Talos API TLS custom CA injection via machine configuration

Question

Goal: Allow administrators to add trusted CA certificates for the Talos API server by specifying them only in the talosconfig file, avoiding the need to modify the host trust store or rebuild the node image.

Constraint: The Talos API currently validates client TLS certificates against the system default trust store in /etc/ssl/certs, which is populated from firmware and the Talos image at boot and can be extended only by placing .crt files in /usr/local/share/ca-certificates and running update-ca-certificates, a process that requires privileged host access and does not persist across upgrades unless the machine configuration is altered.

Uncertainty: It is unclear whether the talosconfig schema supports a runtime CA injection mechanism that would be merged into the API server’s trust store without touching the host filesystem, or if such a feature would require a node rebuild.

Questions: Does the talosconfig file accept a custom CA field that the API server reads at startup? If not, what is the minimal change needed to enable runtime CA injection via configuration alone? How would upgrades handle persistence of such custom CAs when defined only in talosconfig?

Tasadduq Burney · Answer

Custom CA Injection in Talos OSThe talosconfig file is a client-side configuration used by talosctl; it does not have the capability to inject trusted CA certificates into the remote Talos API server's runtime trust store. To allow the API server to trust a custom CA for client certificate validation, the CA must be defined within the Machine Configuration on the node itself.Implementation via Machine ConfigurationThe minimal way to achieve runtime CA injection without manually modifying the host filesystem or rebuilding the image is to use the caBundle field within the API server configuration. This embeds the certificate into the node's immutable configuration, ensuring it is loaded by the API server at startup.Prepare the CA: Ensure your CA certificate is in PEM format.Modify Machine Config: Add the bundle to the configuration under the API server section:cluster:
  apiServer:
    tls:
      caBundle: |
        -----BEGIN CERTIFICATE-----
        MII... (your base64 encoded PEM content)
        -----END CERTIFICATE-----Apply Configuration: Use talosctl to apply the updated configuration to the target node:talosctl apply-config -n <node-ip> --file machine-config.yamlPersistence and UpgradesBecause this method utilizes the Machine Configuration, the custom CA is stored in the node's persistent configuration state. During a Talos upgrade, the system preserves the existing machine configuration. As long as the configuration is not explicitly overwritten or reset to a default state, the caBundle will persist across version upgrades.Verification and AssumptionsThis approach assumes you are using a version of Talos that supports the caBundle field in the API server schema; this field is version-specific and may not exist in older releases. To verify the current configuration on a running node, you can run:talosctl get config --output yamlCheck the cluster.apiServer.tls section to confirm the bundle is present. If the API server fails to validate certificates after application, check the node logs for TLS handshake errors.Diagnostic Detail Required: Please specify the exact Talos OS version you are running, as schema fields for TLS bundles can vary between major releases.

Talos API TLS custom CA injection via machine configuration

1 answer

Custom CA Injection in Talos OS

Implementation via Machine Configuration

Persistence and Upgrades

Verification and Assumptions

Your perspective belongs here.

0 question comments