#Tag
Posts tagged "talos"
A mirror saves the download, not the dependency
A pull-through mirror turns repeated image downloads into cache hits, but a cache that re-checks tags and falls back to the origin has not removed the upstream from your availability story. What it must do, and does not by default, is serve the exact manifest it was given, because an image digest is the hash of that manifest.
A health check cannot prove a reboot happened
Automation that confirms a restart by polling for a healthy API is asking a question the old boot answers just as cheerfully as the new one. Gate a transition on evidence only the new state can produce: for a reboot, a boot ID that differs from the one you recorded before the change.
fsGroup is a request, not a guarantee
A non-root pod crashlooped on permission denied with a textbook securityContext, because the volume plugin behind a host-directory-backed claim carries no ownership pass and nothing says so. The field validated, the ownership change never happened, and only the directory reached through the application's own mount could settle it.
Powered off is a state, not an incident
Three of this fleet's six machines were upgraded, verified healthy, and then deliberately shut down the same night, and the books record a state, not a failure. When a node's entire existence is a rebuildable document, powered off becomes something you schedule, not something you fear.
Stage every lock before you turn one
Turning off anonymous pulls on the registry a fleet boots from is a change that only fails at the next boot, and a node that can't pull at boot may not come back to tell you. So the flip is split in time: the credential staged inert in every node's config, each node rebooted and proven with a real pull, and the door closed only when the last key has turned.
My servers don't have SSH, and that's the feature
Every box in this fleet runs an OS with no shell, no package manager, and no SSH daemon - the entire machine is an API with a declarative config. It sounds like giving up control. It's the opposite: you can't drift what you can't touch.