The Whole Machine

Ten chapters of parts; one machine. This closing chapter reassembles them — tracing a single Talos node from the firmware handing control to a kernel, all the way to a Ready Kubernetes member — then names the handful of design patterns that recur at every layer, and what is worth stealing for your own systems.

#Power-on to Ready: the full trace

Here is the whole life of a control-plane node, with each step pointing back at the chapter that explains it. Nothing here is a script being run; almost everything after step 5 is a controller reacting to a resource.

1. Firmware → kernel. UEFI (optionally with SecureBoot verifying the UKI signature) loads the Talos UKI — kernel + initramfs + cmdline in one signed PE binary — and jumps into the kernel. → ch.09, ch.08
2. initramfs PID 1. init mounts /proc, /sys, /dev, extends PCR 11 with enter-initrd, loop-mounts the read-only squashfs root (overlaying any system-extension layers), then switch_roots into it and execs the real PID 1. → ch.01, ch.04
3. machined takes over as PID 1. It starts the process reaper and launches the COSI controller runtime in a goroutine — the ~200-controller reconciliation graph — over a shared resource state. → ch.02
4. The sequencer runs Initialize. It enforces KSPP kernel hardening, starts the early services (udevd, machined API, apid, containerd), reloads META, and runs LoadConfig. → ch.01
5. Config is acquired. AcquireController walks its sources — STATE disk, embedded, platform user-data, kernel cmdline — and if none exist, enters maintenance mode and waits for talosctl apply-config. The result becomes a MachineConfig resource at ActiveID. This is the moment the desired state enters the system. → ch.03
6. The graph wakes up. Every controller watching MachineConfig fires. Block controllers discover disks and drive the EPHEMERAL/STATE volumes through Located → Provisioned → Prepared → Ready, unlocking LUKS2-encrypted volumes against the TPM during the enter-machined PCR window. The Install sequence writes Talos to disk if this is bare metal. → ch.04, ch.01
7. The network converges. The Config → Merge → Spec → Kernel pipeline brings up links and addresses: a default DHCP4 operator leases an IP, machine-config addresses override it by layer priority, and Spec controllers apply the merged desired state to the kernel via rtnetlink. NodeAddressController decides the node's canonical IPs. → ch.05
8. Secrets materialize. The secrets controllers derive the OS / Kubernetes / etcd root CAs from the config and mint every leaf certificate as a COSI resource — apid's serving cert, etcd's peer/member certs, the kubelet's bootstrap identity — refreshing them automatically at half their lifetime. → ch.08
9. etcd & the control plane. On talosctl bootstrap (one node, one time) etcd starts initial-cluster-state=new; peers join later as learners. Once etcd is healthy, the k8s controllers render kube-apiserver/controller-manager/scheduler into StaticPod resources, serve them as a PodList over localhost HTTP, and the kubelet — itself a Talos service — runs them. → ch.06
10. The Boot sequence finishes. StartAllServices brings up the rest; bootstrap manifests (CNI, kube-proxy, CoreDNS) are applied once under an etcd lock. The node registers, NodeApplyController stamps its labels and taints, and the kubelet reports Ready. → ch.06
11. Steady state = reconciliation. From here nothing is "done" — it is maintained. Edit the config via the API and the same controllers re-converge. Run talosctl upgrade and the node A/B-swaps to a new image, auto-reverting if it fails to come back healthy. → ch.07, ch.09

#The subsystem map

Every chapter, as one row — what it owns, where it lives, and the single idea to remember.

#Five patterns that recur everywhere

Read enough of the source and the same five moves appear in every subsystem. They are the real architecture — the controllers are just instances of them.

1. Desired and observed are separate resources. A *Spec says what should be true; a *Status reports what is true; convergence is emergent, never forced in one write. This is what lets Talos want an address before its link exists, or a pod before etcd is healthy. → ch.05
2. Many config sources, merged by priority. Defaults, kernel cmdline, platform metadata, dynamic operators, and the machine config all feed candidate specs tagged with a layer; a merge step keeps the highest. Adding a source never means editing the consumer. → ch.05, ch.03
3. Transform chains of small typed steps. Rather than one big function, Talos threads config → Config resource → Final resource → running process, each a tiny controller. The "Final" step is the single source of truth for the exact arguments. → ch.06
4. Every apply is idempotent and self-healing. Locate-or-create, skip-if-already-equal, take a lock, retry with backoff forever. Re-running a reconcile is always safe — which is why a flapping NIC, a racing disk lock, or a duplicated controller never corrupts anything. → ch.04, ch.05
5. A little durable state bridges the gaps reconciliation can't. The META partition carries the handful of facts that must survive a wipe or a reboot — the staged-upgrade image, the disk-encryption config, and the upgrade fallback marker whose mere presence means "this upgrade isn't confirmed good yet." → ch.09

#What to steal

You do not have to run Talos to learn from it. If you are building any system that looks like "take a desired state, make the real world match it, and keep them matched" — a VM control plane, a device fleet manager, a GitOps agent, an appliance — Talos is a worked reference for the hard parts.

#Talos and COSI

The reconciliation engine underneath all of this — the resource model, the State broker, the controller runtime, the reconcile loop — is not Talos-specific. It is COSI (cosi-project/runtime), extracted by Sidero Labs as a reusable library and used here in its largest, most complete application. If this deep dive left you wanting the engine internals rather than the machine built on them, its companion is one click away.

That is the whole machine: a kernel, one process, a graph of controllers, and a single document that says what the node should be. Everything else is reconciliation.