marco/veda
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Document Talos client certificate renewal

Browse Source
This commit is contained in:
Marco van Zijl 2026-05-17 12:29:04 +02:00
parent 79c5bdf760
commit fd769a6648
1 changed files with 47 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
readme.md
View File

@ -74,7 +74,7 @@ contexts:
# (...) # (...)
``` ```
For controlplane nodes: For control plane nodes:
```bash ```bash
talosctl gen config \ talosctl gen config \
@ -227,16 +227,57 @@ partprobe $DISK
### Certificate lifetimes ### Certificate lifetimes
Talos Linux automatically manages and rotates all server side certificates for etcd, Kubernetes, and the Talos API. Note however that the kubelet needs to be restarted at least once a year in order for the certificates to be rotated. Any upgrade/reboot of the node will suffice for this effect. Talos Linux automatically manages and rotates server-side certificates for etcd,
Kubernetes, and the Talos API. Note however that the kubelet needs to be
restarted at least once a year in order for the certificates to be rotated. Any
upgrade/reboot of the node will suffice for this effect.
You can check the Kubernetes certificates with the command `talosctl get KubernetesDynamicCerts -o yaml` on the controlplane. You can check the Kubernetes certificates with the command `talosctl get KubernetesDynamicCerts -o yaml` on the control plane.
Client certificates (talosconfig and kubeconfig) are the user’s responsibility. Each time you download the kubeconfig file from a Talos Linux cluster, the client certificate is regenerated giving you a kubeconfig which is valid for a year. Client certificates (`talosconfig` and `kubeconfig`) are the user's
responsibility. They are separate from the cluster's server-side certificates.
Each time you download the kubeconfig file from a Talos Linux cluster, the
client certificate is regenerated, giving you a kubeconfig which is valid for a
year.
The talosconfig file should be renewed at least once a year, using the `talosctl config new` command. The `talosconfig` file should be renewed at least once a year, before it
expires. If the current `talosconfig` is still valid, renew it through a
control plane node:
```bash
cd talos
talosctl -n 192.168.0.10 config new talosconfig --roles=os:admin
talosctl config merge ./talosconfig
talosctl config endpoint 192.168.0.1
```
If the current `talosconfig` client certificate is already expired, recover it
from the stored cluster secrets instead. Do not run `talosctl gen secrets` for
an existing cluster.
```bash
cd talos
talosctl gen config veda https://192.168.0.1:6443 \
--with-secrets secrets.yaml \
--output-types talosconfig \
--output talosconfig \
--force
talosctl config merge ./talosconfig
talosctl config endpoint 192.168.0.1
```
After renewing `talosconfig`, regenerate the Kubernetes client certificate as
well:
```bash
talosctl -n 192.168.0.10 kubeconfig
```
### Ceph host networking ### Ceph host networking
For some reason the Ceph object gateway is not properly configured in the dashboard. For some reason the Ceph object gateway is not properly configured in the dashboard.
[See this issue for similiar symptons](https://github.com/rook/rook/issues/12099) [See this issue for similar symptoms](https://github.com/rook/rook/issues/12099)