I have the following config, and even from a new from stractch setup if I apply the config it will give me the following errors:
version: v1alpha1 # Indicates the schema used to decode the contents.
debug: false # Enable verbose logging to the console.
persist: true
# Provides machine specific configuration options.
machine:
type: controlplane # Defines the role of the machine within the cluster.
token: rcpm7g.k48mm1bcxbwotmy2 # The `token` is used by a machine to join the PKI of the cluster.
# The root certificate authority of the PKI.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBNW1yUDI5bG5Xd2UzZjRIMzlQellJekFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qWXdNekE1TWpBeU56RTRXaGNOTXpZd016QTJNakF5TnpFNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQU5zbDRGTmdUUDYwTFdEMzh2dFRpZTRpN2RYYiswSHRCWTNiClprRmdBWDNxbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkplaFpTd3AvcUNndzJtTQo1d1dBSG1YeDVDNElNQVVHQXl0bGNBTkJBRG91bmZteVczdU90Q05tQnNlWm4zSWtic0NZbXhaOTJnVTlVb29qCkkwck1UT3lBQXBiSjFaZUZMUkNwb2YveEh5UGRnMk0yNkpuOHRtRGFaQ0gyalFjPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJQkYydTFkcVRYdDdjTlhVaDhMaHMvSHZ6V0xLd1BlTU9BK0xWUFdjeWdWaAotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K
# Extra certificate subject alternative names for the machine's certificate.
certSANs: []
# # Uncomment this to enable SANs.
# - 10.0.0.10
# - 172.16.0.10
# - 192.168.0.10
# Used to provide additional options to the kubelet.
kubelet:
image: ghcr.io/siderolabs/kubelet:v1.35.2 # The `image` field is an optional reference to an alternative kubelet image.
defaultRuntimeSeccompProfileEnabled: true # Enable container runtime default Seccomp profile.
disableManifestsDirectory: true # The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.
# # The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.
# clusterDNS:
# - 10.96.0.10
# - 169.254.2.53
# # The `extraArgs` field is used to provide additional flags to the kubelet.
# extraArgs:
# key: value
# # The `extraMounts` field is used to add additional mounts to the kubelet container.
# extraMounts:
# - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
# type: bind # Type specifies the mount kind.
# source: /var/lib/example # Source specifies the source path of the mount.
# # Options are fstab style mount options.
# options:
# - bind
# - rshared
# - rw
# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
# serverTLSBootstrap: true
# # The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
# credentialProviderConfig:
# apiVersion: kubelet.config.k8s.io/v1
# kind: CredentialProviderConfig
# providers:
# - apiVersion: credentialprovider.kubelet.k8s.io/v1
# defaultCacheDuration: 12h
# matchImages:
# - '*.dkr.ecr.*.amazonaws.com'
# - '*.dkr.ecr.*.amazonaws.com.cn'
# - '*.dkr.ecr-fips.*.amazonaws.com'
# - '*.dkr.ecr.us-iso-east-1.c2s.ic.gov'
# - '*.dkr.ecr.us-isob-east-1.sc2s.sgov.gov'
# name: ecr-credential-provider
# # The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.
# nodeIP:
# # The `validSubnets` field configures the networks to pick kubelet node IP from.
# validSubnets:
# - 10.0.0.0/8
# - '!10.0.0.3/32'
# - fdc7::/16
# Provides machine specific network configuration options.
network:
nameservers:
- 10.0.10.6
- 2001:470:c254:10::6
- 10.0.10.22
- 1.1.1.1
- 2001:470:c254:10::22
hostname: CP-01
interfaces:
- interface: ens18
addresses:
- 10.0.10.61/24
- 2001:470:c254:10::61/64
routes:
- network: 0.0.0.0/0
gateway: 10.0.10.1
- network: ::/0
gateway: 2001:470:c254:10::1
# # Configures KubeSpan feature.
# kubespan:
# enabled: true # Enable the KubeSpan feature.
# Used to provide instructions for installations.
install:
disk: /dev/sda # The disk used for installations.
image: ghcr.io/siderolabs/installer:v1.12.5 # Allows for supplying the image used to perform the installation.
wipe: false # Indicates if the installation disk should be wiped at installation time.
grubUseUKICmdline: true # Indicates if legacy GRUB bootloader should use kernel cmdline from the UKI instead of building it on the host.
