Run a managed Kubernetes cluster
Before you start: the one precondition that matters
Section titled “Before you start: the one precondition that matters”The cluster’s subnet needs a gateway attached.
Kubernetes nodes pull container images from the internet. Without egress the machines boot, Talos starts, etcd may even bootstrap — and no node ever becomes ready, because nothing can fetch an image. The cluster builds and then sits there degraded.
If you have not done it yet: Give a private network internet access.
Also make sure the subnet is app or mgmt. A data subnet can never have egress, so a
cluster cannot live there.
1. Create the cluster
Section titled “1. Create the cluster”Kubernetes → Küme Oluştur (Kubernetes → Create cluster).
| Field | What to choose |
|---|---|
| Ad (Name) | Lower-case, becomes part of node names |
| Özel ağ / subnet | A subnet with a gateway |
| Kontrol düzlemi (Control plane) | 1 for development, 3 for etcd quorum. Nothing else is accepted |
| Worker’lar | How many, and which plan |
Creation takes several minutes. Machines are cloned, Talos configuration is generated and attached as a virtual CD-ROM, etcd is bootstrapped, and then the panel waits for the nodes to report Ready to Kubernetes itself.
That last step is why the cluster does not go green immediately. It is measuring, not guessing — an earlier version marked everything ready once the infrastructure steps finished, and produced a green cluster with no working kubelet.
2. Get your kubeconfig
Section titled “2. Get your kubeconfig”Kubeconfig on the cluster page. It is shown once. Save it.
export KUBECONFIG=~/Downloads/kubeconfigkubectl get nodesNAME STATUS ROLES AGE VERSIONprod-cp1 Ready control-plane 6m v1.…prod-w1 Ready <none> 4m v1.…prod-w2 Ready <none> 4m v1.…The panel cannot re-issue it: it does not hold a certificate authority for your cluster, so it cannot mint per-user credentials. Rather than keep a cluster-admin secret indefinitely, it deletes the file after showing it to you. If you lose it, take it from the cluster — the machines are yours.
3. Or use the browser console
Section titled “3. Or use the browser console”kubectl konsolu runs kubectl in a short-lived pod inside your own cluster and
streams it to the browser. Useful when you are away from your own machine, and it always
works even if you lost the kubeconfig.
4. Reach the cluster from your laptop
Section titled “4. Reach the cluster from your laptop”The API server is on a private address. Two ways in:
Zero Trust (recommended). With a gateway joined to your network, the private address in your kubeconfig resolves and works from your laptop directly. Nothing is exposed.
A public address on a control-plane machine is not offered; control-plane machines are not yours to manage. Use the load balancer route below if you need public API access.
5. Install what you need
Section titled “5. Install what you need”zone9 does not install an ingress controller or a storage class. Install what you prefer:
helm install ingress-nginx ingress-nginx/ingress-nginx \ --namespace ingress-nginx --create-namespace \ --set controller.service.type=NodePort \ --set controller.service.nodePorts.http=30080 \ --set controller.service.nodePorts.https=30443NodePort rather than LoadBalancer: a Kubernetes cloud controller that provisions a
zone9 load balancer automatically is planned but not shipped. Today you create the load
balancer in the panel and point it at the NodePort — which is the next guide.
6. If the cluster shows as degraded
Section titled “6. If the cluster shows as degraded”Read the message; it names the nodes that are not ready. The usual cause is the missing gateway.
After fixing the cause, press Yeniden doğrula (Re-verify) on the cluster page. That queues a fresh measurement — it creates nothing and repairs nothing, it only looks. Opening the cluster page also queues one automatically when the status is unsettled.