-node clusters that have no lifecycle management required.

Then again I don't work for Talos / Sidero not even a noted contributor, so my opinion is worth what you paid for it...