Transform your single VPS into a production-ready Kubernetes powerhouse
π― Who This Guide Is For: This is a starter guide specifically designed for learners with one VPS or cloud server for educational purposes. If you have multiple physical machines in a homelab setup, you'll need different configurations and networking approaches.
π Inspiration & Credits
Before we dive into this exciting journey, I want to give proper credit to Mischa van den Burg for his inspiring videos that motivated this comprehensive guide:
π― "The Kubernetes Homelab That Prints Job Offers - 2025" - His insights about how Kubernetes creates incredible learning opportunities and reignites passion for cloud-native computing.
π€ "How To Learn Kubernetes in 2025" - Perfect for those still deciding whether it's worth learning Kubernetes despite its complexity. If you have the passion to learn cloud-native computing, this is a great starting point!
π‘ Why This Matters: As Mischa demonstrates, building real-world Kubernetes projects isn't just about learningβit's about creating opportunities that can transform your career in DevOps and cloud engineering. Even with the complexity, the passion for cloud-native technology makes the journey worthwhile.
π Introduction: Welcome to the Cloud-Native Revolution
Imagine you're building a smart city. Traditional infrastructure is like having individual houses scattered everywhereβeach with its own utilities, security systems, and maintenance crews. Cloud-native architecture, powered by Kubernetes, is like creating a modern apartment complex where everything is centralized, automated, and efficiently managed.
Today, we're going to build your first Kubernetes cluster using two incredible technologies:
- Talos Linux: Think of it as the ultimate apartment building managerβsecure, automated, and never sleeps
- Cilium: The smart networking system that connects everything with lightning speed
By the end of this guide, you'll have a production-ready Kubernetes cluster running on a single VPS that can scale and adapt to your needs.
π€ Why Kubernetes? Understanding the "Why" Before the "How"
The Restaurant Analogy
Imagine you own a restaurant. In the old days (traditional deployment), you had:
- One chef doing everything
- If the chef gets sick, the restaurant closes
- During rush hour, customers wait forever
- Scaling means hiring more chefs and buying more kitchens
With Kubernetes, your restaurant becomes a smart food court:
- Multiple specialized stations (containers) handle different tasks
- Automatic scaling: More pizza stations appear during lunch rush
- Self-healing: If one station breaks, another takes over instantly
- Resource sharing: All stations share the same utilities efficiently
π― Kubernetes Benefits
Feature | Benefit | Impact |
---|---|---|
π Auto-Scaling | Automatically adjusts resources | π Efficiency |
π‘οΈ Self-Healing | Restarts failed containers | π Fast Recovery |
π¦ Portability | Run anywhere consistently | π° Cost-Effective |
π Fast Deployment | Deploy in seconds, not hours | β‘ Speed |
π§ Declarative | Describe desired state | π― Reliability |
π Service Discovery | Apps find each other automatically | π Connectivity |
Why Kubernetes is Essential for Modern Applications
- Scalability: Your app can grow from 10 to 10,000 users seamlessly
- Reliability: If something breaks, Kubernetes fixes it automatically
- Efficiency: Maximum resource utilization means lower costs
- Portability: Run anywhereβcloud, on-premises, or hybrid
- Developer Productivity: Focus on code, not infrastructure
π‘οΈ Enter Talos Linux: The Security-First Operating System
The Fortress Analogy
Traditional Linux servers are like medieval castles with many doors, windows, and secret passages. Each entry point is a potential security risk. Talos Linux is like a modern bank vault:
- Single API entrance: Only one way in, heavily guarded
- No SSH backdoors: No secret passages for attackers
- Immutable: The vault structure can't be modified from inside
- Self-updating: Automatically upgrades its security systems
π₯ Traditional Linux vs Talos Linux
Aspect | Traditional Linux | Talos Linux | Winner |
---|---|---|---|
πͺ Access Method | SSH Access | π API Only | π‘οΈ Talos |
π οΈ Shell Access | Full Shell | π« No Shell | π‘οΈ Talos |
π System State | Mutable | π Immutable | π‘οΈ Talos |
π§ Updates | Manual Updates | π€ Auto Updates | π‘οΈ Talos |
π― Attack Surface | Large | π‘οΈ Minimal | π‘οΈ Talos |
π Debugging | Easy | API-based | π€ Depends |
Talos Linux Advantages
β
Zero Attack Surface: No shell, no SSH, no unnecessary services
β
API-Driven: Everything managed through secure APIs
β
Immutable: OS can't be tampered with at runtime
β
Kubernetes-Native: Built specifically for container workloads
β
Minimal Resources: Tiny footprint means more resources for your apps
πΈοΈ Cilium: The Neural Network of Your Cluster
The Smart City Traffic System Analogy
Traditional networking (kube-proxy) is like having traffic lights at every intersectionβfunctional but slow. Cilium is like having an AI traffic management system:
- eBPF Technology: Like having sensors everywhere that make instant decisions
- No Bottlenecks: Traffic flows smoothly without stopping at every light
- Security Built-in: Automatically blocks suspicious vehicles
- Observability: Real-time monitoring of all traffic patterns
β‘ Cilium eBPF Superpowers
Performance | Security | Observability |
---|---|---|
π Kernel Speed | π‘οΈ L3/L4/L7 Security | π Deep Observability |
β‘ Zero-Copy Networking | π Network Policies | π Real-time Metrics |
π Load Balancing | π« DDoS Protection | ποΈ Traffic Visualization |
π High Throughput | π Encryption | π Network Debugging |
π― Low Latency | π‘οΈ Identity-based Security | π Performance Analytics |
Why Cilium Over Traditional CNI
π Performance: eBPF runs in kernel spaceβblazingly fast
π Security: Network policies enforced at the kernel level
π Observability: Deep insights into network traffic
π Load Balancing: Replaces kube-proxy with better performance
ποΈ Our Architecture: The Blueprint
We're building a single-node Kubernetes cluster that acts as both control plane and worker. Think of it as a studio apartment that's perfectly organizedβcompact but fully functional.
ποΈ Architecture Stack
Layer | Component | Features |
---|---|---|
π Infrastructure | VPS (Single Node) | Your cloud server foundation |
π‘οΈ Operating System | Talos Linux (Immutable) | β’ API-driven management β’ Zero attack surface β’ Automatic updates |
βοΈ Orchestration | Kubernetes Control Plane + Worker | β’ etcd (cluster database) β’ API Server (cluster brain) β’ Scheduler (workload placement) β’ Kubelet (node agent) |
πΈοΈ Networking | Cilium CNI (eBPF) | β’ Pod-to-pod communication β’ Load balancing β’ Network security policies β’ Observability with Hubble |
π¦ Applications | Your Workloads | β’ Web services β’ Databases β’ APIs β’ Microservices |
π οΈ Prerequisites: What You'll Need
Before we start building, make sure you have:
π Checklist:
- β A VPS (DigitalOcean, Linode, Vultr, etc.) with at least 2GB RAM (this is for starter, you can upgrade later)
- β talosctl installed on your local machine
- β kubectl for Kubernetes management
- β helm for package management
- β Basic terminal knowledge (don't worry, we'll guide you through everything!)
Installing Required Tools
# Install talosctl (macOS)
brew install siderolabs/tap/talosctl
# Install kubectl
brew install kubectl
# Install helm
brew install helm
π Step-by-Step Setup Guide
Phase 0: Preparing Your Configuration
First, let's create our Talos configuration patch. This is like creating the blueprint for our smart building:
Create patch.yaml
:
# Talos Linux Configuration Patch for Single Node VPS with Cilium CNI
# This patch configures Talos for a single-node setup with custom networking and storage
# Machine-specific configuration
machine:
install:
disk: /dev/vda # Primary disk for VPS installation
network:
interfaces:
- interface: eth0 # Primary network interface on VPS
# Cluster configuration
cluster:
# Allow workloads to be scheduled on control plane (single node setup)
allowSchedulingOnControlPlanes: true # Required for single node - control plane acts as worker too
network:
cni:
name: none # Disable default CNI - Cilium will provide networking
proxy:
disabled: true # Disable kube-proxy - Cilium will handle load balancing with eBPF
Phase 1: Talos Linux Installation
Step 0: Preparing Your VPS for Talos Installation
Before generating the configuration, you need to ensure your VPS can boot Talos Linux. You have several options:
π§ Installation Methods:
Option 1: ISO Mounting (Most Common)
- Download the Talos Linux ISO from:
- GitHub releases (official releases)
- Talos Linux Factory (custom images for specific platforms)
- Mount it through your VPS provider's control panel
- Boot from the mounted ISO
Option 2: Netboot (Provider-Specific)
- Some providers like Onidel VPS offer netboot options
- Check your VPS control panel for "Custom OS" or "Netboot" features
- Configure it to boot Talos Linux directly from the network
Option 3: Siderolabs Booter (Advanced)
- Use the siderolabs/booter tool for PXE boot
- Perfect for automated deployments or multiple machines
- Requires network boot capability on your VPS
# Example: Using siderolabs booter (if your VPS supports PXE)
docker run --rm --network host \
ghcr.io/siderolabs/booter:v0.1.0
β οΈ Important: Make sure your VPS successfully boots into the Talos Linux installation environment before proceeding to the next step. You should see the Talos maintenance mode interface.
