AWS

Official AMI Images

List of AMI images for each AWS region:
RegionVersionInstance TypeArchitectureAMI
ap-northeast-1 v0.11.0 hvmarm64ami-0823f5549d11040bd
ap-northeast-1 v0.11.0 hvmamd64ami-0f2d15b870b0b268c
ap-northeast-1 v0.11.1 hvmarm64ami-0dc38f926ca23256a
ap-northeast-1 v0.11.1 hvmamd64ami-01feb7f1e0642509b
ap-northeast-1 v0.11.2 hvmarm64ami-0137e8d33bcd97bb4
ap-northeast-1 v0.11.2 hvmamd64ami-025a88814605329a2
ap-northeast-1 v0.11.3 hvmamd64ami-0eb9410331d08a8f8
ap-northeast-1 v0.11.3 hvmarm64ami-0e16f9a1dac47b0e1
ap-northeast-1 v0.11.5 hvmamd64ami-0122b2b3e0cbfff45
ap-northeast-1 v0.11.5 hvmarm64ami-0bd935b3ead32ad59
ap-northeast-2 v0.11.0 hvmarm64ami-007df7add01d205f3
ap-northeast-2 v0.11.0 hvmamd64ami-0e866f28f5af12bcb
ap-northeast-2 v0.11.1 hvmarm64ami-03a69d46e88f7dd1e
ap-northeast-2 v0.11.2 hvmarm64ami-0ca6147f6439fb96a
ap-northeast-2 v0.11.3 hvmamd64ami-00e8168931a53aaae
ap-northeast-3 v0.11.0 hvmarm64ami-06a890f099218a9fa
ap-northeast-3 v0.11.1 hvmamd64ami-0a61e86789c3159ec
ap-northeast-2 v0.11.2 hvmamd64ami-0553a6b70f0bc03d1
ap-northeast-3 v0.11.1 hvmarm64ami-0935100c75cd63d7b
ap-northeast-3 v0.11.2 hvmamd64ami-02d10ccf2579da846
ap-northeast-3 v0.11.2 hvmarm64ami-0b3789bf5522f4d7f
ap-northeast-2 v0.11.3 hvmarm64ami-0b24a186d5192f876
ap-northeast-3 v0.11.0 hvmamd64ami-0f4281b5e139ff7b5
ap-northeast-3 v0.11.3 hvmarm64ami-0985f0bbb6d2bc996
ap-northeast-3 v0.11.3 hvmamd64ami-0e8335a6a82e2e16d
ap-south-1 v0.11.0 hvmamd64ami-03c7acef43bdbbd21
ap-south-1 v0.11.0 hvmarm64ami-0aa1dd6b4952f562b
ap-southeast-1 v0.11.0 hvmamd64ami-0939f1d186ce6a9bb
ap-southeast-1 v0.11.0 hvmarm64ami-05d2d0ce7f49005d0
ap-southeast-2 v0.11.0 hvmamd64ami-022f55d142168cbeb
ca-central-1 v0.11.0 hvmamd64ami-0acc96aba975a8b0d
ca-central-1 v0.11.0 hvmarm64ami-06a3184047b3d9af4
eu-central-1 v0.11.0 hvmamd64ami-0429d3f39d71cbc79
eu-central-1 v0.11.0 hvmarm64ami-00cb7c2a692f5d04a
eu-north-1 v0.11.0 hvmarm64ami-0bfddafd27a0973d4
eu-north-1 v0.11.0 hvmamd64ami-039170061dbd571c0
ap-northeast-2 v0.11.5 hvmarm64ami-0c672c8870b6c7972
ap-northeast-2 v0.11.5 hvmamd64ami-07f14267bb4daced3
ap-northeast-3 v0.11.5 hvmarm64ami-02f7674d0d4b48ddf
ap-southeast-2 v0.11.0 hvmarm64ami-02133c6033c78f851
eu-south-1 v0.11.0 hvmarm64ami-060d4eeaaa7d9836b
eu-south-1 v0.11.0 hvmamd64ami-037d97ca84b17abcf
eu-west-1 v0.11.0 hvmamd64ami-0dc4022629c26ea96
eu-west-1 v0.11.0 hvmarm64ami-01e67da547e762aa8
eu-west-2 v0.11.0 hvmamd64ami-06be6929d1091a829
eu-west-2 v0.11.0 hvmarm64ami-03f3c978aa17f88b6
ap-northeast-3 v0.11.5 hvmamd64ami-08d9947d4d5ca05ca
eu-west-3 v0.11.0 hvmamd64ami-09ac8361927d20831
eu-west-3 v0.11.0 hvmarm64ami-0a141926398da4f3b
sa-east-1 v0.11.0 hvmamd64ami-002b2941b20df3f96
sa-east-1 v0.11.0 hvmarm64ami-03048a1d9679465e2
us-east-1 v0.11.0 hvmamd64ami-0fdb2f5cb915076a3
us-east-1 v0.11.0 hvmarm64ami-0e278f0f47185365e
us-east-2 v0.11.0 hvmamd64ami-03fc7533fea8ee69d
us-east-2 v0.11.0 hvmarm64ami-0124d0fcc6bf70125
us-west-1 v0.11.0 hvmarm64ami-08baccb9ed66d685b
us-west-1 v0.11.0 hvmamd64ami-00c69e82c5292b6e2
