Bootstrap failing with failed to verify certificate: x509

I would've submitted a discussion since its more of an question rather than an issue

($cp1ip is just shorthand for 192.168.102.x)

This is running on vagrant and libvirt, bootstraping a cluster via talosctl when using talosctl gen config works fine, but I wanted to give talm a try

What I did

talm init
Setup the talosconfig and the endpoint

> export TALOSCONFIG=$(realpath ./talosconfig)
> talosctl config endpoint $cp1ip

Create templates

> talm template -e $cp1ip -n $cp1ip -t templates/controlplane.yaml -i > nodes/cp1.yaml
> talm template -e $w1ip -n $w1ip -t templates/worker.yaml -i > nodes/w1.yaml

Apply configs

 > talm apply -f ./nodes/cp1.yaml -i
- talm: file=./nodes/cp1.yaml, nodes=[192.168.121.90], endpoints=[192.168.121.90]
> talm apply -f ./nodes/w1.yaml -i
- talm: file=./nodes/w1.yaml, nodes=[192.168.121.6], endpoints=[192.168.121.6]

Bootstrap

> talm bootstrap -f ./nodes/cp1.yaml
error executing bootstrap: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake
 failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

Hey, Talm is storing talosconfig in the same directroy with the project, you can copy your talosconfig into root project directory, or override path in Chartt.yaml

Andrei Kvapil (@kvaps)

Andrei Kvapil (@kvaps) I believe that is the case

>  tree
.
├── charts
│   └── talm
│       ├── Chart.yaml
│       └── templates
│           └── _helpers.tpl
├── Chart.yaml
├── flake.lock
├── flake.nix
├── justfile
├── nodes
│   ├── cp1.yaml
│   └── w1.yaml
├── patch.yaml
├── secrets.yaml
├── talm
├── talosconfig
├── templates
│   ├── controlplane.yaml
│   ├── _helpers.tpl
│   └── worker.yaml
├── Vagrantfile
└── values.yaml

I'll redo it again

vagrant up (after wgeting 1.10 talos image)

> ./talm init
Created secrets.yaml
generating PKI and tokens
Created talosconfig
Created values.yaml
Created charts/talm/Chart.yaml
Created charts/talm/templates/_helpers.tpl
Created Chart.yaml
Created templates/_helpers.tpl
Created templates/controlplane.yaml
Created templates/worker.yaml

talm template -e $cp1ip -n $cp1ip -t templates/controlplane.yaml -i > nodes/cp1.yaml

> ./talm apply -f ./nodes/cp1.yaml -i
- talm: file=./nodes/cp1.yaml, nodes=[192.168.121.54], endpoints=[192.168.121.54]

> ./talm bootstrap -f ./nodes/cp1.yaml
error executing bootstrap: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dia
l tcp 192.168.121.54:50000: connect: connection refused"

Vagrant.configure("2") do |config|
  # Define resources for the VMs
  resources = {
    "control-plane-node-1" => {
      ip: "192.168.56.100",
      cpus: 2,
      memory: 4096,
      disk_size: '16G',
    },
    "worker-node-1" => {
      ip: "192.168.56.103",
      cpus: 2,
      memory: 4096,
      disk_size: '16G',
    }
  }

  # Loop through resources and configure VMs
  resources.each do |name, config_data|
    config.vm.define name do |node|
      # TODO: fix this, talos maybe doesn't respect the setting
      # node.vm.network :private_network, :ip => config_data[:ip]
      node.vm.provider :libvirt do |domain|
        domain.cpus = config_data[:cpus]
        domain.memory = config_data[:memory]
        domain.storage :file, device: :cdrom, path: "/tmp/metal-amd64.iso"
        domain.storage :file, size: config_data[:disk_size], type: 'raw'
        domain.storage :file, device: "vdc", type: 'raw'
        domain.boot 'hd'
        domain.boot 'cdrom'
      end
    end
  end
end

Is there a way to apply a patch while generating the configs? Maybe that is causing issues

Controlplane nodes/cp1.yaml

# talm: nodes=["192.168.121.54"], endpoints=["192.168.121.54"], templates=["templates/controlplane.yaml"]
# THIS FILE IS AUTOGENERATED. PREFER TEMPLATE EDITS OVER MANUAL ONES.
machine:
  type: controlplane
  kubelet:
    nodeIP:
      validSubnets:
        - 192.168.100.0/24
  network:
    hostname: talos-18f96
    # -- Discovered interfaces:
    # ens6:
    #   hardwareAddr:52:54:00:88:74:39
    #   busPath: 0000:00:06.0
    #   driver: virtio_net
    #   vendor: Red Hat, Inc.
    #   product: Virtio network device)
    interfaces:
      - interface: ens6
        addresses:
          - 192.168.121.54/24
        routes:
          - network: 0.0.0.0/0
            gateway: 192.168.121.1
    nameservers:
      - 192.168.121.1
...

And my patch is

machine:
  network:
    interfaces:
      - deviceSelector:
          physical: true # should select any hardware network device, if you have just one, it will be selected
        dhcp: true
        vip:
          ip: 192.168.121.100

Hi, I think you need to properly edit the values.yaml that is generated after talm init

It looks like a templating issue with default network (from default values.yaml) that does not align with your nodes ip

lb0o

Same issue here. lb0o What does "default network" mean?

I can bootstrap a cluster with talosctl but the instructions for talm as laid out in https://cozystack.io/docs/v1/install/kubernetes/talm/
don't work for me.

Andrei Kvapil (@kvaps) any ideas?

talm --version
talm version 0.22.4

I am on MacOs Ventura.

here is my values.yaml

endpoint: "https://192.168.178.159:6443"
clusterDomain: cozy.local
floatingIP: 192.168.178.99
image: "ghcr.io/cozystack/cozystack/talos:v1.12.6"
podSubnets:
- 10.244.0.0/16
serviceSubnets:
- 10.96.0.0/16
advertisedSubnets:
- 192.168.178.0/24
oidcIssuerUrl: ""
certSANs: []
nr_hugepages: 0
allocateNodeCIDRs: true

here is my full node1.yaml

# talm: nodes=["192.168.178.159"], endpoints=["192.168.178.159"], templates=["templates/controlplane.yaml"]
# THIS FILE IS AUTOGENERATED. PREFER TEMPLATE EDITS OVER MANUAL ONES.
machine:
  type: controlplane # Defines the role of the machine within the cluster.
  # token: kfs1gy.w0ctpkk02cpcy4ew # The `token` is used by a machine to join the PKI of the cluster.
  # # The root certificate authority of the PKI.
  # ca:
  #   crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEFtQ3Z5a3A2QWFoSzYweUJhWFkzaUVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQTBNRFV4TWpFMk1ERmFGdzB5TnpBME1EVXhNakUyTURGYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWVab1JadXhNc3JzaGRpWkVBR2MrV1Urb0NrOWpBQmVlCnQycDMyK1VLcDk2alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCVGhWS2hXRHdJbHdmby9qWG1GRkZDN1pFVzdEVEFGQmdNclpYQURRUUNHRlpzbApRWHdzbm9RdkRiSGZxZmlpZnRqeHd6OWNvQnhRQUtLQVQ3UWJOTWZXWHRxRWRGeWV0K0kzSDdwaFpHOUp4cUQwCjc5VjUrcGpDbUh4RGl3TUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  #   key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJTlQwSTJEVm5MVGlHTFl2dUNPSjhXZXMyWndmL3FUQkpVR1ZzbmJ2Y2lvbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
  # # Extra certificate subject alternative names for the machine's certificate.
  certSANs:
    - 127.0.0.1
  kubelet:
    extraConfig:
      cpuManagerPolicy: static
      maxPods: 512
    nodeIP:
      validSubnets:
        - 192.168.178.0/24        

