Issues with Applying Talos Linux Configuration on Remote VPS with Public IP

[YaroCabbage]

Hi everyone,

I'm trying to install and configure Talos Linux on a remote VPS that has both a private subnet and a public IP address. When I attempt to apply the configuration using the public IP, I encounter the following error:
error applying new configuration: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate is valid for 127.0.0.1, 192.168.199.133, ::1, not 87.228.17.99"

Here is command I'm running

talosctl apply-config --talosconfig=./clusterconfig/talosconfig --nodes=87.228.17.99 --file=./clusterconfig/my-cluster-master.yaml;

I suspect that Talos is generating certificates that are only valid for local network IPs. How can I configure Talos Linux to work with my public IP address in this scenario? Here are the specifics of my setup:

1. The VPS has a public IP: 87.228.17.99.
2. It also has a private subnet with IP: 192.168.199.133.
3. I need to apply the configuration using the public IP address due to network constraints.

Any advice or steps to resolve this issue would be greatly appreciated!

Thanks in advance.

[smira]

When Talos runs on a platform it knows about (e.g. AWS), it will automatically pull down the public IP from the cloud metadata and issue the correct certificate.

I guess your provider is not supported by Talos, so you'd need to tell Talos about the address which is not attached to the VM by patching the machine configuration with this:

machine:
  certSANs:
    - 87.228.17.99

[YaroCabbage]

Yes, my provider is not supported by Talos. I did patch previously the machine configuration with the certSANs setting, but it didn't resolve the issue. I suspect that Talos doesn't recognize that the remote VPS has a public IP (87.228.17.99). Consequently, Talos generated TLS certificates that are only valid within the private network, where the remote machine has the IP 192.168.199.133.

Here is my configuration done with talhelper:

---
clusterName: my-cluster
endpoint: https://87.228.17.99:6443
additionalMachineCertSans:
  - 87.228.17.99
additionalApiServerCertSans:
  - 87.228.17.99
nodes:
  - hostname: master
    controlPlane: true
    ipAddress: 87.228.17.99
    installDisk: /dev/sda

Here is file which i've tried to apply:

version: v1alpha1
debug: false
persist: true
machine:
  type: controlplane
  token: hidden
  ca:
    crt: hidden
    key: hidden
  certSANs:
    - 87.228.17.126
  kubelet:
    defaultRuntimeSeccompProfileEnabled: true
    disableManifestsDirectory: true
  network:
    hostname: master
  install:
    disk: /dev/sda
    image: factory.talos.dev/installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v1.7.5
    wipe: false
  features:
    rbac: true
    stableHostname: true
    apidCheckExtKeyUsage: true
    diskQuotaSupport: true
    kubePrism:
      enabled: true
      port: 7445
    hostDNS:
      enabled: true
cluster:
  id: hidden
  secret: hidden
  controlPlane:
    endpoint: https://87.228.17.126:6443
  clusterName: my-cluster
  network:
    dnsDomain: cluster.local
    podSubnets:
      - 10.244.0.0/16
    serviceSubnets:
      - 10.96.0.0/12
  token: hidden
  secretboxEncryptionSecret: hidden
  ca:
    crt: hidden
    key: hidden
  aggregatorCA:
    crt: hidden
    key: hidden
  serviceAccount:
    key: hidden
  apiServer:
    certSANs:
      - 87.228.17.126
      - 87.228.17.126
    disablePodSecurityPolicy: true
    admissionControl:
      - name: PodSecurity
        configuration:
          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
          defaults:
            audit: restricted
            audit-version: latest
            enforce: baseline
            enforce-version: latest
            warn: restricted
            warn-version: latest
          exemptions:
            namespaces:
              - kube-system
            runtimeClasses: []
            usernames: []
          kind: PodSecurityConfiguration
    auditPolicy:
      apiVersion: audit.k8s.io/v1
      kind: Policy
      rules:
        - level: Metadata
  controllerManager: {}
  proxy: {}
  scheduler: {}
  discovery:
    enabled: true
    registries:
      kubernetes:
        disabled: true
      service: {}
  etcd:
    ca:
      crt: hidden
      key: hidden

[smira]

If you apply correct machine config, the certificate will include the IP from the certSANs.

[YaroCabbage]

Thanks! After this message I realized what the mistake was.
(I forgot to specify the --insecure flag)
Now everything works!