us-west-2 v0.11.0 hvmamd64ami-0973b177563cc8d4e
ap-northeast-2 v0.11.1 hvmamd64ami-0f9d5463430c8dc7b
us-west-2 v0.11.0 hvmarm64ami-0c278fde9aae1b0a2
ap-south-1 v0.11.1 hvmarm64ami-040e641c4d5ec491d
ap-south-1 v0.11.1 hvmamd64ami-03c2ab33aa0ba4d29
ap-southeast-1 v0.11.1 hvmamd64ami-0ad1809b641650a22
ap-south-1 v0.11.2 hvmarm64ami-0fae0bbaf5865c523
ap-south-1 v0.11.3 hvmarm64ami-0ed4a9e168065f10d
ap-south-1 v0.11.3 hvmamd64ami-00fc8c3fe58fe59f2
ap-southeast-1 v0.11.1 hvmarm64ami-08d6ee070a3e5037b
ap-southeast-1 v0.11.2 hvmamd64ami-0d786cd576e74c143
ap-south-1 v0.11.5 hvmarm64ami-026ec99ed95eb8ea7
ap-south-1 v0.11.5 hvmamd64ami-04a26d7b8fc8e080a
ap-southeast-2 v0.11.1 hvmarm64ami-005f2b90c9a10344f
ap-southeast-2 v0.11.1 hvmamd64ami-01c4826ba9d5f084e
ca-central-1 v0.11.1 hvmarm64ami-0317175135d20d598
eu-central-1 v0.11.1 hvmamd64ami-0ddea9ae34d4d2cb6
ap-southeast-2 v0.11.2 hvmamd64ami-0b6f4060e5e045d30
ca-central-1 v0.11.2 hvmarm64ami-056e7abda740e9a03
eu-north-1 v0.11.1 hvmamd64ami-0de44e70b1ca239fb
ap-southeast-2 v0.11.2 hvmarm64ami-038a54566619a5566
ca-central-1 v0.11.1 hvmamd64ami-077ddb5a661f2e085
eu-central-1 v0.11.1 hvmarm64ami-09f3fa65642744976
eu-north-1 v0.11.1 hvmarm64ami-045807c8e06489bbb
eu-south-1 v0.11.1 hvmarm64ami-0fd0479e0fb9ce8a7
eu-south-1 v0.11.1 hvmamd64ami-08584e3871d0f44e3
eu-west-1 v0.11.1 hvmarm64ami-0fc3491956fe0a86b
eu-west-1 v0.11.1 hvmamd64ami-02800882516d4d6f9
ca-central-1 v0.11.2 hvmamd64ami-0a7b1022f946b1705
eu-west-2 v0.11.1 hvmarm64ami-0cfb94e49486a349d
eu-west-2 v0.11.1 hvmamd64ami-017cfdcdb0cc0b082
eu-west-3 v0.11.1 hvmarm64ami-02c2105207bbf7686
eu-west-3 v0.11.1 hvmamd64ami-0019f29b9baae6b62
sa-east-1 v0.11.1 hvmamd64ami-0b18849593cf53aa2
sa-east-1 v0.11.1 hvmarm64ami-05fc23c783fdea3e6
ap-southeast-1 v0.11.2 hvmarm64ami-0b3fef9d19ae485c7
us-east-1 v0.11.1 hvmamd64ami-093c062611bcfcbf2
us-east-1 v0.11.1 hvmarm64ami-0142bfef2de90bd4c
us-east-2 v0.11.1 hvmamd64ami-09dd54a4f52bf78a2
us-east-2 v0.11.1 hvmarm64ami-0af40c8fa54fd8ed4
us-west-1 v0.11.1 hvmamd64ami-04617323b3600643b
us-west-1 v0.11.1 hvmarm64ami-0d1a517423b6563cf
us-west-2 v0.11.1 hvmarm64ami-0e762a70c122bd7ed
us-west-2 v0.11.1 hvmamd64ami-06497e3d94e719a57
ap-south-1 v0.11.2 hvmamd64ami-0809f84563b8bbd1e
ap-southeast-1 v0.11.3 hvmarm64ami-0606957b9ed92b6d5
ap-southeast-1 v0.11.3 hvmamd64ami-069ddd7a5941d6f49
ap-southeast-2 v0.11.3 hvmamd64ami-0e11eb043071b3ff5
ap-southeast-2 v0.11.3 hvmarm64ami-0ab1294bc888be6d1
ca-central-1 v0.11.3 hvmamd64ami-00f41c0dd51bcdd52
ap-southeast-1 v0.11.5 hvmamd64ami-017cbe3f448aa0a4f
ap-southeast-1 v0.11.5 hvmarm64ami-03781d00f8eb8b2a2
ap-southeast-2 v0.11.5 hvmarm64ami-0a301a4357e30b42a
ap-southeast-2 v0.11.5 hvmamd64ami-08618d4e9974ce8c6
ca-central-1 v0.11.3 hvmarm64ami-067a5e2975d4c35ef
ca-central-1 v0.11.5 hvmamd64ami-020ced0e294e36ea0
ca-central-1 v0.11.5 hvmarm64ami-0c91ece961e36eac6
eu-central-1 v0.11.2 hvmamd64ami-08e66d5f383c3befc
eu-central-1 v0.11.2 hvmarm64ami-0edb4be3b60ccc71a
eu-central-1 v0.11.3 hvmarm64ami-06d92e8a29750a54c
