Talosctl certificate error when multiple endpoints specified in TALOSCONFIG

[ktoulliou]

Hi, I'm not sure if it's a bug or not.

When I set 3 endpoints in my talosconfig file, I need to specify arg "-e 192.168.1.30", because I have this error :

$ talosctl --talosconfig=talosconfig get identities
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate is valid for mycluster-cp0, talos, talos.default, not 192.168.1.30:50000,192.168.1.31:50000,192.168.1.32:50000"

File talosconfig :

context: mycluster
contexts:
    mycluster:
        endpoints:
            - 192.168.1.30
            - 192.168.1.31
            - 192.168.1.32
        nodes:
            - 192.168.1.30
            - 192.168.1.31
            - 192.168.1.32
...

But when I set only 1 endpoint in talosconfig, I don't need to specify "-e" parameter.

context: mycluster
contexts:
    mycluster:
        endpoints:
            - 192.168.1.30
#             - 192.168.1.31
#             - 192.168.1.32
        nodes:
            - 192.168.1.30
            - 192.168.1.31
            - 192.168.1.32

I have trying to modify certSANs but not success.

Note: Endpoints of the talosconfig file is generated by the terraform provider, like this :

data "talos_client_configuration" "this" {
  cluster_name         = var.cluster.name
  client_configuration = talos_machine_secrets.this.client_configuration
  nodes                = [for k, v in var.nodes : v.ip]
  endpoints            = [for k, v in var.nodes : v.ip if v.machine_type == "controlplane"]
}

I managed to reproduce the error without talosconfig, with this command :

$ talosctl --talosconfig=talosconfig -e 192.168.1.30,192.168.1.30 get identities
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate is valid for mycluster-cp0, talos, talos.default, not 192.168.1.30:50000,192.168.1.30:50000"

My question is : Is it normal that talosctl cannot select only 1 endpoint when specifying several in taloconfig or CLI ?
Thanks for your help

[smira]

No, this is not how it is supposed to work.

Are you running talosctl on Windows?

[ktoulliou]

Do you have an example of a no_proxy configuration? I've tested many no_proxy configurations, but the best one I've found is to not set no_proxy. It works better without, with a few exceptions.

[smira]

I don't have examples, you need to refer your networking setup/addresses.

[ktoulliou]

For the proxy issue :

I've removed all proxies configurations on talos machine/cluster config. Network team accepts to bypass for this test.

All services are functioning properly once startup is complete. Everything works perfectly without HTTP/HTTPS/NO proxies, directly connected to the Internet. (With proxies, I believe some discovery services do not use the machine's proxy configuration or Talos environment variable). Why is no_proxy necessary and not automatically generated with Talos? Or are our proxies having issues? I'm not an expert in deploying or maintaining proxies, maybe a transparent proxy would solve the issues?

For the talosctl multiple endpoints issue :

talosctl do the same error with multiple endpoints, with or without proxy (on talos side) :

$ talosctl --talosconfig=talosconfig get disks
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate is valid for mycluster-cp2, talos, talos.default, not 192.168.1.30:50000,192.168.1.31:50000,192.168.1.32:50000"

I can't test without proxy on client side (on my VM who execute talosctl cli)

[ktoulliou]

With corporate MITM Proxy, my no_proxy setup is : localhost,127.0.0.0/8,192.168.0.0/16,.mycompany.com,.svc,172.17.0.0/16,172.18.0.0/16,10.1.0.0/16

Still doesn't work. Some services in Talos, like ETCD at bootstrap, and some localhost, or K8S network access.

[smira]

Issue with talosctl is a bug and it's tracked as #11536

For the in-cluster configuration, I can't say much except for the fact I know it should work if set up properly.