After talosctl gen config->talosctl disks --insecure: "error reading server preface: remote error: tls: certificate required"

[raphael10-collab]

(base) raphy@raohy:~/.talos$ talosctl gen secrets
(base) raphy@raohy:~/.talos$ ls -lah | grep secrets.yaml 
-rw-------   1 raphy raphy 8,7K ott 16 12:39 secrets.yaml


(base) raphy@raohy:~/.talos$ talosctl gen config $CLUSTER_NAME https://$ENDPOINT:6443 --with-secrets secrets.yaml 
generating PKI and tokens
Created /home/raphy/.talos/controlplane.yaml
Created /home/raphy/.talos/worker.yaml
Created /home/raphy/.talos/talosconfig

(base) raphy@raohy:~/.talos$ talosctl --nodes $ENDPOINT get links --insecure
rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: remote error: tls: certificate required"

What am I doing wrong and/or missing? How to make it work ?

[smira]

I don't quite know what you're doing, but $ENDPOINT runs Talos in non-maintenance mode right now, so it requires proper talosconfig client certificate.

It might be that you remove --insecure, and it works for you, or you add --talosconfig=talosconfig.

[raphael10-collab]

Hi @smira
I guess I have some (network?) issues :

(base) raphy@raohy:~/.talos$ talosctl health -n aaa.aaa.aaa.aaa -e aaa.aaa.aaa.aaa
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\")"
(base) raphy@raohy:~/.talos$ 
(base) raphy@raohy:~/.talos$ kubectl get nodes
NAME                            STATUS   ROLES           AGE    VERSION
k8s-eu-1-control-plane-node-1   Ready    control-plane   380d   v1.31.11
k8s-eu-1-worker-1               Ready    <none>          380d   v1.31.11
k8s-eu-1-worker-2               Ready    <none>          100d   v1.31.11
k8s-eu-1-worker-3               Ready    <none>          100d   v1.31.11

(base) raphy@raohy:~/.talos$ helm ls
NAME   	NAMESPACE	REVISION	UPDATED                                 	STATUS  	CHART         	APP VERSION
questdb	questdb  	1       	2025-10-07 17:24:57.073362305 +0200 CEST	deployed	questdb-1.0.12	9.1.0      


(base) raphy@raohy:~/.talos$ talosctl support -n aaa.aaa.aaa.aaa -e aaa.aaa.aaa.aaa
support.zip already exists, overwrite? [y/N]: y
Failed to create kubernetes client rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\")"
Support bundle is written to support.zip

I do not understand what is going on: apparently the cluster is fine, but I get certificate required issue

[smira]

No, you're using wrong talosconfig for the cluster you're trying to access.

If you did gen config, and never merged talosconfig, you need to add --talosconfig=talosconfig flag to make talosctl pick it up.

Following Getting Started might help https://docs.siderolabs.com/talos/v1.11/getting-started/getting-started

[raphael10-collab]

Can you please explain me th

I added --talosconfig=.talos/talosconfig in talosctl health -n control_plane_node_ip -e control_plane_node_up but got the same error message:

failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\ :

(base) raphy@raohy:~$ cat .talos/talosconfig 
context: k8s-eu-1
contexts:
    k8s-eu-1:
        endpoints: []
        ca: LS0tLS1...
        crt: LS0tLS1..
        key: LS0tLS1..

(base) raphy@raohy:~$ talosctl health -n aaa.aaa.aaa.aaa -e aaa.aaa.aaa.aaa --talosconfig=.talos/talosconfig
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\")"

Even for Step 5 https://docs.siderolabs.com/talos/v1.11/getting-started/getting-started#step-5%3A-learn-about-your-installation-disks

I get the same error message:

(base) raphy@raohy:~$ talosctl get disks -n control_plane_node_ip -e control_plane_node_ip --talosconfig=.talos/talosconfig
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of \"x509: Ed25519 verification failure\" while trying to verify candidate authority certificate \"talos\")"

[smira]

There is no way for me to help me further than what I said above.

At this point your talosconfig doesn't match the cluster's machine configuration.

Your talosconfig should match the PKI from e.g. your controlplane.yaml that you applied to your Talos machine.

The error says that these don't match at the moment.

[raphael10-collab]

How to reset everything from scratch?

I tried with a worker_node but got the same error message: "certificate signed by unknown authority. verification failure" :

(base) raphy@raohy:~/.talos talosctl reset -n worker_node_ip -e control_plane_node_ip --talosconfig=talosconfig

[smira]

If you don't have access to Talos API, you can't reset it via API obviously.

You can reset by wiping the machine/VM any way you have available.
You can reset by booting Talos ISO and choosing an option to "reset the disk" in the bootloader menu.