Talosctl certificate renewal
Error message
tamaymueller@terra:~$ talosctl -n 92.60.36.251 dashboard
failed to get node "92.60.36.251" version: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: remote error: tls: expired certificate"That means that the client certificate for talosctl (stored in
~/.talos/talosconfig*) has expired and needs to be renewed.
Fix
-
Create full talosconfig
-
Extract ca certificate and key
-
Create new CSR and sign it
TALOSCONFIG=~/.talos/talosconfig-tamay-cloud.yaml
#Get `certs.os.crt` and `certs.os.key` from secret.yaml
# Extract the CA cert + key from secret.yaml
yq -r .certs.os.crt secrets.yaml | base64 -d > ca.crt
yq -r .certs.os.key secrets.yaml | base64 -d > ca.key
# Generate fresh credentials
talosctl gen key --name admin
talosctl gen csr --key admin.key --ip 127.0.0.1
talosctl gen crt --ca ca --csr admin.csr --name admin --hours 8760
TALOS_KEY=$(base64 -w0 admin.key)
TALOS_CRT=$(base64 -w0 admin.crt)
yq -i ".contexts.[].key = \"${TALOS_KEY}\"" ${TALOSCONFIG}
yq -i ".contexts.[].crt = \"${TALOS_CRT}\"" ${TALOSCONFIG}
rm -f admin.{crt,csr,key} ca.{crt,key}