Repository navigation
fix: make --insecure reachable for talosctl meta subcommands - #14347
Merged
Merged
Conversation
smira
approved these changes
Sep 11, 2026
smira
left a comment
smira
left a comment
Member
There was a problem hiding this comment.
thank you, I will remove the tests as they are overly complex for a simple issue here
`talosctl meta` groups write and delete and runs nothing itself, so its maintenance-service flags have to be persistent: cobra merges a parent's persistent flags into its subcommands, but not its local ones. Registered locally, --insecure was listed in `talosctl meta --help` while every invocation of it failed with "unknown flag: --insecure". Writing a META key happens before a machine config exists, so the maintenance service is the only route to that operation. Signed-off-by: Aleksei Sviridkin <[email protected]> Signed-off-by: Andrey Smirnov <[email protected]>
smira
force-pushed
the
fix/talosctl-meta-insecure
branch
from
September 11, 2026 10:38
4d84cc1 to
4327e10
Compare
Member
|
/m |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
What? (description)
InsecureFlagsgets anAddPersistentFlags, andtalosctl metaswitches to it, someta writeandmeta deletesee--insecureand--cert-fingerprintagain. Tests cover parsing both flags on the two subcommands, plus a walk over the command tree that fails if a command which runs nothing carries--insecureas a local flag.Why? (reasoning)
Fixes #14346
Since v1.14.0
talosctl meta write --insecurefails withunknown flag: --insecure. #13500 replacedmetaCmd.PersistentFlags()withInsecureFlags.AddFlags(metaCmd), and that one registers in the local flag set. Cobra merges a parent's persistent flags into a child, not its local ones, andmetaCmdisArgs: cobra.NoArgswith noRunE, so the flag had nowhere to land.talosctl meta --helpstill listed it.Writing a META key goes over the maintenance service, before a machine config exists, so there is no other route to that operation.
wiperegisters the mix-in on the subcommands that run and works. Persistent flags on the parent keep bothmeta write --insecureandmeta --insecure writeworking, the same as v1.13.7.Acceptance
Please use the following checklist:
make conformance)make fmt)make lint)make docs)make unit-tests)Conform passes everything except the GPG identity check, which wants the signing key to belong to a siderolabs org member. The CLI reference was regenerated with the same generator the docs target runs, and it reproduces the committed file byte for byte on a clean tree.