# # Look up disk using disk attributes like model, size, serial and others.
# diskSelector:
# size: 4GB # Disk size.
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
# Features describe individual Talos features that can be switched on or off.
features:
diskQuotaSupport: true # Enable XFS project quota support for EPHEMERAL partition and user disks.
# KubePrism - local proxy/load balancer on defined port that will distribute
kubePrism:
enabled: true # Enable KubePrism support - will start local load balancing proxy.
port: 7445 # KubePrism port.
# Configures host DNS caching resolver.
hostDNS:
enabled: true # Enable host DNS caching resolver.
forwardKubeDNSToHost: true # Use the host DNS resolver as upstream for Kubernetes CoreDNS pods.
# # Configure Talos API access from Kubernetes pods.
# kubernetesTalosAPIAccess:
# enabled: true # Enable Talos API access from Kubernetes pods.
# # The list of Talos API roles which can be granted for access from Kubernetes pods.
# allowedRoles:
# - os:reader
# # The list of Kubernetes namespaces Talos API access is available from.
# allowedKubernetesNamespaces:
# - kube-system
# Configures the node labels for the machine.
nodeLabels:
node.kubernetes.io/exclude-from-external-load-balancers: ""
# # Provides machine specific control plane configuration options.
# # ControlPlane definition example.
# controlPlane:
# # Controller manager machine specific configuration options.
# controllerManager:
# disabled: false # Disable kube-controller-manager on the node.
# # Scheduler machine specific configuration options.
# scheduler:
# disabled: true # Disable kube-scheduler on the node.
# # Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.
# # nginx static pod.
# pods:
# - apiVersion: v1
# kind: pod
# metadata:
# name: nginx
# spec:
# containers:
# - image: nginx
# name: nginx
# # Allows the addition of user specified files.
# # MachineFiles usage example.
# files:
# - content: '...' # The contents of the file.
# permissions: 0o666 # The file's permissions in octal.
# path: /tmp/file.txt # The path of the file.
# op: append # The operation to use
# # The `env` field allows for the addition of environment variables.
# # Environment variables definition examples.
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: info
# GRPC_GO_LOG_VERBOSITY_LEVEL: "99"
# https_proxy: http://SERVER:PORT/
# env:
# GRPC_GO_LOG_SEVERITY_LEVEL: error
# https_proxy: https://USERNAME:PASSWORD@SERVER:PORT/
# env:
# https_proxy: http://DOMAIN\USERNAME:PASSWORD@SERVER:PORT/
# # Used to configure the machine's sysctls.
# # MachineSysctls usage example.
# sysctls:
# kernel.domainname: talos.dev
# net.ipv4.ip_forward: "0"
# net/ipv6/conf/eth0.100/disable_ipv6: "1"
# # Used to configure the machine's sysfs.
# # MachineSysfs usage example.
# sysfs:
# devices.system.cpu.cpu0.cpufreq.scaling_governor: performance
# # Configures the udev system.
# udev:
# # List of udev rules to apply to the udev system
# rules:
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
# # Configures the logging system.
# logging:
# # Logging destination.
# destinations:
# - endpoint: tcp://1.2.3.4:12345 # Where to send logs. Supported protocols are "tcp" and "udp".
# format: json_lines # Logs format.
# # Configures the kernel.
# kernel:
# # Kernel modules to load.
# modules:
# - name: btrfs # Module name.
# # Configures the seccomp profiles for the machine.
# seccompProfiles:
# - name: audit.json # The `name` field is used to provide the file name of the seccomp profile.
# # The `value` field is used to provide the seccomp profile.
# value:
# defaultAction: SCMP_ACT_LOG
# # Override (patch) settings in the default OCI runtime spec for CRI containers.
# # override default open file limit
# baseRuntimeSpecOverrides:
# process:
# rlimits:
# - hard: 1024
# soft: 1024
# type: RLIMIT_NOFILE
# # Configures the node annotations for the machine.
# # node annotations example.
# nodeAnnotations:
# customer.io/rack: r13a25
# # Configures the node taints for the machine. Effect is optional.
# # node taints example.
# nodeTaints:
# exampleTaint: exampleTaintValue:NoSchedule
sysctls:
net.ipv6.conf.ens18.accept_ra: "0"
net.ipv6.conf.ens18.autoconf: "0"
# Provides cluster specific configuration options.
cluster:
id: vyMk4WGgkr0vvqKQLOPE4agQMzJTfLcLV4bRHf2mqU8= # Globally unique identifier for this cluster (base64 encoded random 32 bytes).
secret: 1Iyv5Nf9quPRu7HC+HemuivU7r0r6M0naWSQRQM0BbY= # Shared secret of cluster (base64 encoded random 32 bytes).
