/proc/cmdline in maintenance mode

[blackliner]

Hi, I would like to see the content of /proc/cmdline of a PXE booted machine in maintenance mode.
talosctl -e 10.33.120.20 -n 10.33.120.20 read /proc/cmdline errors with

error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty

Which usually means --insecure is needed. But read does not seem to support --insecure. I also can't join the node, because by then /proc/cmdline will not be the same anymore.

Slack 🧵

[smira]

Talos won't let you use read API in the maintenance mode for security reasons.

The only way out is to present the cmdline as a resource in Talos.

[blackliner]

is this something I can do, or does this require a change from your end?

Or do you have other ideas how to debug this and similar problems? (Problem being that I don't know if the kernel args provided by PXE are what they should be)

[blackliner]

I can't do dashboard, dmesg... Sorry, I don't really follow the security aspect, this is a private subnet in a datacenter. I get the idea of zero trust, but if we really spin this out: Only an attacker that is already sitting on the subnet can be problematic, and in that case, they can already sniff the cleartext PXE transmissions.

[blackliner]

That being said, I can repro the issue and introspect the PXE communication via tcpdump

[smira]

When I say it's not secure, I mean in general - in your specific case you might consider it to be secure for you.

We don't want to expose random Talos machines booted in maintenance mode with public IP to potential attacks.

This is why I said a workaround and a proper way is to expose current cmdline as a resource which can be read over maintenance mode.