Tinkerbell: Kubernetes-Native Bare Metal Provisioning

▶ Watch (0:02)

Tinkerbell replaces older tools like Kickstart and traditional PXE booting with a Kubernetes-native approach. Three CRD types do the work. A Hardware CRD captures disk and network details for each machine. A Template CRD defines the OS installation steps, structured like a CI pipeline (GitHub Actions or Buildkite are close analogies). Combining a Hardware object with a Template produces a Workflow, which drives power operations, PXE boot, ISO mounting, and full layer-3 static provisioning from start to finish.

Recent Features: Captain OS, Serial-over-SSH, and Autodiscovery

▶ Watch (1:38)

Captain OS is the new lightweight in-memory operating system, replacing Hook OS. Serial-over-SSH lets operators SSH through Tinkerbell directly into a BMC console using public keys, removing the need to configure IPMI tool separately. Autodiscovery mode removes manual CRD creation entirely: power machines on, Tinkerbell finds them, creates Hardware CRDs automatically, and can immediately run workflows based on machine attributes. All three features shipped in the current release.

Bootstrapping Without a Pre-Existing Cluster

▶ Watch (2:49)

Tinkerbell ships as a single binary with zero external dependencies. That binary provisions the initial hardware. Once a permanent Kubernetes cluster exists, all CRDs migrate over and the binary is no longer needed. DHCP handling is flexible: Tinkerbell integrates with an existing DHCP stack or runs fully static layer-3 provisioning when DHCP control is unavailable. Hardware references allow custom third-party CRDs to be incorporated into Tinkerbell workflows by reference, extending the model without forking the project.

Upcoming Work: No-Cloud Data Source and External CAPI Support

▶ Watch (3:38)

Two features are near release. First, no-cloud data source support joins the existing EC2 metadata endpoint, broadening cloud-init compatibility. Second, Tinkerbell will run externally to an existing Cluster API (CAPI) structure. Today the CAPI provider assumes Tinkerbell is internal to the management cluster. The external mode gives teams more placement flexibility and separates the provisioning plane from the management cluster. Template and Workflow references will also expand to match the flexibility already available for Hardware objects.

Notable Quotes

we have a serial over SSH that allows you to SSH through Tinkerbell into the console of your BMC using public keys. No more needing to play with IPMI tool and make sure you have all that set up properly. Jacob Weinstock · ▶ 2:06

Tinkerbell has a single binary, zero external dependencies that you can use and deploy uh to set up your kind of initial run and then transfer all those CRDs over to a permanent cluster and you’re off and running. Jacob Weinstock · ▶ 2:57

Key Takeaways

  • Three CRDs (Hardware, Template, Workflow) replace Kickstart and manual PXE setup.
  • A zero-dependency single binary bootstraps provisioning before a Kubernetes cluster exists.
  • Autodiscovery creates Hardware CRDs automatically when machines power on.

About the Speaker(s)

Jacob Weinstock is a software engineer at NVIDIA and core maintainer of the Tinkerbell project. A self-described open source maintainer and home lab enthusiast, he drives the day-to-day development of Tinkerbell and chairs the project’s weekly community meetings on the CNCF Slack.