Deploy Talos on AWS multiregions

[marcoferraraUK]

Hi,
I'm starting to learn Talos and I'm trying to deploy it ok AWS multi-regions.

My scope is to have two control plane instance in one region (for example UK) and one in another region (IE).

I created two ELB, one in UK and one in IE.
I created 2 control plane ec2 in UK (set as target for UK ELB) and one in IE (set as target for IE ELB), and I configured ran the commands below:
`
talosctl gen secrets
talosctl gen config talos-cluster-test https://elb_dns_name --with-examples=false --with-docs=false --with-kubespan --kubernetes-version "v1.28.0" --talos-version "v1.6.6" --with-secrets secrets.yaml
talosctl apply-config --insecure --nodes uk_ip1 --file controlplane.yaml
talosctl apply-config --insecure --nodes uk_ip2 --file controlplane.yaml
talosctl apply-config --insecure --nodes ie_ip1 --file controlplane.yaml

talosctl --talosconfig talosconfig config endpoint uk_ip1
talosctl --talosconfig talosconfig config node uk_ip1

talosctl --talosconfig talosconfig bootstrap
talosctl --talosconfig talosconfig kubeconfig
talosctl --talosconfig talosconfig health
`

Now my problem is, if the UK region is down, all cluster is down, how can add the second ELB to the conf generated to have the other region works?

[smira]

There's no beautiful way to do that, but your question is mostly about your (client-side) access to the cluster.

Talos KubePrism feature will automatically provide access to the controlplane of your cluster even if one region is down.

So you can create another LB in another region (or simply use public IP of the working node) in your local kubeconfig to failover to the working site.

Also keep in mind that etcd is quorum-based, so no matter how you distribute them across two regions, only one of them would have the majority (quorum), so when one site is down, etcd might be down (if the minority is up).

tl;dr: you can add some availability to your cluster, but usually two clusters in two regions is a better approach.

[marcoferraraUK]

Hi Smira,
thanks a lot for your reply.

if I create another LB after I can't configure it, because it's different tls to access the existing nodes.

is it correct my conf?
Do I need set one endpoit as uk_ip1, only?

[smira]

You can set up as many LBs as you wish, Talos supports specifying additional certSANs.

Most of your questions are covered in https://www.talos.dev/v1.6/introduction/prodnotes/ and https://www.talos.dev/v1.6/introduction/getting-started/

[marcoferraraUK]

Thanks for the reply, I read these, but I'm a little confused.

For example, I'm trying to configure the solution using DNS.
I created a records A with Control Plane IPs:

192.168.100.100 k8s-api.mydomain.local  
192.168.100.101 k8s-api.mydomain.local  
192.168.200.200 k8s-api.mydomain.local  

I re-generated the conf files using DNS as Endpoint

talosctl gen secrets  
talosctl gen config talos-cluster-test https://k8s-api.mydomain.local:6433 --with-examples=false --with-docs=false --with-kubespan --kubernetes-version "v1.28.0" --talos-version "v1.6.6" --with-secrets secrets.yaml
talosctl apply-config --insecure --nodes 192.168.100.100 --file controlplane.yaml
talosctl apply-config --insecure --nodes 192.168.100.101 --file controlplane.yaml
talosctl apply-config --insecure --nodes 192.168.200.200 --file controlplane.yaml

But I don't understand how can set the endpoint here and add multiple nodes:

talosctl --talosconfig talosconfig config endpoint 192.168.100.100
talosctl --talosconfig talosconfig config node 192.168.100.10
```0


If I add multiple nodes I receive an error when I try to run bootstrap

talosctl --talosconfig talosconfig bootstrap
talosctl --talosconfig talosconfig kubeconfig
talosctl --talosconfig talosconfig health

[smira]

it is unreadable, but I guess you need to look into https://www.talos.dev/v1.6/reference/configuration/v1alpha1/config/#Config.machine (machine.certSANs):

machine:
   certSANs:
     - k8s-api.mydomain.local

[marcoferraraUK]

sorry I don't understand.
could you provide an example, please?

what are the commands to set all 3 control plane as node in talosconfig?
I set only the first control plane as endpoint and node with the commands:

talosctl --talosconfig talosconfig config endpoint 192.168.100.100
talosctl --talosconfig talosconfig config node 192.168.100.10

but in this case if the node is down I can connect to the cluster. how can set it?

[smira]

Please see https://www.talos.dev/v1.6/introduction/getting-started/#understand-talosctl-endpoints-and-nodes

talosctl config endpoint IP1 IP2 IP3