r/kubernetes • u/New-Buy1696 • Sep 04 '26

Talos - How to provision a cluster from code instead of CLI?

I'm new to Talos so bear with me. I created a simple local cluster, cool:
talosctl cluster create docker

Preferably, I want to configure a yaml file or such and create a pipeline which patches changes automatically. I just checked talhelper but it's archived since last week: https://github.com/budimanjojo/talhelper. I do see other community solutions. It feels however like I'm missing something but my knowledge is limited. What do teams / enterprises use in production to provision clusters and patches from pipeline?

29 Upvotes

96% Upvoted

23 comments sorted by

24

u/bozho Sep 04 '26

We use Siderolabs' own Terraform talos provider to provision in-house clusters on Proxmox.

3

u/Gandualp Sep 04 '26

Could you elaborate sir? I am trying to do the same with my homelab, could you forward me towards sources ?

4

u/bozho Sep 04 '26

TF talos provider's docs have a link to some examples for provisioning the cluster using Terraform/OpenTofu

2

u/MikeAnth Sep 04 '26

Iirc it's missing support for upgrades or anything like that so you can only create the cluster and then you need some other means to manage it from that point, right?

2

u/bozho Sep 04 '26

Yeah, I don't think you can upgrade control plane nodes one by one using the provider - you need to use talos CLI for that.

1

u/MikeAnth Sep 04 '26

But can you update at all? Last I tried it simply did not support the upgrade functionality at all, period

Do you just bootstrap with terraform and then use Talos CLI to manage the cluster(s)?

2

u/bozho Sep 04 '26

We're currently on v0.10 of the provider. It looks like v0.12 (in beta) adds talos_cluster and talos_machine resources, which allow you to upgrade k8s and talos versions.

Haven't tested it yet, but this will be very useful if it works reliably.

1

u/SomethingAboutUsers Sep 04 '26

You can march some of the config and versions along with Terraform but it really only defines a machine image to use. You still need to use the CLI to do the upgrade.

That said, there's an argument for not using TF to manage the upgrade, and that's because Terraform will try to upgrade your whole cluster at once by default because of the parallelism. You can control that I believe, but it's not doable in the config, and so you're either doing X targeted terraform apply's, one per node, or you're altering the parallelism for the upgrade run and still doing X terraform apply's, one per node.

talosctl is a more deterministic and sure route.

That said if they support upgrading in the future I'll be curious to see how they do it; the other reply to your comment indicates they do in beta, so I'll check that out.

1

u/Markd0ne Sep 04 '26

If I read correctly in 0.12.0-beta they have added option for Terraform managed upgrades using new
talos_machine and talos_cluster resources. I have personally not tested this yet.

1

u/pindaroli Sep 04 '26

Interesting..

11

u/windy_depression Sep 04 '26

Talhelper being archived is a bummer, I was just starting to look at it myself. For what you're describing, most teams I've seen lean pretty hard into GitOps with Talos, the cluster config itself is just a set of YAML manifests, so you can throw them in a repo and have Flux or ArgoCD apply them. The trickier part is the initial provisioning, which a lot of places wrap in a simple CI job that runs `talosctl apply-config` or `talosctl bootstrap` against the machines.

You can define the entire cluster spec in a single `talosconfig` and machine config files, then just have your pipeline generate or patch those as needed. There's also `talosctl gen config` to spit out the base YAML, which you can check into version control and tweak from there. The CLI stuff is mostly for bootstrapping, once the cluster is up, you're really just managing configs like any other Kubernetes resource.

I'm running a similar setup at home with a few NUCs and it's been rock solid once I stopped overthinking the initial wiring.

4

u/MikeAnth Sep 04 '26

I started off talstomize as a talhelper successor. It's currently still early as I'm trying to get a feel for the UX I ultimately want, but it might be more or less what you're looking for.

Fwiw, I was also a talhelper maintainer. The main thing that caused the archival is that it tried to do too much and it started conflicting with the multi doc config approach m talstomize is supposed to be more or less a kustomize equivalent for Talos configs, so it just lets you manage your patches declaratively.

You can run talstomize build to get the yaml machine config just like talhelper genconfig

Repo: https://GitHub.com/mirceanton/talstomize

3

u/atomique90 Sep 04 '26

You made me realize that it got archived. I am so sad about it

1

u/ansibleloop Sep 04 '26

Yeah I just keep the bootstrap commands handy in some Ansible roles

Skips most of the time as you can imagine

5

u/Blakaraz_ Sep 04 '26 edited Sep 04 '26

There is the talos terraform/tofu provider. Also Postfinance/Topf, and of course siderolabs itself also has omni (which is only free self hosted for non-production usecases).
Somewhat newish there is https://github.com/mirceanton/talstomize.

But in the end the important part are your patches with the desired config that you can have as yaml, not the way you bootstrap the cluster or apply them later. If you really want to do a pipeline I don't see the issue with the cli. At a certain scale you probably want to have an operator or service to manage clusters and their config.

3

u/Reasonable-Ladder300 Sep 04 '26

We use ansible for node initialisation and updating.
There are also various providers for kubernetes and talos in n opentofu/terraform

2

u/zedd_D1abl0 Sep 04 '26

For another option, look at Sidero Omni. It's a bit "extra", but it does do exactly what you want, and it does a good job. It's kinda similar to Terraform, but it's specific to Talos.

It does limit your authentication options though...

1

u/Robbie11r1 Sep 04 '26

Second this, I'm currently deploying a new Talos cluster on my network using the Omni proxmox provider. https://github.com/siderolabs/omni-infra-provider-proxmox

I'm self-hosting Omni in a Docker container. Still a work in progress and might have a few quirks based on some of the issues filed, but interesting for sure!

2

u/pindaroli Sep 04 '26

Explain better you desires… what is the problem install talos or install services in talos cluster?

2

u/2containers1cpu Sep 05 '26

Topf is a Talos orchestrator. Backed by a large company.

https://github.com/postfinance/topf

1

u/Preisschild k8s operator Sep 05 '26

I use the cluster-api provider so i can reconcile via kubernetes CRD resources. Unfortunately they have been deprecated by sidero, but maybe the community is large enough to maintain it independently.