feat(talosctl,omni): volumes belongs to talosctl; omni mints the talosconfig

beddari commented

2026-09-19 20:08:56 +00:00

Owner

The disk layout is a Talos fact, so volumes now lives only on dataverket/talosctl/node and the copied layout module in omni is gone. omni gains talosconfig: mints one cluster admin talosconfig for the service account and stores it as a resource with a sensitive content field. talosctl gains a sensitive talosconfigContent argument materialized into a private temp file per call. Wired by CEL in fabrikk-infra. Adversarially reviewed, findings folded in. Published as 2026.09.19.2.

beddari added 1 commit

2026-09-19 20:08:56 +00:00

feat(talosctl,omni): volumes belongs to talosctl; omni mints the talosconfig b0bcd4be88

The disk layout is a Talos fact, so the volumes method now lives only on
@dataverket/talosctl/node, and the copied layout module in omni goes away.
omni gains a talosconfig method: it mints one cluster's admin talosconfig
for the service account in a private temporary directory, removes it, and
stores the content as a talosconfig resource with a sensitive content
field. talosctl gains a sensitive talosconfigContent global argument that
the transport materializes into a private temporary file per invocation
and removes afterwards; it wins over the talosconfig path, an empty string
counts as unset, and the content is redacted from errors. The two are
wired by CEL: nodes from the discovered node records, content from the
talosconfig resource, key from the vault. Reviewed adversarially; the
findings (all-field vaulting from sensitiveOutput, temp file mode, README
drift, migration note, precedence tests) are folded in. 2026.09.19.2.

beddari merged commit 26aa5b17e4 into main

2026-09-19 20:11:34 +00:00

beddari deleted branch talosctl-owns-volumes

2026-09-19 20:11:34 +00:00

beddari referenced this pull request from a commit

2026-09-19 20:11:35 +00:00

Merge pull request 'feat(talosctl,omni): volumes belongs to talosctl; omni mints the talosconfig' (#2) from talosctl-owns-volumes into main

Rows
Columns

feat(talosctl,omni): volumes belongs to talosctl; omni mints the talosconfig #2