# Provides control plane specific configuration options.
controlPlane:
endpoint: https://10.0.10.61:6443 # Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.
clusterName: casteel-cluster # Configures the cluster's name.
# Provides cluster specific network configuration options.
network:
dnsDomain: cluster.local # The domain used by Kubernetes DNS.
# The pod subnet CIDR.
podSubnets:
- 10.244.0.0/16 # IPv4 pod CIDR
- fd00:10:244::/48 # IPv6 pod CIDR
serviceSubnets:
- 10.96.0.0/12 # IPv4 service CIDR
- fd00:10:96::/112 # IPv6 service CIDR
cni:
name: custom
# # The CNI used.
# cni:
# name: custom # Name of CNI to use.
# # URLs containing manifests to apply for the CNI.
# urls:
# - https://docs.projectcalico.org/archive/v3.20/manifests/canal.yaml
token: jh66bu.zobglu22koy2d01z # The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.
secretboxEncryptionSecret: pl15xyz2bLJ9HyhT131n7E61M1LEoMuc+uyDcEYS20g= # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# The base64 encoded root certificate authority used by Kubernetes.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQU5rb3p0TSt0UzRXS2RoTDNHMHVydE13Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakF6TURreU1ESTNNVGhhRncwek5qQXpNRFl5TURJMwpNVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVFXcUdQeHV3ZEZZY3VkcGhINks4Z0dSR3RsMk5aeGQvNFViVldodEt5dUFLMjNRbll0b1NpOWRuZTIKNjhQUG5UbWRUQW9jdWhScFY3UzZSMExhRmRiRG8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGSThRVHBRS0svdmkyRXNxM1FRbjJXSXRCcWNVTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUdKM040bFQKUW1NaWlWeVVoeFRBMGh5aDZJWTZML3MzSUliUUpBaExnU1FpQWlFQXZGb1BuS0VmN2lPQjhXWlRxdDdpRE9MbgpMY1dxM3o0c0V6Q3VqcTVlcXBNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVYbThKZTEzdlNZYSs0SXQxTDFuNlRKa0c4eFA1a09zVEZzQXNjdzBiQ2FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRnFoajhic0hSV0hMbmFZUitpdklCa1JyWmRqV2NYZitGRzFWb2JTc3JnQ3R0MEoyTGFFbwp2WFozdHV2RHo1MDVuVXdLSExvVWFWZTB1a2RDMmhYV3d3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.
aggregatorCA:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJYekNDQVFXZ0F3SUJBZ0lRSEFXN0JSRFZubWxFRCtrODJkRjZZekFLQmdncWhrak9QUVFEQWpBQU1CNFgKRFRJMk1ETXdPVEl3TWpjeE9Gb1hEVE0yTURNd05qSXdNamN4T0Zvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxRwpTTTQ5QXdFSEEwSUFCRnRmUHhtTTFtZnk3ZXpJWU9MWGZHamNpMFY3dnVMNHdXWmEzSGluQXNuYXIyM0NwRDBsCkc0cnMwMS8yQmMvc3N2cVFlMG1vVDUyeGUxdER0WUhqWnBTallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWQKQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZApCZ05WSFE0RUZnUVVwNlRRZUo4dFdWNmVQaHMvMm5pbmdDeWYycFF3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloCkFJSjFzOENXK2RFZE4wUDJIOWNMZ0FjRVlsSzhZU3RST1RUUVBuUzhZODdPQWlBNFo5V2QvNjBPRDM2T1VGWWsKLzdWQzJUZElLektJd0phaHU2WElBOU5vWkE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUNMRGZHNmdINWRkZ2s3T2VlWFRkeDdnQmVGcUViVXRaY1ZFeFg0YVBZSm9vQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFVzE4L0dZeldaL0x0N01oZzR0ZDhhTnlMUlh1KzR2akJabHJjZUtjQ3lkcXZiY0trUFNVYgppdXpUWC9ZRnoreXkrcEI3U2FoUG5iRjdXME8xZ2VObWxBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# The base64 encoded private key for service account token generation.
