Static Token vs Kubeconfig: Choosing an Authentication Method When API Server Port Cannot Be Changed

Goal

Determine the most suitable authentication mechanism for the Talos API server when the port is fixed at 443 and no built‑in token rotation exists.

Constraints

The static token file is only present during bootstrap and is removed thereafter, so it cannot serve long‑term authentication. The API server offers no port override, limiting external exposure. Kubeconfig requires per‑node client certificates and secure distribution, adding operational overhead but providing stronger isolation.

Unresolved Decision

Which approach best balances security, operational complexity, and future extensibility given the current lack of automatic token rotation and port configurability?

Specific Questions

1. Does Talos plan to expose a configuration option to change the API server port in future releases?
2. What mechanisms are being considered to automate static token rotation or to provide a fallback when the token becomes invalid?
3. Should all nodes rely on kubeconfig certificates, or is there a viable strategy to reintroduce a static token with controlled rotation?