Step 1: Generate Talos Configuration
# Replace YOUR_VPS_IP with your actual VPS IP address
talosctl gen config talos-cilium-single-node-cluster https://YOUR_VPS_IP:6443 \
--config-patch @patch.yaml \
--output-dir ./out
What's happening here?
- We're creating configuration files for our cluster
- The patch file customizes the setup for our single-node scenario
- All generated files go into the
./out
directory
Step 2: Apply Configuration to Your VPS
# This installs Talos Linux on your VPS
talosctl apply -f ./out/controlplane.yaml -n YOUR_VPS_IP -i
β° Wait Time: Your VPS will reboot and install Talos Linux. This takes about 5-10 minutes. Grab a coffee! β
Step 3: Bootstrap the Kubernetes Cluster
# This starts the Kubernetes control plane
talosctl bootstrap -n YOUR_VPS_IP -e YOUR_VPS_IP --talosconfig ./out/talosconfig
What's bootstrapping?
Think of it as turning on the power in your smart building. All the systems come online and start talking to each other.
Step 4: Get Your Kubernetes Access Key
# This downloads the key to access your cluster
talosctl -n YOUR_VPS_IP -e YOUR_VPS_IP --talosconfig ./out/talosconfig kubeconfig ./out/kubeconfig
# Set up your local environment
export KUBECONFIG=./out/kubeconfig
Step 5: Verify Kubernetes is Running
kubectl get nodes
You should see something like:
NAME STATUS ROLES AGE VERSION
talos-xxx-xxx NotReady control-plane 1m v1.28.x
Don't panic about "NotReady"! This is normalβwe haven't installed networking yet.
Phase 2: Installing Cilium CNI
Now we're going to install the nervous system of our clusterβthe networking layer.
Step 1: Add Cilium Repository
helm repo add cilium https://helm.cilium.io/
helm repo update
Step 2: Install Cilium with Optimized Settings
helm install cilium cilium/cilium \
--version 1.18.1 \
--namespace kube-system \
--set ipam.mode=kubernetes \
--set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
--set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
--set cgroup.autoMount.enabled=false \
--set cgroup.hostRoot=/sys/fs/cgroup \
--set operator.replicas=1 \
--set kubeProxyReplacement=true \
--set hubble.relay.enabled=true \
--set hubble.ui.enabled=true \
--set k8sServiceHost=YOUR_VPS_IP \
--set k8sServicePort=6443
π§ Understanding the Cilium Configuration Parameters
Let me break down what each of these parameters does and why they're crucial for our Talos + Cilium setup:
π¦ Basic Installation Settings
--version 1.18.1 # Specific Cilium version for stability
--namespace kube-system # Install in the system namespace
π§ IP Address Management (IPAM)
--set ipam.mode=kubernetes # Let Kubernetes handle IP allocation
Why this matters: Instead of Cilium managing IPs directly, we let Kubernetes do it. Think of it like letting the hotel concierge assign room numbers instead of guests picking their own!
π Security Capabilities
--set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
--set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
What these do:
- NET_ADMIN: Manage network interfaces and routing
- SYS_ADMIN: System administration tasks
- NET_RAW: Create raw sockets for network operations
- CHOWN/FOWNER: Change file ownership
- KILL: Terminate processes
- IPC_LOCK: Lock memory pages
Why so many permissions? Cilium needs deep system access to manage networking at the kernel level. It's like giving a master key to the building superintendent!
π Control Groups (cgroups) Configuration
--set cgroup.autoMount.enabled=false # Don't auto-mount cgroups
--set cgroup.hostRoot=/sys/fs/cgroup # Use host's cgroup filesystem
Talos-specific: Since Talos manages the system differently than traditional Linux, we need to tell Cilium exactly where to find the cgroup filesystem.
βοΈ Single-Node Optimizations
--set operator.replicas=1 # Only one operator instance
Why only 1? In a multi-node cluster, you'd want multiple operators for high availability. But with just one node, multiple operators would just waste resources!
π Kube-Proxy Replacement
--set kubeProxyReplacement=true # Replace kube-proxy entirely
Game changer: This is where Cilium shines! Instead of using the traditional kube-proxy, Cilium handles all service load balancing with eBPF - much faster and more efficient!
ποΈ Observability with Hubble
--set hubble.relay.enabled=true # Enable Hubble relay
--set hubble.ui.enabled=true # Enable Hubble web UI
What's Hubble? Think of it as a security camera system for your network traffic. You can see exactly what's talking to what, when, and why!
π API Server Connection
--set k8sServiceHost=YOUR_VPS_IP # Your VPS public IP
--set k8sServicePort=6443 # Kubernetes API port
Critical for single-node: Tells Cilium how to reach the Kubernetes API server from outside the cluster.