serviceAccount:
key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdzZESXgwdElqVFVzTWwxbjhKVGFWVXZCUHJlR2pRZzRRNTFDaC9ER2dub1k5SktrCml2M1dDNGVUQnN2L3JMaDRDaDlNRHpCSVEwcVEwZ3lPYnF2S1hnWHhwTHRoSEpXNVhXNlJOUU5iK1ZWRGZhdTUKS1R2amJSWDF4Rm12RHBRcTJZZG5EZ2U5bTArZ0N2QzBmN3NFRGxjNnhaaFZ3bEJISEJTdU0xMHRodi9lbGJrRgp5bHhlbUJ2TE1JQ2IzQVNPT2FLZkdOTzIxYW1YakFHS2ZwN2NvcGtNOGZ4M0hNZEl3Rms2aGZkUko0VWdZalJBCjdnazhCRmk3U25VYXAvajZ1Y0oyendvdzVtalgzbFdlZWp6WEdEL0plMFNXelM2OU01K2gybjJwaTQwUHRMTXcKSWlzSjNQMWhILzhpLzF5RFJTQUJNTDUxRFRUQ0NLMElTR24zeGNPUlNZcFFzbGhaVUJqSGFybkxnUlJjeHRpUQo0T2lZc3dJZzFXVXlMVHhXUDJLVjhsUFkrU1hjWkRjRGtJeUVhQ0p3S2pTdHp4N0NrVmdxUmRlZmd1UlcvcVpIClU5dTg5VXRzM2dFcWRCdTc2dlIrdzNFbDBZNlZTWjdNS2xCMXRYenNvRWFhWVFKSFV5bUVBUUx0b0dIcWdyaTUKbUs2V2c2YS9ORVVFNVhVWXIzVjdoRTBxVzJnb3dUemtZdWd5SFZTNElOQWE4Wmk4SXlGRGlLYkprT1BVMWVuVgpQbWptbm15dlptcFl1MGF3cHpYNnNIYS9SUng5MjFOVFBwWnNTME5WMzJhM3VXMzBFQmZPd1V6NjU4ZHZLV2ZkClJWK1dwQ0dCVXVMVEFjc0RkeWtHbjJYSk93R1Jwc0NEUEIvTURETGNRbVlSeC9ubnlhZDNIb2NGUktjQ0F3RUEKQVFLQ0FnQUhUS0NHanlYak5FWUo1YmVvZFJBUWVWc2tpVVNEK1UwMWVLWUZoeWtMci9LWkdEK21KVmZaNWtmSQp5ODU3d0xENTc3WlplcnUzaHc0UVNGZW9MdERHTnEwNjJ2aFhVTFF4NnZEbGJDZi91RkZrWEZ2MFVKVVR6NVgwCkFFU3FqcGRxdG0vL1NLLzlIampOTDdOaHhndElzd2lHWEVEQmwxZmxQRldqcFA1bDR5RGRyL2IvV0tMNW1mcU4Ka2hRK3RBelAxR1ExKzVyKzJKZkcvdWU1VnhsMGJRYmI5ZkpHZmZQQStaTllIRStkakl6QXgvZXU2ZzZna0Rtcwp5dUhMdlZ2ZGw5dnhyYmVxdG83Q0dsVVNIK01HdDBVLzl1SGU2Mkl6NHVqdklNYUt1OHRjNVYxanZsSUg1T0c5CmgrVGp2UUtlT2F0OFhoN2xUSlZRMkRsTzVRLzhTRnh3aXVtWFkzMHZjejVRR2Z5S0kyOU4wOFhDbVppV1pBUFEKY0VPV2dodVIvOVQ1MmhnYlJkd3l4MlBrMEwzQTVLbXhwcFZvQ3hKdGdJTGNWaS9sZWJid0hZWjZwM3FjYzdXKwpYRmM2YzBJSFBLblhhQUlhZkhIeXpmNmdqRTA3QUpRM25PM0QxOVpVTG1RanBCcGppakp0V3djU3hVclEyOVhpCnVWMkE1bVFtMCs4a1NzdGxBcFZjK3FYVlkxY2NUYWFsTFZBU1NKOE9ySzYrZzRaSXJQNGFkeGFQcW54TDRtOFAKMFRra25Lb2ZmaTlMY0pjdWtwdldTMEFkZUlDOHFkaUdDQWF1TVFRZ3gzTjVid1FyVGZpOXJFTndBMzhrMDdOLwpnbDNyTWkrS2hiSWM0cTUrS0FtcXdORS9aa2tXZ01aR0hxUlRiUHg4YnYxREQ0VHp3UUtDQVFFQTErY0pyZ1ZwCkZhcWl4NjE4SCtOam9yZ2pZY05xUldVSlZ5RVVrQWtsQVlQNjhPUzREZG4rb291a1FRL25tTjhFN0tZaGR4dTAKNUhUY003RVFaWHFIVHFiWVArSUpjUWlKbldNWFBDRnpLUUJicjBhTXdWZi9LQW1qcWJIOXlhQ2dPOERaTVlJWgpweXc0cUhXZ2xaaFF3Y1JuMjBGaUR0eHQ0d0t0cUdqajVtQm1JNWdVeHhBRDlGWWkvWk9SM1JwTm1yVmZqczRvClRwMm9kZTZvUnpNelF6ZE9maUdvYWk5KzJZY2pNNDM1dktHTkJsZUJsK21zdGJuSSt5b1N4UTRHNFZUcWxrK3EKbTVNaUhmRVFkQ2Frblp6dmYyZHNhZ01UN2JSbUFYWEZYMThINEoyZktxNW1BN0hDTVlmbWRNM1FxUEF6ZVZDQQpBcFVOUWUxNHM4ODZ5d0tDQVFFQTUvWFBiQjkrbTlGRUJqMEpYc3Q4cE53UHZWWW1Ca0RKQXZ4K3pPd0ZyZWJHCmRmeTA3VXN3VTZIcitTbGcvNmtmOU1BcEdHWnFsRGVYelE0T3o0QzV6NUtsUEJ2WmtQVlZ6Uk5VcGt5d2tOVkMKNmhqTXIrelQ4c2lXRFBZSXcreWJOUGdjWTRtS202VnVVZGU1dkl1QjlHUm9MczJYVVloT2s5bTEzci9JTXVicgpnbVhJNzJJYjYrV2x5S2NUcEhJRll5aTBqcU9tbVlyZkR2eWFWOU9mY3E0T2plNmZHUm5YWndUWjc4Z3c0UU9BCkRTV3FSckRWRXNNanY1N242aDk0bUx5U2ZQL1ZuNXNXbzdjU2swbU02MnZ5ZVlOYnVSV2ZpY0JPUVdPaUJ5SWcKa1JGWm4wQzJLRk84WUgvckVzc3podWpTOGx5UUlsTWxSOFNlRU9nV0ZRS0NBUUVBaTYvOXdVdmEyNXZWU2QvaQo2VGJUNWhuQk9xV1dnbU9Ha1lyanBQVmxyZjlZUXJlWXBjMmZSRWVZOUVkNERwNXNyemdsZXN6QVV2ZVE2UmpzCmhOdXI0NlZyVUpuTWhnZUNFZ1JrcWhEeVUxclo5eU5zT2tQVzRHNnNKMFR6OEpvdVVicktTNC9qVFJmOWFIRUMKZndkWGFLYk1rejFRVmxFai83Wmg2UTVFTlcrMVpkNGx3MDJIWVhUQm10TDVrdFpMMDRiNTFvbG41c1Yya3liZwpWWUM0OEFvK2pMajJJQTJ1d3NyK2FZSzRTK1V5T3lJdXhMejVjM0pLcU1abDhuekswc3VBSTlSVGkraThNQ2NpCkFDUm9hVmw2VXpIMUlQbncwT0RoQnB6T0lKQjVwa2dWRFNaYzlwTHlFOTNicTBMbWVBZEJKb0tBOENyRHN4NFQKOURKbDFRS0NBUUVBd3NrK3A3TkM1S0kwbDNDRi85NnRDdHZwTTd1MkxxWVVwcmRWMjh1UGNWdEw2U1NPNG4yegpWV2V4K3dmdWRvS1ZYVGhJeWo2bTNWUloyMDRremNkeFFZZ0p6Wkl0ZjNjbDJCS1ZrUmp4Wkk1UnBMZXltMEVyCk1zT1NqY3ZGekpGU1BJYmxnQWl1SnNvaS9BTkY2N2pUSm1GeXcyck4yUiszckp5MEJ4dlJpRDAySThoSmxnd3oKR2tNOGxtVUhMNTY0TzI2aFFPN1lKalBoNEhuck9qbHh1aUhFQXhnUTdra3ZBMG1sb1ovZ3UvUHVnaHZSQTQvWApQZXcwaHVOd0tNREl5cW4vOFl2ODNneWtWRktWL0sxVTh4VXhCeTF4eHRrTG9lZWxUMi9WVGx3d01PSDYrcXFpCnpQYVVTQXpqWUdMWElFRS9jMXFiaHRkL2hPYnRQWkZIaVFLQ0FRQUdIY1VZampkL3JzZjFyY1J5ZEpaL1dwSGEKQlZEMGZpbjQrYnpMTVRZMjRTOUtsWlNNMS9VVkRnMWZ6OU9JVjR0cThsbWxiSmR6c013VTV4b3BrNUttZUxVcwppdHF2VUdPQ0QxQjZ3aURvNDJKUG1wdDN5MmhMemhrSjRHYktNWVp4VGo1WWNZOVZtaXFJMGtRY3Q4THp1QTVMClU1d1QydFk0M1NPRWljd2F1ZlZ6WVZDNWhpVy9aWVhzNDFBOW1pUlB1MUdDL2dSUWtoYVBweW9WMmN5VmY1aVMKeEJhWVh3UlhaQ3dhL2VCZ0RXc2dFa0U2UXN6NmRyaVVyWnI0ajhvalZ4OC9VVld5ZDhRcTV6LzNZUkpFdzZIZQp5RjVjdGpqNXd5d0dmb0U5a3hxWVYzRGNDTHQwTW9mUzk0M0xRVGgzbEhHOTFuS3dURXIwM01Ub1J0YWgKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
# API server specific configuration options.
apiServer:
image: registry.k8s.io/kube-apiserver:v1.35.2 # The container image used in the API server manifest.
# Configure the API server admission plugins.
admissionControl:
- name: PodSecurity # Name is the name of the admission controller.
