How to apply Firewall rules?

[MaKaNu]

I have following situation, which I do not understand completely:

My Cluster is configured with 4 nodes:

• 1 Control-Plane
• 3 Worker Nodes

I try to achieve the following:

Access the prometheus via nginx-ingress via metallb which are all deployed inside my cluster.

All seems to work as I expected, with the only exception: How to expose the metallb ports 80, 443?

I do not understand where the firewall rules explained in the docs need to be applied.

The command to get the current firewall config returns the following error:

❯ talosctl get mc v1alpha1 -o yaml | yq .spec | yq 'select(.kind == "NetworkDefaultActionConfig"),select(.kind == "NetworkRuleConfig" )'
jq: error (at <stdin>:1): Cannot index string with string "kind"

And trying to apply firewall rule returns like this:

❯ talosctl apply-config -n ctrl-node --file ingress-firewall-cp.yaml
error applying new configuration: 1 error occurred:
        * ctrl-node: rpc error: code = InvalidArgument desc = error decoding NetworkRuleConfig to *network.RuleConfigV1Alpha1: netip.ParsePrefix("$CLUSTER_SUBNET"): no '/'

where the content of ingress-firewall-cp.yaml is jsut thee content described here

My thought process was: If I am able to get and set the default rules I am also able to expand for metallb.

If I am totally sideways, please tell what I am doing wrong.

[smira]

First of all, $VARIABLE needs to be replaced to match your networking in the example.

Second, these are the documents that you need to append to your machine config. So you have options here, and you can pick whatever works best for you:

• generate machine config with patches in the first place (talosctl gen config ... --config-patch=@firewall.patch)
• patch the running machine with the document (talosctl patch mc --patch=@firewall.patch)
• download the config and patch it offline

Plase see docs

[MaKaNu]

Ok, I think I got my mistake.

In the first approach, no firewall configuration is active. So as example the service (Prometheus frontend) should be directly accessible via DNS request which maps to the control-plane and my metallb is probably not fully deployed. Which is why my first command is not working correctly

Second, IF I want to apply ingress I just follow your hints (updating vars, append instead of apply)