  network:
    hostname: talos-a7053
    interfaces:
      - interface: enp0s3
        addresses:
          - 192.168.178.159/24
        routes:
          - network: 0.0.0.0/0
            gateway: 192.168.178.1
        vip:
          ip: 192.168.178.99
    nameservers:
      - 192.168.178.1

  install:
    disk: /dev/sda
    image: ghcr.io/cozystack/cozystack/talos:v1.12.6
    wipe: true

  files:
    - content: |
        [plugins]
          [plugins."io.containerd.grpc.v1.cri"]
            device_ownership_from_security_context = true
          [plugins."io.containerd.cri.v1.runtime"]
            device_ownership_from_security_context = true
      permissions: 0o0
      path: /etc/cri/conf.d/20-customization.part
      op: create
    - content: |
        backup {
          backup = 0
          archive = 0
        }
        devices {
           global_filter = [ "r|^/dev/drbd.*|", "r|^/dev/dm-.*|", "r|^/dev/zd.*|" ]
        }
      permissions: 0o644
      path: /etc/lvm/lvm.conf
      op: overwrite
  sysctls:
    net.ipv4.neigh.default.gc_thresh1: "4096"
    net.ipv4.neigh.default.gc_thresh2: "8192"
    net.ipv4.neigh.default.gc_thresh3: "16384"
  registries:
    mirrors:
      docker.io:
        endpoints:
          - https://mirror.gcr.io
  kernel:
    modules:
      - name: openvswitch
      - name: drbd
        parameters:
          - usermode_helper=disabled
      - name: zfs
      - name: spl
      - name: vfio_pci
      - name: vfio_iommu_type1
  nodeLabels:
    node.kubernetes.io/exclude-from-external-load-balancers:
      $patch: delete
    
