How to run talos offline (and without local LAN)

[mi-bauer]

I am struggling to get talos running in an offline environment. I want to run talos on a single node (metal installation on arm64 sbc, but I got the same error on a x86 laptop). The talos API should be accessible from the local LAN, thats why dhcp is on. If no internet is available and no ethernet cable is injected the node should still run its workloads. However talos does not boot with my current configuration.

My interfaces look like this:

interfaces:
  - interface: enx4251c45e1b57
	addresses:
	- "10.2.0.10/24"
	mtu: 1500
	dhcp: true

...
time:
	disabled: false
	servers:
	- time.cloudflare.com
	bootTimeout: "0m30s"

...
controlPlane:
	endpoint: https://10.2.0.10:6443

Even though I set a boot timeout in the time configuration, the boot still hangs when it tries to get the time. I repeatedly get these logs, even after 30s:

[ 13.472443] [talos] error serving dns request {"component": "dns-resolve-cache", "error": "dial udp 8.8.8.8:53: connect: network is unreachable"}
[ 13.473763] [talos] error serving dns request {"component": "dns-resolve-cache", "error": "dial udp 8.8.8.8:53: connect: network is unreachable"}
[ 13.475008] [talos] error serving dns request {"component": "dns-resolve-cache", "error": "dial udp 8.8.8.8:53: connect: network is unreachable"}
[ 13.476329] [talos] error serving dns request {"component": "dns-resolve-cache", "error": "dial udp 8.8.8.8:53: connect: network is unreachable"}
[ 13.477759] [talos] failed looking up "time.cloudflare.com", ignored {"component": "controller-runtime", "controller": "time.SyncController", "error": "lookup time.cloudflare.com on 127.0.0.53:53: server misbehaving"}

I am running talos 1.8.2 and kubernetes v1.31.2

Is there working example for using talos offline on metal with no ethernet and internet connection?
Or do you have any advice?

Any help is appreciated. :)

[rothgar]

Talos runs fine without internet access. You can disable the time synchronization or point it to a time sync server you run in your LAN.

[smira]

it certainly shouldn't be in k8s CIDR range

[dekavox]

Yeah, but 10.2.0.10/24 matches this "no-k8s" filter, or am I wrong (or don't get the logic)?

Does it make sense (is it common) to block the whole "Private Class A" (10.0.0.0/8) for k8s?
Sure, there needs to be a blocked segment for k8s/talos but subnets of this network (10.0.0.0/8) are widely used in companies LANs as well.

Would it be an option to implement this filter (as far as this is the problem) a little bit more selectively?
Beside this we will double-check with a static ip from another net segment (e.g. Class C) to check if this solves the problem.

Kind regards :-)

[smira]

I think this is not going in the right direction, you pull in test code, assume the data there is k8s filter, this is all wrong.

Please create an issue, and we will take a look later, thank you.

[dekavox]

Ok, sorry, I just wanted to try to help with the error analysis and not start a discussion of principles ;-)
Just recognized that the latter is a test file, my apologies!
We will create an issue as you suggested.

Thanks for the very responsive support!

[mi-bauer]

I just created the new issue here.