eu-central-1 v0.11.3 hvmamd64ami-0e56f41313e953d4f
eu-central-1 v0.11.5 hvmamd64ami-090b6d094c95e8cd5
eu-central-1 v0.11.5 hvmarm64ami-01fe4028f3efb4284
eu-north-1 v0.11.2 hvmarm64ami-01dcbf7426c5633c2
eu-north-1 v0.11.2 hvmamd64ami-0eb4e3abc663b52f4
eu-north-1 v0.11.3 hvmamd64ami-0e22809d738386c69
eu-north-1 v0.11.3 hvmarm64ami-049af8298a0cc8425
eu-north-1 v0.11.5 hvmarm64ami-00df96e1d79c0175a
eu-north-1 v0.11.5 hvmamd64ami-0ed405fe21966ccd1
eu-south-1 v0.11.2 hvmarm64ami-0e254fe7291dc9ebe
eu-south-1 v0.11.2 hvmamd64ami-024670bce5665a2fb
eu-south-1 v0.11.3 hvmamd64ami-05a029c1519d47204
eu-south-1 v0.11.3 hvmarm64ami-0c5a364d4578ebd57
eu-south-1 v0.11.5 hvmamd64ami-037118f55eae2cc54
eu-south-1 v0.11.5 hvmarm64ami-061d13c11d5da37b3
eu-west-1 v0.11.2 hvmarm64ami-07203756ea00457a8
eu-west-1 v0.11.2 hvmamd64ami-02dd72ab4c5264c1e
eu-west-2 v0.11.2 hvmamd64ami-05a12242e30b89288
eu-west-3 v0.11.2 hvmarm64ami-023c5d6506dbf7e42
eu-west-1 v0.11.3 hvmarm64ami-0d6fcf29c6d202725
eu-west-1 v0.11.5 hvmamd64ami-0a1033d9287096805
eu-west-2 v0.11.2 hvmarm64ami-097132e5d130671c3
eu-west-1 v0.11.3 hvmamd64ami-0678d885959f1fc69
eu-west-2 v0.11.3 hvmamd64ami-0444bc3dacfc56ac1
eu-west-1 v0.11.5 hvmarm64ami-04d6ea44fafd35ca7
eu-west-2 v0.11.5 hvmamd64ami-062201bd7d547c433
eu-west-3 v0.11.2 hvmamd64ami-0b2a1355f25ae598e
sa-east-1 v0.11.2 hvmamd64ami-091b5992e20410b53
sa-east-1 v0.11.2 hvmarm64ami-03ffb68cd504acd05
eu-west-2 v0.11.3 hvmarm64ami-035c50beaaa1857fe
eu-west-3 v0.11.3 hvmarm64ami-05be2bf5809da84f1
eu-west-3 v0.11.3 hvmamd64ami-050f5f03f8fb9cd4f
sa-east-1 v0.11.3 hvmamd64ami-0b254ba8b02b77ca5
sa-east-1 v0.11.3 hvmarm64ami-005a6f23f77fdb50d
us-east-1 v0.11.2 hvmamd64ami-0ccb1e2c3ffb3b4d4
us-east-1 v0.11.2 hvmarm64ami-09ceede022b10607a
us-east-1 v0.11.3 hvmarm64ami-02c97ab213f25accc
us-east-1 v0.11.3 hvmamd64ami-01601a5a0752a0c28
us-east-2 v0.11.2 hvmamd64ami-0c7b776ab402577b2
us-east-2 v0.11.2 hvmarm64ami-0503f8e3470cec553
us-west-1 v0.11.2 hvmarm64ami-043e7a485b3a6825f
us-west-2 v0.11.2 hvmarm64ami-01343ccf2da9e5cd5
us-west-2 v0.11.2 hvmamd64ami-0fb01d7cf20f4f6ce
eu-west-2 v0.11.5 hvmarm64ami-01c64b7013ce42221
us-east-2 v0.11.3 hvmamd64ami-0ebfc1310a7583374
us-east-2 v0.11.3 hvmarm64ami-09d2d1df4f674c3da
us-west-1 v0.11.2 hvmamd64ami-0998efd9eab1a780f
us-west-1 v0.11.3 hvmarm64ami-06306c82f4ef3c852
us-west-1 v0.11.3 hvmamd64ami-044405d257d4f4075
us-west-2 v0.11.3 hvmamd64ami-081803410fb8b47a6
us-west-2 v0.11.3 hvmarm64ami-0188f8b5ed3e14587
eu-west-3 v0.11.5 hvmamd64ami-07e45eafe13c3c856
eu-west-3 v0.11.5 hvmarm64ami-068aef2c061be5600
sa-east-1 v0.11.5 hvmamd64ami-0515b9f6d7cdcc26e
sa-east-1 v0.11.5 hvmarm64ami-0a4e9ab7c6b3145d6
us-east-1 v0.11.5 hvmamd64ami-04481be2b235ae8c9
us-east-1 v0.11.5 hvmarm64ami-0f7e3a6c42a97e587
us-east-2 v0.11.5 hvmamd64ami-098db48498e35cdd5
us-east-2 v0.11.5 hvmarm64ami-0f3b7741cdd150536
us-west-1 v0.11.5 hvmarm64ami-06618a472bf5b5793
us-west-1 v0.11.5 hvmamd64ami-060c2a3e52b9482f4
us-west-2 v0.11.5 hvmamd64ami-05b00114dd6f51766
us-west-2 v0.11.5 hvmarm64ami-097f7772417da838a

