Talos client certificate expiry: diagnosing kubelet TLS handshake failures
Static PKI roles and expiry In Talos v1.7–v1.9, each control-plane component — kubelet, controller-manager, scheduler, API server, etcd — authenticates with a client certificate signed by the cluster CA. Least-privilege is encoded statically in the certificate's OU (for example, system:node:<name> ) and enforced by the API server's RBAC authorizer. Mac
talos