π‘ Pro Tip: Parameter Customization
π― Key Parameters You Might Want to Adjust
Parameter | Purpose | Customization Tip |
---|---|---|
k8sServiceHost |
API server connection | β Your actual VPS IP |
operator.replicas |
Operator instances | β Scale with node count |
hubble.ui.enabled |
Web UI for monitoring | β Disable if not needed |
kubeProxyReplacement |
Performance mode | β Keep true for eBPF benefits |
securityContext.capabilities |
System permissions | β Don't change unless you know why |
Remember: Each parameter serves a specific purpose in making Cilium work seamlessly with Talos Linux. Don't randomly change them unless you understand the implications!
What do all these settings do?
-
kubeProxyReplacement=true
: Cilium replaces kube-proxy for better performance hubble.ui.enabled=true
: Gives us a beautiful network monitoring dashboardoperator.replicas=1
: Optimized for single-node deployment
Step 3: Verify Everything is Working
# Check if Cilium pods are running
kubectl get pods -n kube-system -l k8s-app=cilium
# Check node status (should now be Ready!)
kubectl get nodes
# Check Cilium status
cilium status --wait
Success looks like:
NAME STATUS ROLES AGE VERSION
talos-xxx-xxx Ready control-plane 5m v1.28.x
π Congratulations! What You've Built
You've just created a production-ready Kubernetes cluster with:
π― Achievement Unlocked!
Component | Achievement | Status |
---|---|---|
π‘οΈ Security | Talos Linux with zero attack surface | β Complete |
β‘ Performance | Cilium with eBPF networking | β Complete |
π― Efficiency | Single-node control plane + worker | β Complete |
ποΈ Architecture | Cloud-native ready infrastructure | β Complete |
ποΈ Observability | Built-in monitoring with Hubble | β Complete |
π Ready for | Production workloads and scaling | π Ready! |
π Understanding What You Built
The Magic Behind the Scenes
- Talos Linux is running as your OS, managing everything through APIs
- Kubernetes is orchestrating containers and managing resources
- Cilium is handling all networking with eBPF superpowers
- Your cluster can now run any containerized application
π£οΈ Your Journey Ahead
Category | Next Steps | Popular Tools |
---|---|---|
π Web Applications | Deploy websites and APIs | React, Vue, Node.js |
ποΈ Databases | Persistent data storage | PostgreSQL, MongoDB, Redis |
π Monitoring | Observability stack | Prometheus, Grafana, Alerting |
π CI/CD Pipeline | Automated deployments | GitLab, GitHub Actions, ArgoCD |
πͺ Ingress Controllers | External access | Traefik, NGINX, Istio |
π Security Hardening | Advanced security | Network policies, RBAC, Vault |
π Scaling | Handle more traffic | HPA, VPA, Cluster Autoscaler |
π‘ Wisdom Gained
Lesson | Key Insight | Impact |
---|---|---|
1οΈβ£ Approachability | Kubernetes isn't scary with the right guidance | π― Confidence boost |
2οΈβ£ Security First | Talos makes security simple and automatic | π‘οΈ Peace of mind |
3οΈβ£ Performance | eBPF networking is truly game-changing | β‘ Speed & efficiency |
4οΈβ£ Efficiency | Single-node clusters are surprisingly powerful | πͺ Resource optimization |
5οΈβ£ Accessibility | Modern infrastructure is accessible to everyone | π Democratized tech |
π€ Join the Community
You're now part of the cloud-native community! Here are some great resources:
π Community Resources
Platform | Resource | What You'll Find |
---|---|---|
π‘οΈ Talos Linux | talos.dev | Official docs, guides, API reference |
πΈοΈ Cilium | cilium.io | eBPF tutorials, networking guides |
βοΈ Kubernetes | kubernetes.io | Complete K8s documentation |
ποΈ CNCF | cncf.io | Cloud-native landscape & projects |
π¬ Discord/Slack | Community channels | Real-time help & discussions |
π Documentation | Official docs | Step-by-step tutorials |
π₯ YouTube | Video content | Conferences, demos, deep-dives |
π‘ Final Thoughts
Building your first Kubernetes cluster is like learning to driveβit seems overwhelming at first, but once you understand the basics, a whole world of possibilities opens up. You've just built something that many enterprises pay thousands of dollars for, using open-source tools and a single VPS.
π "The future of infrastructure is declarative, automated, and secure. You're now equipped with the knowledge to be part of that future."
Happy clustering! π
Did this guide help you build your first Kubernetes cluster? Share your experience in the comments below, and don't forget to follow for more cloud-native tutorials!
Tags: #Kubernetes #TalosLinux #Cilium #CloudNative #DevOps #Containers #eBPF #Infrastructure #Tutorial #Beginner
Top comments (0)