SERVERS
Every host, inventoried and under control.
Add a server with a hostname and an SSH key. Talos discovers what is on it, keeps the inventory current, and turns every subsequent change into a job someone can point at afterwards.
THE MANUAL WAY
What managing hosts by hand actually looks like.
THE INHERITED FLEET
Fourteen servers, three of them set up by someone who left. Nobody can say which runtimes are installed, which ports are open, or what would break if you patched one.
THE SHARED KEY
One SSH key in a password manager, pasted into four laptops and two CI configs. Rotating it means finding every copy first, so nobody rotates it.
AFTER THE OUTAGE
Something changed on the box at 02:00. Shell history is per-user, was not captured, and the person who ran it is asleep.
WHAT TALOS DOES
Six things you stop doing over SSH.
Agentless connection
Hostname, port, user, key. Nothing is installed on the target — Talos connects over plain SSH and disconnects when the job ends.
Read-only discovery
OS, kernel, runtimes, open ports, running containers, database engines. It writes nothing to the host, so the first thing you run cannot break anything.
Encrypted key storage
Keys are pasted once and encrypted at rest. They are decrypted in memory for the length of a job and never reach a log line or a job payload.
Ansible playbooks as jobs
Idempotent configuration runs through the same queue as everything else, with the same live output and the same audit entry.
Terraform provisioning
Create the host and register it in one flow, with state kept by Talos rather than on somebody’s laptop.
Plan-then-apply reset
Decommissioning shows you the exact list of what will be destroyed, and how each item was identified, before anything runs.
HOW IT RUNS
Every action is a tracked job.
WHAT MAKES THIS DIFFERENT
Decommissioning shows its work before it does any.
Reset used to be the most dangerous button in any control plane: you pressed it and hoped its idea of "this server’s data" matched yours. Talos splits it in two. First it produces a plan — every database, volume, bench and container it intends to destroy, each annotated with how it was identified. You read that list. Only then does apply run, and only against exactly what the plan named.
RELATED CAPABILITIES
Point it at one server first.
Discovery is read-only. It will tell you what it found before it changes anything.