Talos Infrastructure

Work in Progress

I built this to actually understand Kubernetes, Talos and Terraform, not just click through a managed cluster and call it done. So instead of a managed Kubernetes service, this is a private cluster on Hetzner Cloud built from raw infrastructure: no managed control plane, and no public IP on any of the nodes.

The Build

This is a production style cluster where none of the Kubernetes nodes are reachable from the internet. All outbound traffic is routed through a NAT VM, and the only public entry point is a load balancer sitting in front of the control plane.

Internet → Load Balancer (public IP)
                │
         Private Network (10.0.0.0/16)
         ├── nat-vm   - outbound NAT gateway
         ├── cp1      - control plane
         ├── cp2      - control plane
         ├── cp3      - control plane
         └── worker1  - worker node

Every node runs Talos Linux, an API driven OS with no shell and therefore no SSH either.

Why?

The goal was to build a cluster that behaves more like real infrastructure than a throwaway homelab. I did not want publicly reachable nodes or a managed control plane hiding the operational details. I wanted to handle the network design myself and actually understand how the pieces fit together.

By keeping all nodes on a private network and forcing ingress and egress through controlled points, the cluster has a much smaller attack surface and a cleaner security model. It is also a practical way to explore patterns that show up in production environments, especially around isolation, routing and controlled access.

Running this on Hetzner keeps the cost reasonable while still giving me full control over the infrastructure. That makes it a good platform for learning Kubernetes in a way that is hands on and close to real operational work.