Creating a Cluster via the AWS CLI

In this guide we will create an HA Kubernetes cluster with 3 worker nodes. We assume an existing VPC, and some familiarity with AWS. If you need more information on AWS specifics, please see the official AWS documentation.

Create the Subnet

aws ec2 create-subnet \
    --region $REGION \
    --vpc-id $VPC \
    --cidr-block ${CIDR_BLOCK}

Create the AMI

Prepare the Import Prerequisites

Create the S3 Bucket
aws s3api create-bucket \
    --bucket $BUCKET \
    --create-bucket-configuration LocationConstraint=$REGION \
    --acl private
Create the vmimport Role

In order to create an AMI, ensure that the vmimport role exists as described in the official AWS documentation.

Note that the role should be associated with the S3 bucket we created above.

Create the Image Snapshot

First, download the AWS image from a Talos release:

curl -LO https://github.com/talos-systems/talos/releases/latest/download/aws-amd64.tar.gz | tar -xv

Copy the RAW disk to S3 and import it as a snapshot:

aws s3 cp disk.raw s3://$BUCKET/talos-aws-tutorial.raw
aws ec2 import-snapshot \
    --region $REGION \
    --description "Talos kubernetes tutorial" \
    --disk-container "Format=raw,UserBucket={S3Bucket=$BUCKET,S3Key=talos-aws-tutorial.raw}"

Save the SnapshotId, as we will need it once the import is done. To check on the status of the import, run:

aws ec2 describe-import-snapshot-tasks \
    --region $REGION \
    --import-task-ids

Once the SnapshotTaskDetail.Status indicates completed, we can register the image.

