Product

Talos OS

Run every tenant guest on immutable Linux built for Kubernetes — upgraded as images, not patched over SSH. Operate Image Factory gold from Cloud /images.

CapA Machines boot content-addressed metal bases. Official extensions only. CRI mirrors point at the site VIP so air-gap joins never depend on public package mirrors.

Architecture

Factory → host gold → CapA Machines → image upgrades

Pick a schematic, EnsureImage on alive hosts, boot Machines from that gold, and roll upgrades as versioned images.

Image Factory

Pick factory, channel, Talos version, and official extensions. Schematic id is content-addressed.

Host gold

EnsureImage materializes metal bases on alive fabric hosts — existing VMs keep their disks.

CapA Machines

Guests boot those bases. TalosConfigTemplate Spec is content-addressed when the API forbids in-place mutation.

Image upgrades

Roll Machines through versioned templates — not apt or SSH package drift on a live node.

1
Choose schematic in Cloud
Cloud /images opens Image Factory: factory endpoint, channel, Talos version, optional official extensions only.
2
EnsureImage across hosts
Gold downloads onto alive hosts. Identity is factory_id + schematic_id + talos_version + arch + asset path.
3
CapA boots Talos guests
Machine configs are API-managed. CRI registry mirrors point at the site VIP with skipFallback for air-gap.
4
Upgrade as image rolls
Pending schematic updates appear in Cloud. Apply rolls Machines onto new gold — reviewable, not tribal hotfixes.

Ensure via ctl

Same EnsureImage path as Cloud /images. Sister surfaces: Managed Kubernetes and Container Registry CRI mirrors.

ctl images ensure

aanjaleyad ctl images ensure \
  -factory factory.talos.dev \
  -channel stable \
  -talos-version v1.10.4 \
  -extension siderolabs/qemu-guest-agent

Always-on core

Guest OS contract

Talos is the guest OS contract for every CapA Machine — not an optional pack toggle.

Official Image Factory extensions only; custom binary packages are out of product scope.

Not a general-purpose Linux desktop — Kubernetes node OS only.

Host CA material from Private CA injects into Talos machine config on StartPlatform and tenant create.

Open source

Talos Linux

Immutable Linux for Kubernetes. Used here only to credit the guest OS Aanjaleya Talos gold builds on. Talos is a trademark of Sidero Labs; Aanjaleya is not affiliated with or endorsed by Sidero Labs in this attribution.

Sidero Labs / Talos org mark

github.com/siderolabs/talos

Aanjaleya Innovation Private Limited is not affiliated with or endorsed by those projects in this attribution.

Talk to us Managed Kubernetes Container Registry Private CA All features