Talos Bare-Metal Cluster

Nested Pulumi project for bootstrapping bare-metal Talos Linux clusters.

Overview

This project handles the full lifecycle of a bare-metal Talos cluster:

• Phase 1: Talos bootstrap (machine secrets, config apply, bootstrap)
• Phase 2: Post-install (Cilium CNI, Longhorn storage, Gateway API)

Architecture

talos-cluster-baremetal/
├── __main__.py              # Main orchestration (2 phases)
├── patches.py               # PatchConfig dataclass + patch builders
├── check_node_state.py      # Pre-flight node state detection
├── wait_for_talos_node.py   # Dynamic provider: wait for Talos API
├── wait_for_k8s_api.py      # Dynamic provider: wait for K8s API
├── tests/                   # pytest tests for patch generation
├── outputs/                 # Generated credentials (gitignored)
│   ├── talosconfig          # Talos client config
│   ├── kubeconfig           # Kubernetes kubeconfig
│   ├── controlplane.yaml    # Generated machine config
│   └── machine-secrets.yaml # Cluster secrets
└── Pulumi.dev.yaml          # Stack config with node details

Node State Detection

Before declaring resources, check_node_state.py probes the node:

This enables idempotent pulumi up - re-running after a successful deploy skips bootstrap.

Deployment Phases

Phase 1: Talos Bootstrap

1. Generate machine secrets
2. Build machine config with patches
3. Apply config to node (triggers reboot)
4. Wait for Talos API (50000/tcp)
5. Bootstrap cluster (etcd init)
6. Generate kubeconfig

Phase 2: Post-Install

1. Wait for Kubernetes API (6443/tcp)
2. Install Gateway API CRDs
3. Install Cilium CNI (with L2 announcements)
4. Create Longhorn namespace
5. Install external-snapshotter CRDs
6. Install Longhorn storage
7. Create VolumeSnapshotClass

Configuration

Required Settings

# Pulumi.dev.yaml
config:
  openchoreo:control_plane_node: "192.168.1.100"
  openchoreo:network_addresses: '["192.168.1.100/24"]'
  openchoreo:network_gateway: "192.168.1.1"
  openchoreo:cluster_endpoint: "https://192.168.1.100:6443"

Optional Settings

Patch System

patches.py builds Talos machine config patches using a PatchConfig dataclass:

from patches import PatchConfig, build_control_plane_patches

cfg = PatchConfig(
    cluster_name="openchoreo",
    cluster_endpoint="https://192.168.1.100:6443",
    network_interface="enp0s1",
    network_addresses=["192.168.1.100/24"],
    # ... more settings
)

patches = build_control_plane_patches(cfg)

Patch Categories

Dynamic Providers

WaitForTalosNodeReady

Waits for Talos API on port 50000, then runs talosctl health:

WaitForTalosNodeReady(
    "wait-talos",
    node="192.168.1.100",
    endpoint="192.168.1.100",
    talosconfig_path="outputs/talosconfig",
    timeout=600,
)

WaitForKubernetesAPI

Waits for Kubernetes API on port 6443:

WaitForKubernetesAPI(
    "wait-k8s",
    host="192.168.1.100",
    port=6443,
    timeout=600,
)

Testing

# Run patch generation tests
uv run pytest tests/

# Test with specific config
uv run pytest tests/test_config_patches.py -v

Tests use fixtures from conftest.py that provide PatchConfig instances.

Outputs

After successful deployment:

Files Written

Credentials are written to outputs/ (gitignored):

Component Versions

Conventions

Naming

• Pulumi resources: kebab-case (wait-talos-node-ready)
• Python variables: snake_case (control_plane_node)
• Config keys: snake_case (control_plane_node)

Dependencies

• Always use opts=pulumi.ResourceOptions(depends_on=[...]) for ordering
• Phase 2 resources depend on kubeconfig or wait resources

Secrets

• Credentials written with mode 0600
• Outputs marked as pulumi.Output.secret()
• outputs/ directory is gitignored