# Provides cluster specific configuration options.
cluster:
  # id: soNArMT6M0JMlBzxP1mC0QPqB5v8w4QaKm5Fmh04FFE= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
  # secret: v+3X5QWHTq5tC/oQtGoYKOdL4+UiA9LPOIx0O4nlOec= # Shared secret of cluster (base64 encoded random 32 bytes).
  # token: as1il1.d866jj6repl2d2is # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
  # secretboxEncryptionSecret: pQAxYrTg1W16zrACdIfpyAOoY8Ng+ar25EqbgWSwJ8Y= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
  # ca:
  #   crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEFtQ3Z5a3A2QWFoSzYweUJhWFkzaUVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQTBNRFV4TWpFMk1ERmFGdzB5TnpBME1EVXhNakUyTURGYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWVab1JadXhNc3JzaGRpWkVBR2MrV1Urb0NrOWpBQmVlCnQycDMyK1VLcDk2alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCVGhWS2hXRHdJbHdmby9qWG1GRkZDN1pFVzdEVEFGQmdNclpYQURRUUNHRlpzbApRWHdzbm9RdkRiSGZxZmlpZnRqeHd6OWNvQnhRQUtLQVQ3UWJOTWZXWHRxRWRGeWV0K0kzSDdwaFpHOUp4cUQwCjc5VjUrcGpDbUh4RGl3TUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  #   key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJTlQwSTJEVm5MVGlHTFl2dUNPSjhXZXMyWndmL3FUQkpVR1ZzbmJ2Y2lvbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
  # ca:
  #   crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpVENDQVRDZ0F3SUJBZ0lSQUxGU1ZCbUM4K3l3NjdHLzhpTnhGZmd3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakEwTURRd09USXhOREJhRncwek5qQTBNREV3T1RJeApOREJhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVRSNlVUdEdxT08vQ01CYjU1cCt2Tnkzemx3bWRDMFZuVGNGblVLbldzT0puem44TFdIRTAyZ0VsSkkKMzdSODA4M2p1TmdqM1huSWhsUnNuNGV5dlJBaW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGQUx0NlRaR2psK3NYb3QrMjhtdUR5QmhmK1dkTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDSUFXOER0U0cKNXErN3NZRE16U0M4Q3dkdE0xeHBCTnpSbHJxRFBnaUg3bk1hQWlBRGpzak1nRElRV3p5TXc1RmNGckVPcWVhcgphaDY5Z29rOExWeWZGNEw5enc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  #   key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUk5eHBFZ0tweEVGdlkvTVNKcWw2TG1pNWZMZUZuRDBZVkZ6T2xvMVJOV05vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFMGVsRTdScWpqdndqQVcrZWFmcnpjdDg1Y0puUXRGWjAzQloxQ3AxckRpWjg1L0MxaHhOTgpvQkpTU04rMGZOUE40N2pZSTkxNXlJWlViSitIc3IwUUlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
  # # The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
  # aggregatorCA:
  #   crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYakNDQVFXZ0F3SUJBZ0lRUlZpYmVvcklNMEdxZlhvTjAwcVZHakFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1EUXdOREE1TWpFME1Gb1hEVE0yTURRd01UQTVNakUwTUZvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCSUFRR2ZsbGQyMlVBUEl2T2xCVllrTWIzK3VYbUo1di8rb3g2cDZ1UTFUc1JndUZGRm5ECkN0WkxqdVRPWCsrY2NqYXQ1SExQeXFaRXJKYUpyb2R1dXZPallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVUwU25ORDhIUTJhWllENTZKNm5mU0JIcmhWWGN3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnCmROb3ZLNWg1b0tKNUZvTmZzb204QWJLbnZIQnBNY20zU0R1blkvM2hqbUFDSUdtMzltbHJVUG5HemY5dWRTZW0KWXRRR0srQ2g3UE9HZlNaOWZDS3YxZ2ZPCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  #   key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSURvTVM4MVVaVVFndVp4N3RDekU3QVhmamFrdlJGSVM0d2hJL0NzR0lQdEZvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFZ0JBWitXVjNiWlFBOGk4NlVGVmlReHZmNjVlWW5tLy82akhxbnE1RFZPeEdDNFVVV2NNSwoxa3VPNU01Zjc1eHlOcTNrY3MvS3BrU3Nsb211aDI2Njh3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
  # # The base64 encoded private key for service account token generation.
  # serviceAccount:
  #   key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBcDZxdFlqTGF1Tm94VWYydGxLeU8xbVBZSnJjdENXUk9jenROOWxSeWJxTXRjQlAvCjZEaDVuZHhnRVh3MWFQWThiTlphQ1I0SVpXd0hYNGNnT2d6YlJWdW54V2pGNFdEMjhhU01GVmNIN2JsR2M5VTkKQkRsRm5EVTFBNzdqTGFUTUw3M0V6NE55Vk9NTm14L245MHl0WGJXbE1JQ3kyZ1pqc0Y1ZzFvOUJiYWdhMFB3bwp5ZjlZdWFkc2wwM1B5QlhOVVZQekJzR3d1eTdrQkhSUHZOVnBVNFcyNUhxREYzS2FRSUlIUUU0cnB4Nzh2ejdvCm9vU0NYVStFZysyVjNySXhjWlZOM1dmYkJhSDdTZGdXMUNFQTVjeitiSjBmL05JY0xoS2didUprK3ptTHhUSDYKckFsNnRTTHNkc2hudFhZNHRFUER1ejIxWEUxeUVyMXVCS2V1ZThsbFZ0SGErR2FNNjYwSzlWSnlsbXY2b2JkcwpRZ2ZTN2h1UW42d2RXTTJPWUowMUg3b1FqQkNQcVNmbEFWdnlmTFBtMkd6R3cvN2VXRVlETlhsdjkvd3pjWE1hCkxFOWJLNHpOMzUzSVZlaCtQdXVIU0x5RWJkL3oxUzBQek9TcitFLzFtNEhlaFkzUitFVGc2WStPcEdKU1JzSjEKT2EyVlB4SUZsNWY1TUEzLzNSN2VqSDdTRHRSdkprb2QzdURuRVVHMlNIWmFZc3RlaHIwNEd0VXo4UytoenpTUApxOGZVOG1iRk05cmM4V0xnYmhmTVhYTlNNYy8vdGRNeHRNYVA3VVpLbDlFaEJVVTRscTcrR1h2NmJVTm1xNTRzClR6V2pyL0toQlBSV1Q5bnEwUENPTnVGZXYvZHpmc1pQVEczRG5CNWF0dkVBSDNsNEFuaFFvaXRhQ2kwQ0F3RUEKQVFLQ0FnQThoaktmaTU4RDhwT3lOc0kxdEpLOVZuNTgvMHV0STczai8rajFQbWV1ZzQ0UDh0QkNtanhnbldBNgpmNTFpSGQwVEpzK0trZ0pTNWt2RkVxaXgrOWtkY09nZnJXSWRLUjBMZnF3b3VlbDlTWS9pbVh1MHJoM3dOUTdGCm90OHNKMXlqOFR0OTgwUE8yOFdhRlVydHJRcTZGS3VrVmhqNTlpdC9TNXBtYVlFalhmY01NTEppdEovcEtNUmMKMi9SaEZHbXc3WDZCbG1LL056Nk5VeFZEbzhBcEs5QXBLd1p1Yk9xODFaTmJoYnhoVUNESndxSkVwRlBRN2piMgpUc24yZ1ZteTJFUXE0K1llNHVtc3J1b1N1alV5UHkwcXRRK0tlcWc4ZzNIUmhUMFJxU1RJMHZGYnIvSlJOK0duClFWR2FvaW4yL0sxSHhvOVUyZ29QTkwxbHhjZ0lobUpEcld0Q0lFTy9iOGNLNkkvM25hSndsaDh0RVR5QTNHRUMKa2xEYThXbTJQQjI2ZGM1ZSszUXRFRGlpaTZYQWR0S2h6Z2tQdDMvcnFpa3gvYmtjMmtZV204VXJIRXF6REd6SwpGNVFZS0g0WlZPV2NCWW1xeDkwYVhGLzQzZnl3c1ZkVHlJK09ya0RsVjRSM0lCNWxFb3lOZjJvajZlL3Jmb3dzCkQ5dzlJeG53dWVQelZVbi9aS1Y1d0UrcGV4Q2NXZy9vejBKWmI4NkFUM201Wlp4eEE5WEVTWnFKZ09CR3ZvZmUKZHEyMWt0V29GMWh5UFFkR3NtRVNCeWVtRVZKd3BoaWgvb2ozNi9VZE9MYTBsK2Y4UDRTVjc4TTdkQkRCOXRwWgoxRnJnYkN4aVFUaDdFT0ZYTXV5Zzk0K0FkeGdsL1hLRk80YVJxMG1nWC9uZEJhV1Bld0tDQVFFQXdKOTJreG1MCjRWQWpLY2dHZEs3cnlhSHk1cm4yVmVaZmNTc1QyajAwSGl4bjJRaXJSTllnYVJkaExHUlhkZGFvekpGRWk2WGMKMlJ1SjVlUjBUNWdVZGtBdld2UFd5UmxmNlphckw2dkM0RjZoMVp3WHBTdzBNYVFNRURjY05TWWxrVVp6Vm53WApqL0tROCs2b2J6ck4rYVJEQUZUdGhrKy9QM05kckM4amxMUzcvTGdxYlc5dzJlYmpHeDBrbVhxS3libWR0bDJwCkgvN2Ryck1HaTV2ZmpmaHYwMnBwZDNQekRIQ0VWczROYzRJRmI0UFF2VVIwSCtUYkVZWE5YakxlaEluSUEycFEKaGM1Z2hqQ1R1OGhVVHhCUlVtTkUwSDJaTWZWQmxRNWY5TmN2YlVvMzFmeUp3eUdKalQ3SnNTVkE1QmRsMmlITAphV3FNOGdTb2FaT1Rtd0tDQVFFQTN0VXFYaDJrQ2E3K0J6Yk9WNk5pb29wa2dDM2x4d3BuL2dka2N2eDI5ejBOCjBoTGc0U1lYQ1A1RWpEK3c0WDJEa296TDJ1aG9ud2dOMERDM1JodGM1Tk1sMmxJSDYrRkVnMk1jZDk3SEpveXoKOUw5T3haZzZoNi9oUDlhWCswVVAvSXJ5dkhMSWVzNklUNGFCMmd0VmlvYmFScWZ2c25oc2tubmZTSUdzQUFWSgpXM044Z2JSZnQ4b0l2YjZzSzljSVkrazVEbXF4U0FsbUZkRjdvdGU5SXkwYzFpbE1yOXNVYWF5RDI0NC9HaTRRCi91TzlURklVUXFoUWN4L3JmTTlVSlk3NEEwK2J5aWVKRSs5bEFxV3RCNzNIL2JoYUpoVEh2RjI4VjNkSUlvZ2gKcnB0Zy81M2czY3FJZVdyNWlQMXJNdEFCVjhEKzVaZkMvMEgrUU1QcDF3S0NBUUE1ZU5yR05SOFpVUEhNNjVPUgppUWR0RjljRHBJU3RTSms5aU43WmhOMWlDMW5JMWQ5VUlKZDNBN1RJcS8rMGR5SFNONTIrRlBUNkNrOXd1bU5CCnhGeUdrOHdOVlNmR3hMMXJVcnNzOUJDbkpWVWdDUHk5R1oxUkdtTkhDMHB0U1Q1NFJBN3h4UUM2d0dNamhSZlkKYURGQXhSUUFxMVpiZHJ2WFVMS29SMEJVaEVCNnZQQmJ5cDVmUlphSlpuNmZGSU1JZ1V0Zk9EN1gveEZocUtUUgpUdWE2MDE5Nk13dll5azNBYm1udUJIamE5L1pyT1djMHNaSDhXaXBLNWlOS2NkOFdxSTEzQjJlVEpPcUQzMGFWCkJzYXcrR3RySzVkQ3BkYnBvd1c0Vlp1bnovU2twVHBYckl2bUhzR04xU2dVcE1yaHcyRnVYaHIxRHdlU3huVUIKV3pqMUFvSUJBUUMybUlpeVBLbTV3YXFwc0xCZlFpUkdPdzlsdGJhUFpxaVdrZW92QzFCVkFyTzdpL3E0cEdURgoyczNDKzBIdlZOR25HamJGK0NJYkJ4ZUNuUmpobXZTQkVjRDM2TFpUQlBJR2xBVzArRm5LN2d0Y3FCTmRlWU9rCndtdmF5dmNaVUp0ci8xUXZOZ093Rm1PK2Z1TVRFS3lVNmpJZEtlb1NIZm9pQVRvRmlUU3ZnNlY4Q2VOaHliT1IKd0QxdmRycFE1bEVheGZjYUtEV0RhU2c5QXI3RVR2TE95MTNRNUdEUnpiMHBadE5aNjNNcitjbTFoRnNQR2tjOQo0L3lnaWV5SEJzSFdVUlJNYWtTbjM4UEZFU3Q5Z3RPSi8yck5MdTY0TzlqOE12ZHQyUEhFVWpiL2hKVjBnU1BOCnV2UWdRcGVlT01OS0RRYThxUXAyaXVpZ0VLek8xM3RiQW9JQkFRQzBvSzVDWE9TQkc0bG1sTEpUSTBkQ01tbUsKdG5DVG9VdHFVT0h3M3JHNENlb2pNNlgzUHZxOVo2clN2NmxUeXpTZEJLTndnSllGTHo5MjRsK3lkblRDNlJqMApoTTZHS1dPKzYrZVJsVEFWZjJDZnRZUVJMakl0MzhxWHpXNGwwNzlVRExnZy92NmFCNzZWdWtJVEVuSWFMNzdkCnpQVXhPNXc4dnlVZUZKQU53Q0NGZFU5bjQvazM5U2RuT0ZWVGU4VkpYNGNLck5tUUt3TkpzRFluM2dGcCtaakcKV3pvVHBMQTJ2UXpVMUF5Z1pRbnNTbTRrUFNPYmxFMU9oY2tsU3IzazlFV1hhbVIvZm1RaDFaay8wVFB4N2JvWAoyUUN5Smg5R2RXaHhCVVRYSytzVUNqcEVGNDQva0tBSlV3cHIxWno0NFdEN2pteW4yaldJUmhXbGZjdjUKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
  controlPlane:
    endpoint: https://192.168.178.159:6443 
  clusterName: cozystack 
  network:
    cni:
      name: none
    dnsDomain: cozy.local # The domain used by Kubernetes DNS.
    # podSubnets:
    #   - 10.244.0.0/16
    serviceSubnets:
      - 10.96.0.0/16
  apiServer:
    certSANs:
      - 127.0.0.1
  controllerManager:
    extraArgs:
      allocate-node-cidrs: "true"
      bind-address: 0.0.0.0
      cluster-cidr: 10.244.0.0/16
  proxy:
    disabled: true
  scheduler:
    extraArgs:
      bind-address: 0.0.0.0
  discovery:
    enabled: false
    # enabled: true # Enable the cluster membership discovery feature.
    # registries:
    #   kubernetes:
    #       disabled: true # Disable Kubernetes discovery registry.
    #   service: {}
  etcd:
    # ca:
    #   crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNPZ0F3SUJBZ0lRWFpORzlNUlF4SHBkWFc1T1c5WWRxekFLQmdncWhrak9QUVFEQWpBUE1RMHcKQ3dZRFZRUUtFd1JsZEdOa01CNFhEVEkyTURRd05EQTVNakUwTUZvWERUTTJNRFF3TVRBNU1qRTBNRm93RHpFTgpNQXNHQTFVRUNoTUVaWFJqWkRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQk1CMGVVbFExbmx3ClZGYUlrN2QzN3V6YlVrZlFSNE9sQktPd2lxTU5LRWZlZGxjRHU2Z1diV0FzOWNKZjRhM3RvL1h5ckc2QnJJTjkKK3FJUTU4SDNxZzJqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjRApBUVlJS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVUTZOTjVDeWFNODJtCkJoRUpEV2k5dzd5K1J1VXdDZ1lJS29aSXpqMEVBd0lEU0FBd1JRSWdlTWpTank3MVVwYjNqRFdqMFhkK2VUUEYKOWZWNmhvWHJIUXZxOVZQQ1BLUUNJUUNMV2dTMk9RVGljSzl6WXZvY3hCM3ZBRTJVYzBobmVBVUFnNkk4SnFVTgpIZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
    #   key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUdkb0lDMHJ2eTRXMTVEUDl0SXNFR0NwRHpra0xIeEhmTHViWThHQytkV2dvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFd0hSNVNWRFdlWEJVVm9pVHQzZnU3TnRTUjlCSGc2VUVvN0NLb3cwb1I5NTJWd083cUJadApZQ3oxd2wvaHJlMmo5ZktzYm9Hc2czMzZvaERud2ZlcURRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
    advertisedSubnets:
      - 192.168.178.0/24
  allowSchedulingOnControlPlanes: true

