Talos API Access From Kubernetes

How to access Talos API from within Kubernetes.

In this guide, we will enable the Talos feature to access the Talos API from within Kubernetes.

Enable the feature

This feature can only be enabled on control plane machines.

Enable the feature via machine configuration, specifying the Kubernetes namespaces from which the Talos API can be accessed and the allowed Talos API roles. How you configure this depends on your Talos version.

On Talos v1.14 and above, use the KubeTalosAPIAccessConfig document:

apiVersion: v1alpha1
kind: KubeTalosAPIAccessConfig
allowedRoles:
  - os:reader
allowedKubernetesNamespaces:
  - default

For Talos versions earlier than v1.14, use the kubernetesTalosAPIAccess field under machine.features:

machine:
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - default

Inject Talos ServiceAccount into manifests

Create the following manifest file deployment.yaml. The pod uses the Kubernetes Downward API to discover the IP of the node it’s running on:

Use the talosctl inject serviceaccount command to inject the Talos ServiceAccount into the manifest:

talosctl inject serviceaccount -f deployment.yaml > deployment-injected.yaml

Inspect the generated manifest:

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  name: talos-api-access
spec:
  selector:
    matchLabels:
      app: talos-api-access
  strategy: {}
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: talos-api-access
    spec:
      containers:
      - command:
        - sh
        - -c
        - |
          wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/${release}/talosctl-linux-amd64
          chmod +x /usr/local/bin/talosctl
          while true; do talosctl -n $NODE_IP version; sleep 1; done
        env:
        - name: NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        image: alpine:3
        name: talos-api-access
        resources: {}
        volumeMounts:
        - mountPath: /var/run/secrets/talos.dev
          name: talos-secrets
      tolerations:
      - operator: Exists
      volumes:
      - name: talos-secrets
        secret:
          secretName: talos-api-access-talos-secrets
status: {}
---
apiVersion: talos.dev/v1alpha1
kind: ServiceAccount
metadata:
    name: talos-api-access-talos-secrets
spec:
    roles:
        - os:reader
---

As you can notice, your deployment manifest is now injected with the Talos ServiceAccount.

Test API access

Apply the new manifest into the default namespace:

kubectl apply -n default -f deployment-injected.yaml

Follow the logs of the pods belonging to the deployment:

kubectl logs -n default -f -l app=talos-api-access

You’ll see a repeating output similar to the following:

Client:
    Tag:         <talos version>
    SHA:         <commit sha>
    Built:
    Go version:  <go version>
    OS/Arch:     linux/amd64
Server:
    NODE:        <node ip>
    Tag:         <talos version>
    SHA:         <commit sha>
    Built:
    Go version:  <go version>
    OS/Arch:     linux/amd64
    Enabled:     RBAC

This means that the pod can talk to the Talos API of the node it’s running on successfully, whichever node that happens to be.