# Configuration is an embedded configuration object to be used as the plugin's
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
defaults:
audit: restricted
audit-version: latest
enforce: baseline
enforce-version: latest
warn: restricted
warn-version: latest
exemptions:
namespaces:
- kube-system
runtimeClasses: []
usernames: []
kind: PodSecurityConfiguration
# Configure the API server audit policy.
auditPolicy:
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
# # Configure the API server authorization config. Node and RBAC authorizers are always added irrespective of the configuration.
# authorizationConfig:
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: webhook # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: Deny
# matchConditionSubjectAccessReviewVersion: v1
# matchConditions:
# - expression: has(request.resourceAttributes)
# - expression: '!(\''system:serviceaccounts:kube-system\'' in request.groups)'
# subjectAccessReviewVersion: v1
# timeout: 3s
# - type: Webhook # Type is the name of the authorizer. Allowed values are `Node`, `RBAC`, and `Webhook`.
# name: in-cluster-authorizer # Name is used to describe the authorizer.
# # webhook is the configuration for the webhook authorizer.
# webhook:
# connectionInfo:
# type: InClusterConfig
# failurePolicy: NoOpinion
# matchConditionSubjectAccessReviewVersion: v1
# subjectAccessReviewVersion: v1
# timeout: 3s
# Controller manager server specific configuration options.
controllerManager:
image: registry.k8s.io/kube-controller-manager:v1.35.2 # The container image used in the controller manager manifest.
extraArgs:
node-cidr-mask-size-ipv4: "24"
node-cidr-mask-size-ipv6: "112"
# Kube-proxy server-specific configuration options
proxy:
image: registry.k8s.io/kube-proxy:v1.35.2 # The container image used in the kube-proxy manifest.
# # Disable kube-proxy deployment on cluster bootstrap.
# disabled: false
# Scheduler server specific configuration options.
scheduler:
image: registry.k8s.io/kube-scheduler:v1.35.2 # The container image used in the scheduler manifest.
# Configures cluster member discovery.
discovery:
enabled: true # Enable the cluster membership discovery feature.
# Configure registries used for cluster member discovery.
registries:
# Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information
kubernetes:
disabled: true # Disable Kubernetes discovery registry.
