mirror of
https://github.com/siderolabs/talos.git
synced 2025-10-10 07:01:12 +02:00
84e712a9f1
We add a new CRD, `serviceaccounts.talos.dev` (with `tsa` as short name), and its controller which allows users to get a `Secret` containing a short-lived Talosconfig in their namespaces with the roles they need. Additionally, we introduce the `talosctl inject serviceaccount` command to accept a YAML file with Kubernetes manifests and inject them with Talos service accounts so that they can be directly applied to Kubernetes afterwards. If Talos API access feature is enabled on Talos side, the injected workloads will be able to talk to Talos API. Closes siderolabs/talos#4422. Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
158 lines
3.6 KiB
Markdown
158 lines
3.6 KiB
Markdown
---
|
|
title: "Talos API access from Kubernetes"
|
|
description: "How to access Talos API from within Kubernetes."
|
|
aliases:
|
|
- ../guides/talos-api-access-from-k8s
|
|
---
|
|
|
|
In this guide, we will enable the Talos feature to access the Talos API from within Kubernetes.
|
|
|
|
## Enabling the Feature
|
|
|
|
Edit the machine configuration to enable the feature, specifying the Kubernetes namespaces from which Talos API
|
|
can be accessed and the allowed Talos API roles.
|
|
|
|
```bash
|
|
talosctl -n 172.20.0.2 edit machineconfig
|
|
```
|
|
|
|
Configure the `kubernetesTalosAPIAccess` like the following:
|
|
|
|
```yaml
|
|
spec:
|
|
machine:
|
|
features:
|
|
kubernetesTalosAPIAccess:
|
|
enabled: true
|
|
allowedRoles:
|
|
- os:reader
|
|
allowedKubernetesNamespaces:
|
|
- default
|
|
```
|
|
|
|
## Injecting Talos ServiceAccount into manifests
|
|
|
|
Create the following manifest file `deployment.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: talos-api-access
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: talos-api-access
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: talos-api-access
|
|
spec:
|
|
containers:
|
|
- name: talos-api-access
|
|
image: alpine:3
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/<talos version>/talosctl-linux-amd64
|
|
chmod +x /usr/local/bin/talosctl
|
|
while true; talosctl -n 172.20.0.2 version; do sleep 1; done
|
|
```
|
|
|
|
**Note:** make sure that you replace the IP `172.20.0.2` with a valid Talos node IP.
|
|
|
|
Use `talosctl inject serviceaccount` command to inject the Talos ServiceAccount into the manifest.
|
|
|
|
```bash
|
|
talosctl inject serviceaccount -f deployment.yaml > deployment-injected.yaml
|
|
```
|
|
|
|
Inspect the generated manifest:
|
|
|
|
```yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: talos-api-access
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: talos-api-access
|
|
strategy: {}
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
labels:
|
|
app: talos-api-access
|
|
spec:
|
|
containers:
|
|
- command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
wget -O /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/<talos version>/talosctl-linux-amd64
|
|
chmod +x /usr/local/bin/talosctl
|
|
while true; talosctl -n 172.20.0.2 version; do sleep 1; done
|
|
image: alpine:3
|
|
name: talos-api-access
|
|
resources: {}
|
|
volumeMounts:
|
|
- mountPath: /var/run/secrets/talos.dev
|
|
name: talos-secrets
|
|
tolerations:
|
|
- operator: Exists
|
|
volumes:
|
|
- name: talos-secrets
|
|
secret:
|
|
secretName: talos-api-access-talos-secrets
|
|
status: {}
|
|
---
|
|
apiVersion: talos.dev/v1alpha1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: talos-api-access-talos-secrets
|
|
spec:
|
|
roles:
|
|
- os:reader
|
|
---
|
|
```
|
|
|
|
As you can notice, your deployment manifest is now injected with the Talos ServiceAccount.
|
|
|
|
## Testing API Access
|
|
|
|
Apply the new manifest into `default` namespace:
|
|
|
|
```bash
|
|
kubectl apply -n default -f deployment-injected.yaml
|
|
```
|
|
|
|
Follow the logs of the pods belong to the deployment:
|
|
|
|
```bash
|
|
kubectl logs -n default -f -l app=talos-api-access
|
|
```
|
|
|
|
You'll see a repeating output similar to the following:
|
|
|
|
```text
|
|
Client:
|
|
Tag: <talos version>
|
|
SHA: ....
|
|
Built:
|
|
Go version: go1.18.4
|
|
OS/Arch: linux/amd64
|
|
Server:
|
|
NODE: 172.20.0.2
|
|
Tag: <talos version>
|
|
SHA: ...
|
|
Built:
|
|
Go version: go1.18.4
|
|
OS/Arch: linux/amd64
|
|
Enabled: RBAC
|
|
```
|
|
|
|
This means that the pod can talk to Talos API of node 172.20.0.2 successfully.
|