/proc/cmdline in maintenance mode

[blackliner]

Hi, I would like to see the content of /proc/cmdline of a PXE booted machine in maintenance mode.
talosctl -e 10.33.120.20 -n 10.33.120.20 read /proc/cmdline errors with

error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty

Which usually means --insecure is needed. But read does not seem to support --insecure. I also can't join the node, because by then /proc/cmdline will not be the same anymore.

Slack 🧵

[smira]

Talos won't let you use read API in the maintenance mode for security reasons.

The only way out is to present the cmdline as a resource in Talos.

[blackliner]

is this something I can do, or does this require a change from your end?

Or do you have other ideas how to debug this and similar problems? (Problem being that I don't know if the kernel args provided by PXE are what they should be)

[blackliner]

I can't do dashboard, dmesg... Sorry, I don't really follow the security aspect, this is a private subnet in a datacenter. I get the idea of zero trust, but if we really spin this out: Only an attacker that is already sitting on the subnet can be problematic, and in that case, they can already sniff the cleartext PXE transmissions.

[blackliner]

That being said, I can repro the issue and introspect the PXE communication via tcpdump