Separating secrets from your controlplane.yaml/worker.yaml file?

[TimoVerbrugghe]

Ey everyone! Looking into using Talos, have used kubernetes before but new to talos. I have a question on config file management. I understand you can generate a separate secrets.yaml file and that you can generate a new controlplane.yaml file from that.

However I'm planning to create a controlplane.yaml / worker.yaml file that I would like to store in a github repository somewhere with the rest of my config files. However, I don't see a way to generate an unified controlplane.yaml file based on a custom one + secrets.yaml file (or am I missing something)?

Or is there a way when you apply a talos config to specify a separate controlplane/worker.yaml file and a secrets.yaml file?

How do you all separate secrets from a config that you would store publicly somewhere?

[rothgar]

A secrets file is a normal config patch. So you can use something like this

talosctl apply -f controlplane.yaml -p @secrets.yaml -p @patch-1.yaml -p @patch-2.yaml

[jabbas]

That doesn't work with talosctl v1.9.5... apply throws error:

unknown keys found during decoding:

[smira]

the example was missing @, fixed now

[jabbas]

Yes, i knew about @ sign, it's not working. Seems like the keys in secrets.yaml generated by talosctl doesn't match ones that are in controlpane.yaml

[smira]

you can't patch machine configuration with secrets, actually that answer above is more broken than I thought

[smira]

See #10612 (comment)

[xyhhx]

How do you all separate secrets from a config that you would store publicly somewhere?

personally, i generate my secrets with talosctl gen secrets, encrypt that with sops, track in git.

i use the terraform provider for talos to ingest those secrets and then generate my resources

[pjoomen]

i use the terraform provider for talos to ingest those secrets and then generate my resources

Can you elaborate on how you ingest secrets.yaml into your terraform apply?

[madeddie]

Check https://registry.terraform.io/providers/siderolabs/talos/latest/docs/resources/machine_secrets which describes importing the secrets yaml file to then use in generating configs.

[smira]

Please see #10612 (comment)