Day-2’000 - Migration From Kubeadm+Ansible To ClusterAPI+Talos: A Swiss Bank’s Journey
summary
Claim: migrate 35 on‑prem air‑gapped clusters with custom PKI from kubeadm+Ansible+Puppet to ClusterAPI+Talos without downtime. Steps: provision VMs with Terraform on vSphere, import existing Kubernetes PKI into a talosctl‑generated secrets bundle, match service account issuer and etcd encryption key names (re‑encrypt secrets), create ClusterAPI CRDs, patch TalosControlPlane status bootstrapped=true before scaling, add Talos nodes incrementally until old kubeadm nodes are drained. Known failures: invalid bearer token from issuer mismatch, wrong or missing etcd encryption key, potential etcd quorum loss requiring force recovery. Bootstrapping uses an ephemeral kind + small Go utility run from GitLab to recreate a management cluster.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:04Six-year-old Kubernetes clusters
- 3:32Current provisioning: Kubeadm+Ansible
- 5:16Cluster API and Talos Linux
- 6:18Migration strategy
- 7:41Configuration matching
- 9:27Importing existing PKI
- 11:10Creating Cluster API CRDs
- 12:37Adding nodes incrementally
- 14:05Pitfalls during node addition
- 15:09Live demo setup
- 20:25Patching Talos control plane
- 21:27Provisioning first control plane node
- 22:54Node joins cluster
- 24:42Finalizing migration step
- 25:25Bootstrapping issue and recovery
- 26:48Conclusion and next steps
- 27:09Q&A
related talks
31mTOPF: Open-Sourcing PostFinance's Tool to Migrate and Manage Talos Linux Clusters.
25mJourney to Stable Infrastructures with Talos Linux & Cozystack
35mKubernetes journey
35mClusters as Cattle: How to Seamlessly Migrate Apps Across Kubernetes Clusters
31mSaving Money Exposed Our Architecture - Escaping ClusterAPI with Karpenter
31mHow to Migrate 700 Kubernetes Clusters to Cluster API with Zero D...
34mDon’t Debug, Reset: Managing Kubernetes the Declarative Way with Talos Linux
28mTalos Linux: One (Immutable) OS to Rule Them All