Repository navigation
Cannot configure custom certificate authority #12529
Description
Bug Report
Description
When configuring a custom CA as documented here, the nodes no longer properly start and get stuck in a reboot loop.
Have created a patch.yaml file exactly as mentioned in the doc then ran the below command:
talosctl.exe patch mc --nodes 192.168.2.102 --patch @patch.yaml
Node is rebooted and no longer becomes ready.
Checking the logs, it seems that it fails on the task writeUserFiles with the below error:
create operation not allowed outside of /var: "/etc/ssl/certs/homelab-root-ca.crt"
Out of curiosity, I ran talosctl get mc --nodes 192.168.2.102 -o yaml and found that the previous patch op defined this on the machine config:
machine:
files:
- content: |
-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----
permissions: 0o644
path: /etc/ssl/certs/homelab-root-ca.crt
op: createLogs
Activity
frezbo commentedon Jan 2, 2026
Your machine config has
.machine.filesset which should not be used along with trustedrootsconfigAyluinReymaer commentedon Jan 2, 2026
I have no idea what just happened...
Yesterday, I tried installing the CA cert the wrong way, with
.machine.files. However, I edited it out withtalosctl.exe edit mcand rebooted in order to get the node back online.I confirmed that the files property was not there before patching it again with only the trustedrootsconfig this time, which ended up failing and the
.machine.filesappeared once more, even though the patch.yaml file did not have anything to configure this property. It only had the trustedrootsconfig doc.Now, I was replicating the issue once more and gathering screenshots as evidence, replicating the same steps as done yesterday. Even the patch file is the same since I didn't touch it since yesterday.
Now it works... The trustedrootsconfig document is there and
.machine.filesis not...I guess I can close this issue since its resolved, but it is very strange how
.machine.filesended up there when I patched only the trustedrootsconfig, but is not happening again now...