Register the Image
aws ec2 register-image \
    --region $REGION \
    --block-device-mappings "DeviceName=/dev/xvda,VirtualName=talos,Ebs={DeleteOnTermination=true,SnapshotId=$SNAPSHOT,VolumeSize=4,VolumeType=gp2}" \
    --root-device-name /dev/xvda \
    --virtualization-type hvm \
    --architecture x86_64 \
    --ena-support \
    --name talos-aws-tutorial-ami

We now have an AMI we can use to create our cluster. Save the AMI ID, as we will need it when we create EC2 instances.

Create a Security Group

aws ec2 create-security-group \
    --region $REGION \
    --group-name talos-aws-tutorial-sg \
    --description "Security Group for EC2 instances to allow ports required by Talos"

Using the security group ID from above, allow all internal traffic within the same security group:

aws ec2 authorize-security-group-ingress \
    --region $REGION \
    --group-name talos-aws-tutorial-sg \
    --protocol all \
    --port 0 \
    --source-group $SECURITY_GROUP

and expose the Talos and Kubernetes APIs:

aws ec2 authorize-security-group-ingress \
    --region $REGION \
    --group-name talos-aws-tutorial-sg \
    --protocol tcp \
    --port 6443 \
    --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
    --region $REGION \
    --group-name talos-aws-tutorial-sg \
    --protocol tcp \
    --port 50000-50001 \
    --cidr 0.0.0.0/0

Create a Load Balancer

aws elbv2 create-load-balancer \
    --region $REGION \
    --name talos-aws-tutorial-lb \
    --type network --subnets $SUBNET

Take note of the DNS name and ARN. We will need these soon.

Create the Machine Configuration Files

Generating Base Configurations

Using the DNS name of the loadbalancer created earlier, generate the base configuration files for the Talos machines:

$ talosctl gen config talos-k8s-aws-tutorial https://<load balancer IP or DNS>:<port> --with-examples=false --with-docs=false
created controlplane.yaml
created join.yaml
created talosconfig

Take note that the generated configs are too long for AWS userdata field if the --with-examples and --with-docs flags are not passed.

At this point, you can modify the generated configs to your liking.

Optionally, you can specify --config-patch with RFC6902 jsonpatch which will be applied during the config generation.

Validate the Configuration Files

$ talosctl validate --config controlplane.yaml --mode cloud
controlplane.yaml is valid for cloud mode
$ talosctl validate --config join.yaml --mode cloud
join.yaml is valid for cloud mode

Create the EC2 Instances

Note: There is a known issue that prevents Talos from running on T2 instance types. Please use T3 if you need burstable instance types.

Create the Control Plane Nodes

CP_COUNT=1
while [[ "$CP_COUNT" -lt 4 ]]; do
  aws ec2 run-instances \
    --region $REGION \
    --image-id $AMI \
    --count 1 \
    --instance-type t3.small \
    --user-data file://controlplane.yaml \
    --subnet-id $SUBNET \
    --security-group-ids $SECURITY_GROUP \
    --associate-public-ip-address \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-cp-$CP_COUNT}]"
  ((CP_COUNT++))
done

Make a note of the resulting PrivateIpAddress from the init and controlplane nodes for later use.

Create the Worker Nodes

aws ec2 run-instances \
    --region $REGION \
    --image-id $AMI \
    --count 3 \
    --instance-type t3.small \
    --user-data file://join.yaml \
    --subnet-id $SUBNET \
    --security-group-ids $SECURITY_GROUP
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=talos-aws-tutorial-worker}]"

Configure the Load Balancer

aws elbv2 create-target-group \
    --region $REGION \
    --name talos-aws-tutorial-tg \
    --protocol TCP \
    --port 6443 \
    --target-type ip \
    --vpc-id $VPC

Now, using the target group's ARN, and the PrivateIpAddress from the instances that you created :

aws elbv2 register-targets \
    --region $REGION \
    --target-group-arn $TARGET_GROUP_ARN \
    --targets Id=$CP_NODE_1_IP  Id=$CP_NODE_2_IP  Id=$CP_NODE_3_IP

Using the ARNs of the load balancer and target group from previous steps, create the listener:

aws elbv2 create-listener \
    --region $REGION \
    --load-balancer-arn $LOAD_BALANCER_ARN \
    --protocol TCP \
    --port 443 \
    --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN

Bootstrap Etcd

Set the endpoints and nodes:

talosctl --talosconfig talosconfig config endpoint <control plane 1 IP>
talosctl --talosconfig talosconfig config node <control plane 1 IP>

Bootstrap etcd:

talosctl --talosconfig talosconfig bootstrap

Retrieve the kubeconfig

At this point we can retrieve the admin kubeconfig by running:

talosctl --talosconfig talosconfig kubeconfig .