From bare metal to cluster node — in the interface.
Management for Kubernetes clusters on Talos Linux. A Go binary runs outside the cluster and speaks the Talos machine API directly. The alternative to Sidero Omni — and the sharpest difference is in the licence: Omni is BUSL-1.1, and running it yourself in production needs an enterprise agreement. holzkube-manager is AGPL-3.0.
The «outside» is the whole point. Anyone who has to bring a cluster back up cannot use a tool that runs inside it: no database server, no Helm chart, no Kubernetes to manage Kubernetes. One binary, one data directory, HTTPS with a certificate it generates on first start.
Provisioning
Build a schematic in the Image Factory, find the machine in maintenance mode, apply the config, the node joins. No PXE script, no ISO mounted by hand.
Upgrades
Talos and Kubernetes rolling, node by node, with a health gate between them — the next one only once the previous is healthy again.
Configuration
View the MachineConfig, patch it, diff before applying. The dry run first, then the change.
Inventory
Nodes, health, Talos and Kubernetes version, services, logs over time.
Audit
Every change as a hash chain, verified at startup rather than behind a button. A break is shown in the interface. That is tamper-evidence, not tamper-proofing — and it says so.
Security
--dry-run refuses every writing call in the transport, not in the interface; a test enumerates every mutation and asserts that nothing reaches the node. --sudo-window bounds how long a re-authentication permits destructive work.
Phase 1 is in place: the binary, HTTPS, setup, login, the store and the audit log. The Talos side is being built right now — transport, Image Factory and a simulator the contracts are tested against. Until it is done there is no node view, and the interface says so at every turn.
