<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Immutable on Backend Engineering Strategy Tools</title><link>https://backend-engineering-strategy-tools.github.io/site/tags/immutable/</link><description>Recent content in Immutable on Backend Engineering Strategy Tools</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><lastBuildDate>Thu, 14 May 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://backend-engineering-strategy-tools.github.io/site/tags/immutable/index.xml" rel="self" type="application/rss+xml"/><item><title>Talos Linux + Omni</title><link>https://backend-engineering-strategy-tools.github.io/site/public-notes/kubernetes/talos/</link><pubDate>Thu, 14 May 2026 00:00:00 +0000</pubDate><guid>https://backend-engineering-strategy-tools.github.io/site/public-notes/kubernetes/talos/</guid><description>&lt;p&gt;Talos Linux is an immutable, minimal operating system designed specifically for running Kubernetes. There is no shell, no SSH, no package manager. The entire OS is read-only and managed via a gRPC API (&lt;code&gt;talosctl&lt;/code&gt;). Node configuration is declarative YAML applied over the API; changes that require a reboot take effect on the next boot.&lt;/p&gt;
&lt;p&gt;The tradeoff is rigidity for operational simplicity. You cannot log into a Talos node and fix something by hand. In return, nodes are deterministic, reproducible, and there is no configuration drift.&lt;/p&gt;
&lt;hr&gt;
&lt;h2 id="comparison-to-other-installs"&gt;Comparison to other installs
&lt;/h2&gt;&lt;table&gt;
 &lt;thead&gt;
 &lt;tr&gt;
 &lt;th&gt;Method&lt;/th&gt;
 &lt;th&gt;OS&lt;/th&gt;
 &lt;th&gt;Config&lt;/th&gt;
 &lt;th&gt;Mutable&lt;/th&gt;
 &lt;/tr&gt;
 &lt;/thead&gt;
 &lt;tbody&gt;
 &lt;tr&gt;
 &lt;td&gt;kubeadm&lt;/td&gt;
 &lt;td&gt;Ubuntu / RHEL / etc&lt;/td&gt;
 &lt;td&gt;Manual + scripts&lt;/td&gt;
 &lt;td&gt;Yes&lt;/td&gt;
 &lt;/tr&gt;
 &lt;tr&gt;
 &lt;td&gt;k3s&lt;/td&gt;
 &lt;td&gt;Any Linux&lt;/td&gt;
 &lt;td&gt;Minimal&lt;/td&gt;
 &lt;td&gt;Yes&lt;/td&gt;
 &lt;/tr&gt;
 &lt;tr&gt;
 &lt;td&gt;Talos&lt;/td&gt;
 &lt;td&gt;Talos Linux&lt;/td&gt;
 &lt;td&gt;Declarative API&lt;/td&gt;
 &lt;td&gt;No&lt;/td&gt;
 &lt;/tr&gt;
 &lt;/tbody&gt;
&lt;/table&gt;
&lt;p&gt;k3s and kubeadm give you more flexibility and a familiar Linux environment. Talos is the right choice when you want the cluster nodes to behave like appliances — provisioned, never touched.&lt;/p&gt;
&lt;hr&gt;
&lt;h2 id="omni"&gt;Omni
&lt;/h2&gt;&lt;p&gt;&lt;a class="link" href="https://omni.siderolabs.com" target="_blank" rel="noopener"
 &gt;Omni&lt;/a&gt; is a cluster management platform by Sidero Labs built on top of Talos. It handles:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Node registration (nodes boot and phone home to the Omni API)&lt;/li&gt;
&lt;li&gt;Cluster creation and machine assignment&lt;/li&gt;
&lt;li&gt;Kubernetes upgrades (one action in the UI)&lt;/li&gt;
&lt;li&gt;&lt;code&gt;talosctl&lt;/code&gt; and &lt;code&gt;kubeconfig&lt;/code&gt; access via the Omni CLI&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Nodes register via a join token embedded in the kernel command line at PXE boot time. The cluster runs on your hardware; Omni only manages the control plane.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Hobby tier&lt;/strong&gt;: 10 nodes, non-commercial use, free. Sidero Labs also offers a self-hosted version.&lt;/p&gt;
&lt;hr&gt;
&lt;h2 id="image-factory"&gt;Image Factory
&lt;/h2&gt;&lt;p&gt;&lt;a class="link" href="https://factory.talos.dev" target="_blank" rel="noopener"
 &gt;factory.talos.dev&lt;/a&gt; generates custom Talos images with hardware extensions included. Notable extensions:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;siderolabs/bnx2&lt;/code&gt; — Broadcom NetXtreme II (BCM5708/BCM5709) NIC firmware, required on some enterprise hardware (IBM x3550 M3, HP Gen 6/7 blades)&lt;/li&gt;
&lt;li&gt;&lt;code&gt;siderolabs/intel-ucode&lt;/code&gt; — Intel microcode updates&lt;/li&gt;
&lt;li&gt;&lt;code&gt;siderolabs/nvidia-*&lt;/code&gt; — NVIDIA GPU support&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The factory produces both ISO and PXE artifacts (kernel + initramfs). See the &lt;a class="link" href="https://backend-engineering-strategy-tools.github.io/site/public-notes/hardware/hardware-provisioning/ipxe-opnsense/" &gt;OPNSense + iPXE reference&lt;/a&gt; for how to serve these over TFTP.&lt;/p&gt;
&lt;hr&gt;
&lt;h2 id="supporting-sidero-labs"&gt;Supporting Sidero Labs
&lt;/h2&gt;&lt;p&gt;Talos and Omni are built by &lt;a class="link" href="https://github.com/siderolabs" target="_blank" rel="noopener"
 &gt;Sidero Labs&lt;/a&gt; — good people doing good work. I sponsor them via &lt;a class="link" href="https://github.com/sponsors/siderolabs" target="_blank" rel="noopener"
 &gt;GitHub Sponsors&lt;/a&gt; at the fanboi tier.&lt;/p&gt;
&lt;hr&gt;
&lt;h2 id="relevant-links"&gt;Relevant links
&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;&lt;a class="link" href="https://www.talos.dev/latest/" target="_blank" rel="noopener"
 &gt;Talos Linux docs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a class="link" href="https://omni.siderolabs.com/docs" target="_blank" rel="noopener"
 &gt;Omni docs&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a class="link" href="https://factory.talos.dev" target="_blank" rel="noopener"
 &gt;Image factory&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a class="link" href="https://github.com/siderolabs" target="_blank" rel="noopener"
 &gt;Sidero Labs GitHub&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a class="link" href="https://github.com/sponsors/siderolabs" target="_blank" rel="noopener"
 &gt;Sponsor Sidero Labs&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;</description></item></channel></rss>