# Service registry is using an external service to push and pull information about cluster members.
service: {}
# # External service endpoint.
# endpoint: https://discovery.talos.dev/
# Etcd specific configuration options.
etcd:
# The `ca` is the root certificate authority of the PKI.
ca:
crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmakNDQVNTZ0F3SUJBZ0lSQUtacDhxOTI3QjRCeGtMdXZiMFZsTGt3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TmpBek1Ea3lNREkzTVRoYUZ3MHpOakF6TURZeU1ESTNNVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFTb1dHSjJkSW5VCnNCWVZsMVpJYkoyK3NUQlZWcHQvQm5ORUt3V0ZkMTBkaE0yc3RTdEpzRytRZmMwbkZReGxGcWd3eEhxdTFydTUKL0VoQVM1L2VOdEtBbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRk80cHMzbXV2K3E5CkNyWTFJYmhCZ0ZnNUJnQmdNQW9HQ0NxR1NNNDlCQU1DQTBnQU1FVUNJUUNjc05GSkw0REV0NEtzbVNJeHl1K0sKTXQ4MWlpNkZuUDJjOUlSZFc2cUZCZ0lnZkU5U20wY09nc0lzSUM3UytQS2lVVmdLTFoxeTcxZ3prNmM4MWdRawpFcUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUZZNVQ4R2gxWXJ0TVJGMXVKdFlBcCtGYUxGbG9JTnBLUEwxV1pjb2IyUkpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFcUZoaWRuU0oxTEFXRlpkV1NHeWR2ckV3VlZhYmZ3WnpSQ3NGaFhkZEhZVE5yTFVyU2JCdgprSDNOSnhVTVpSYW9NTVI2cnRhN3VmeElRRXVmM2piU2dBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
# # The container image used to create the etcd service.
# image: registry.k8s.io/etcd:v3.6.8
# # The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.
# advertisedSubnets:
# - 10.0.0.0/8
# A list of urls that point to additional manifests.
extraManifests: []
# - https://www.example.com/manifest1.yaml
# - https://www.example.com/manifest2.yaml
# A list of inline Kubernetes manifests.
inlineManifests: []
# - name: namespace-ci # Name of the manifest.
# contents: |- # Manifest contents as a string.
# apiVersion: v1
# kind: Namespace
# metadata:
# name: ci
# # A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).
# # Decryption secret example (do not use in production!).
# aescbcEncryptionSecret: z01mye6j16bspJYtTB/5SFX8j7Ph4JXxM2Xuu4vsBPM=
# # Core DNS specific configuration options.
# coreDNS:
# image: registry.k8s.io/coredns/coredns:v1.13.2 # The `image` field is an override to the default coredns image.
# # External cloud provider configuration.
# externalCloudProvider:
# enabled: true # Enable external cloud provider.
# # A list of urls that point to additional manifests for an external cloud provider.
# manifests:
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/rbac.yaml
# - https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/v1.20.0-alpha.0/manifests/aws-cloud-controller-manager-daemonset.yaml
# # A map of key value pairs that will be added while fetching the extraManifests.
# extraManifestHeaders:
# Token: "1234567"
# X-ExtraInfo: info
# # Settings for admin kubeconfig generation.
# adminKubeconfig:
# certLifetime: 1h0m0s # Admin kubeconfig certificate lifetime (default is 1 year).
# # Allows running workload on control-plane nodes.
# allowSchedulingOnControlPlanes: true
Errors:
"error refreshing pod status: error fetching pod status: an error on the server (\"Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes,
subresource=pods)\") has prevented the request from succeeding"}
user: warning: [2026-03-12T16:38:30.800125332Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.NodeApplyController", "error": "1 error(s)
occurred:\n\terror getting node: nodes \"cp-01\" not found"}
user: warning: [2026-03-12T16:38:34.794051332Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error":
"error refreshing pod status: error fetching pod status: an error on the server (\"Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes,
subresource=pods)\") has prevented the request from succeeding"}
user: warning: [2026-03-12T16:38:45.543795332Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.ManifestApplyController", "error": "1 error
occurred:\n\t* error creating /v1/Service/kube-dns: Service \"kube-dns\" is invalid: spec.clusterIPs: Invalid value: [\"10.96.0.10\",\"fd00:10:96::a\"]: failed to allocate
IP 10.96.0.10: provided IP is already allocated\n\n"}
I have the following config, and even from a new from stractch setup if I apply the config it will give me the following errors:
Errors: