[HN Gopher] Talos Linux
___________________________________________________________________
Talos Linux
Author : kiyanwang
Score : 84 points
Date : 2022-06-19 11:34 UTC (11 hours ago)
(HTM) web link (www.talos.dev)
(TXT) w3m dump (www.talos.dev)
| ByThyGrace wrote:
| > Ephemeral
|
| > Talos runs in memory from a SquashFS, and persists nothing,
| leaving the primary disk entirely to Kubernetes.
|
| Hmm so if the entire disk is unused where is /boot in this
| configuration?
| AtlasBarfed wrote:
| ... so it wastes memory instead of disk?
|
| Unless we are talking about, like, a 100MB ramdisk, why is that
| a good thing?
|
| And really, I'd prefer a 10MB ramdisk.
| cbarrick wrote:
| Diskless servers are not uncommon
| ReptileMan wrote:
| Probably makes full disk encryption easier. Also compared to
| how much memory you can have on a modern server - it's
| trivial amount
| andrewrynhard wrote:
| It is a 50MB squashfs.
| giancarlostoro wrote:
| Thats impressive honestly.
| ZiiS wrote:
| It can netboot.
| moondev wrote:
| The amount and variety of machine images shipped is honestly
| impressive:
|
| https://github.com/siderolabs/talos/releases/tag/v1.0.6
|
| First time I have seen a project publish vmware-arm64.ova for
| ESXi arm edition.
|
| Is it still possible to exec into a shell on a cluster node via
| something like https://github.com/kvaps/kubectl-node-shell ?
| glitchcrab wrote:
| There's no shell on a Talos machine. You can obviously mount
| the host filesystem into a container, but you cannot exec onto
| a node directly (afaik).
| solatic wrote:
| Can anybody help explain when organizations should use Talos
| instead of cloud-vendor-managed Kubernetes offerings
| (EKS/AKS/GKE)? Especially considering that the managed offerings
| now fit most regulatory requirements (e.g. EKS is FedRAMP-High
| Authorized)? Or does Talos see most of its use in on-prem
| environments?
| andrewrynhard wrote:
| For folks who are all in on a single cloud provider it might
| not make sense, but if you run Kubernetes in multiple clouds,
| on-premise, edge, etc. then it starts to make a lot of sense
| since you get consistency.
| indymike wrote:
| > Can anybody help explain when organizations should use Talos
| instead of cloud-vendor-managed Kubernetes offerings
| (EKS/AKS/GKE)?
|
| 1. Learning. I want to self host to learn the stack top to
| bottom.
|
| 2. Build your own service.
|
| 3. Why not? (probably the best, most hackerish option)
|
| > Especially considering that the managed offerings now fit
| most regulatory requirements (e.g. EKS is FedRAMP-High
| Authorized)?
|
| Standards that meet regulatory requirements may not be updated
| or secure enough to meet private sector needs.
| 0daystock wrote:
| > Security: Talos reduces your attack surface: It's minimal,
| hardened and immutable. All API access is secured with mutual TLS
| (mTLS) authentication.
|
| So, no actual threat modelling, third party audits or integration
| and unit testing is done? Yes, that appears so.
| ntoskrnl wrote:
| Did you just read a marketing blurb on their landing page and
| decide after 5 seconds they don't do unit testing? I guess we
| can also assume they don't brush their teeth every morning
| because they didn't mention that either.
| 0daystock wrote:
| Actually I read the entire documentation and browsed the
| source code.
|
| https://www.talos.dev/v1.0/learn-more/philosophy/ "Security"
| section makes no mention of independent audits. It just
| boldly claims "There are no passwords in Talos" as if that
| was a panacea for security.
|
| The existing integration tests don't verify any assumptions
| about security, only that the configuration is valid. Please
| correct me if I'm wrong or missed anything.
|
| If you're going to call something "secure" you need to prove
| it.
| derfabianpeter wrote:
| They didn't call it secure as per your initial quote. They
| say it is designed to have a small attack surface. You
| missed to acknowledge that security means different things
| for different contexts. Besides, it's a free offering,
| clearing issues with insecurities other offerings have. If
| you want something to be more secure, you can point out
| flaws you find in the intended way (filing issues) which
| might help improve the situation. Calling it out the way
| you did (probably without trying the tool and even more
| likely without having substantial knowledge of better
| approachable alternatives in the space) doesn't help at
| all.
| mbushey wrote:
| I've been looking at Talos for almost a year now. I love the fact
| there is no shell, each machine is just a K8s node. It seems
| wonderful, but I can not get it to install. A friend has has the
| exact same experience, he finally went with Ubuntu and k3s. Has
| anyone successfully installed it?
| midislack wrote:
| This is SO cool, Raptor Engineering's Talos Workstations have a
| new OS!
| yjftsjthsd-h wrote:
| This only appears to support ARM64/aarch64 and AMD64/x86_64; it
| doesn't mention POWER anywhere.
| midislack wrote:
| Why'd they name it Talos then? LOL check out my new OS -
| called Surface!
| thewakalix wrote:
| By Talos, this can't be happening!
| hoistbypetard wrote:
| I was totally expecting this to be something made by Raptor:
| https://www.raptorcs.com/TALOSII/
| heffer wrote:
| I had somewhat of a weird moment here as well. I was expecting
| this to be related to Cisco Talos.
|
| And so I opened your link to find out what it was about. Only
| to find it mentioning CAPI 2.0 which I only know from the ISDN
| days (https://en.wikipedia.org/wiki/Common_ISDN_Application_Pro
| gra...) and not as some form of I/O interface accelerator.
| andrewrynhard wrote:
| We mention CAPI but certainly not 2.0 since the CAPI we are
| referring to is "Cluster API" and they only have 1.0.
| rubicks wrote:
| Same. Was expecting polished Debian-based OS for ppc
| architecture machines. Shucks.
| pabs3 wrote:
| I would expect Raptor folks to contribute upstream to
| firmware, the Linux kernel, bootloaders and Debian itself,
| not make a fork just for their own machines. The Debian
| ppc64el architecture is an official release architecture so
| Debian supports those machines quite well already.
| badrabbit wrote:
| GKE uses ChromeOS, weirded me out at first.
| danpalmer wrote:
| GKE runs Google's "Container Optimised" OS. It's just a bare-
| bones Linux designed for security and performance running
| containers, very similar to Talos.
|
| Edit: Was wrong, thanks for the correction.
| wrs wrote:
| "Container-Optimized OS is maintained by Google and based on
| the open source Chromium OS project." [0]
|
| [0] https://cloud.google.com/container-optimized-
| os/docs/concept...
| danpalmer wrote:
| Ha. I even triple-checked this with a bunch of google
| searches to make sure I was right. Sorry about that!
|
| That is strange. They aren't even some common base, CO-OS
| is literally based on Chromium OS.
| badrabbit wrote:
| Ssh into the nodes and poke around. Interesting FS
| layout, my typical probing commands didn't work and
| couldn't figure out the package manager or distro for a
| while, it was my firsr exposure to chromium os.
| TruthWillHurt wrote:
| So.. it's CoreOS all over again?
|
| Or Ubuntu Eucalyptus?
|
| (Neither is still with us. wonder why..)
| wmf wrote:
| CoreOS has a lot of children including Flatcar, RHEL CoreOS,
| and Fedora CoreOS. Then you have Ubuntu whatever, Google
| Container-Optimized OS, Amazon Bottlerocket, Talos, and
| probably a few more. The market is flooded.
| andrewrynhard wrote:
| The same spirit as CoreOS but it is something entirely
| different. Written from PID1 up solely for the purposes of
| running Kubernetes.
| andrewrynhard wrote:
| I would say that CoreOS is gone because RH destroyed it. Not
| because people didn't use it.
| ossusermivami wrote:
| I think you are misinformed, coreos is still alive within
| RH products (openshift)
___________________________________________________________________
(page generated 2022-06-19 23:01 UTC)