Bazalt SPO, a developer of ALT Linux, has introduced ALT Orchestra, a specialized operating system for Kubernetes deployment. The solution is based on the Talos project and is designed to enhance security by eliminating SSH access and running the root filesystem in read-only mode from RAM.
The deployment process relies on the talosctl utility, which manages cluster initialization via API rather than remote shell commands. The system uses a specific partition structure, including EFI, BOOT, META, STATE, and EPHEMERAL sections, to isolate Kubernetes operations and minimize the attack surface.
ALT Orchestra supports various networking services like Cilium, Calico, and Flannel, as well as a discovery service for cluster node management. Users can add extensions for specific hardware, such as NVIDIA drivers for AI tasks, by modifying the minimal base image configuration.
The project utilizes Image Factory for image creation and customization. Bazalt SPO has parameterized the tool to allow the use of proprietary images and flexible deployment schemes, contributing these improvements back to the upstream Sidero Labs repository.
While components are licensed under Mozilla Public License and GPL-3, the final product follows a commercial model: it is free for individuals but requires a license for corporate use. The company also maintains PodSec, a rootless Kubernetes deployment solution developed in 2023.