talosconfig

context: cozystack
contexts:
    cozystack:
        endpoints:
            - 192.168.178.159
        nodes:
            - 192.168.178.159
            - 192.168.178.160
            - 192.168.178.161
        ca: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQakNCOGFBREFnRUNBaEFHbE9lZ3dXU295NkRsTklxbzJweW5NQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQTBNRFV4TWpFMk1ERmFGdzB6TmpBME1ESXhNakUyTURGYU1CQXhEakFNQmdOVgpCQW9UQlhSaGJHOXpNQ293QlFZREsyVndBeUVBbzJGaXpib1IxcFdSN1pPeHVjbFNGRjYyUFlMWm4wQWhXczBsCk9Qb3YvUktqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDaERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FVNFZTb1ZnOENKY0g2UDQxNQpoUlJRdTJSRnV3MHdCUVlESzJWd0EwRUFSN3J1aWd1azdDdnExQjFDTkhFaFQ4V3NHSFJUSjZpc2ZHZVY2NER4Ckx5aDhzVy80ZHdEVkFrS1I4RzVuZ1Z6VnF2ZnBjUk14dW1IQnVOQnE3N0x4Q3c9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
        crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJLRENCMjZBREFnRUNBaEFtQ3Z5a3A2QWFoSzYweUJhWFkzaUVNQVVHQXl0bGNEQVFNUTR3REFZRFZRUUsKRXdWMFlXeHZjekFlRncweU5qQTBNRFV4TWpFMk1ERmFGdzB5TnpBME1EVXhNakUyTURGYU1CTXhFVEFQQmdOVgpCQW9UQ0c5ek9tRmtiV2x1TUNvd0JRWURLMlZ3QXlFQWVab1JadXhNc3JzaGRpWkVBR2MrV1Urb0NrOWpBQmVlCnQycDMyK1VLcDk2alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0QKQWpBZkJnTlZIU01FR0RBV2dCVGhWS2hXRHdJbHdmby9qWG1GRkZDN1pFVzdEVEFGQmdNclpYQURRUUNHRlpzbApRWHdzbm9RdkRiSGZxZmlpZnRqeHd6OWNvQnhRQUtLQVQ3UWJOTWZXWHRxRWRGeWV0K0kzSDdwaFpHOUp4cUQwCjc5VjUrcGpDbUh4RGl3TUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
        key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJTlQwSTJEVm5MVGlHTFl2dUNPSjhXZXMyWndmL3FUQkpVR1ZzbmJ2Y2lvbgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K

Andrei Kvapil (@kvaps)

Fixed! Andrei Kvapil (@kvaps) lb0o Nikola Milovic (@Nikola-Milovic).

Guide under https://cozystack.io/docs/v1/install/kubernetes/talm/ says:

talm init --preset cozystack --name mycluster
# edit values.yaml
talm template -e 192.168.123.11 -n 192.168.123.11 -t templates/controlplane.yaml -i > nodes/node1.yaml
# edit node1.yaml
talm apply -f nodes/node1.yaml -i
talm bootstrap -f nodes/node1.yaml

What worked:

talm init --preset cozystack --name mycluster
# edit values.yaml
talm template -e 192.168.123.11 -n 192.168.123.11 -t templates/controlplane.yaml -i > nodes/node1.yaml
# edit node1.yaml
talm apply -f nodes/node1.yaml -i --with-secrets secrets.yaml
talm bootstrap -f nodes/node1.yaml

kvapil I think talm should automatically look for and use the secrets.yaml if it exists.

Great you solved it, could you describe what was the misalignment between the two generated template? If I remember well, some options help to debug such as talm option --full to see all fields in template output

did you try to apply with --with-secrets parameter?

Per @veith4f's confirmation above (2026-04-06), the bootstrap failure was a misalignment between the default values.yaml generated by talm init and the node's actual network — not a bug in talm itself. Following the install guide and editing values.yaml to match the cluster network resolves it; --with-secrets on apply was also relevant.

Closing as resolved. If anyone still hits an x509 failure after aligning values.yaml to their network, please open a fresh issue with the rendered config and talosctl output.

Navigation Menu

Repository navigation

Bootstrap failing with `failed to verify certificate: x509` #61

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Bootstrap failing with failed to verify certificate: x509 #61

Description

Activity

kvaps commented on May 29, 2025

Nikola-Milovic commented on May 29, 2025

lb0o commented on Jul 23, 2025

shepses commented on Apr 5, 2026

shepses commented on Apr 5, 2026

lb0o commented on Apr 6, 2026

shepses commented on Apr 6, 2026

lexfrei commented on Apr 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Bootstrap failing with `failed to verify certificate: x509` #61