Documentation
¶
Index ¶
- Variables
- func CheckChartDrift(rootDir, binaryVersion string) (bool, string, error)
- func CheckPresetDrift(rootDir, binaryVersion string) (bool, string, error)
- func DetectAndSetRoot(cmd *cobra.Command, _ []string) error
- func DetectAndSetRootFromFiles(filePaths []string) error
- func DetectProjectRoot(startDir string) (string, error)
- func DetectProjectRootForFile(filePath string) (string, error)
- func DetectRootForTemplate(templatePath string) (string, error)
- func EnsureTalosconfigPath(cmd *cobra.Command)
- func ExpandFilePaths(paths []string) ([]string, error)
- func ResolveSecretsPath(withSecrets string) string
- func ValidateAndDetectRootsForFiles(filePaths []string) (string, error)
- func WithClient(action func(context.Context, *client.Client) error, ...) error
- func WithClientAuto(action func(context.Context, *client.Client) error) error
- func WithClientMaintenance(enforceFingerprints []string, ...) error
- func WithClientNoNodes(action func(context.Context, *client.Client) error, ...) error
- func WithClientSkipVerify(action func(context.Context, *client.Client) error) error
- func WritePresetLock(rootDir, preset string) error
Constants ¶
This section is empty.
Variables ¶
var Commands []*cobra.Command
Commands is a list of commands published by the package.
var CompleteTalosconfigEndpoints = completeTalosconfigField(flagNameEndpoints)
CompleteTalosconfigEndpoints is the exported entry point for completion of the root `--endpoints` persistent flag.
var CompleteTalosconfigNodes = completeTalosconfigField(flagNameNodes)
CompleteTalosconfigNodes is the exported entry point for completion of the root `--nodes` persistent flag. main.go wires it via cobra.RegisterFlagCompletionFunc.
var Config struct { RootDir string RootDirExplicit bool // true if --root was explicitly set // StrictCharts turns vendored-chart drift into a hard error instead of a // warning. Opt-in per project via Chart.yaml (strictCharts: true) so a // whole team/CI inherits it; absent means a warning only (the historical // behavior). The --strict-charts flag forces it on for a single run. StrictCharts bool `yaml:"strictCharts"` GlobalOptions struct { Talosconfig string `yaml:"talosconfig"` Kubeconfig string `yaml:"kubeconfig"` } `yaml:"globalOptions"` TemplateOptions struct { Offline bool `yaml:"offline"` ValueFiles []string `yaml:"valueFiles"` Values []string `yaml:"values"` StringValues []string `yaml:"stringValues"` FileValues []string `yaml:"fileValues"` JsonValues []string `yaml:"jsonValues"` //nolint:revive // public field name kept for backwards compatibility with existing consumers in template.go and pkg/engine LiteralValues []string `yaml:"literalValues"` TalosVersion string `yaml:"talosVersion"` WithSecrets string `yaml:"withSecrets"` KubernetesVersion string `yaml:"kubernetesVersion"` Full bool `yaml:"full"` Debug bool `yaml:"debug"` } `yaml:"templateOptions"` ApplyOptions struct { DryRun bool `yaml:"preserve"` Timeout string `yaml:"timeout"` TimeoutDuration time.Duration CertFingerprints []string `yaml:"certFingerprints"` } `yaml:"applyOptions"` UpgradeOptions struct { Preserve bool `yaml:"preserve"` Stage bool `yaml:"stage"` Force bool `yaml:"force"` } `yaml:"upgradeOptions"` InitOptions struct { Version string } }
Config is the package-level configuration populated from Chart.yaml and CLI persistent flags. Mirrors GlobalArgs for project-root-relative path resolution across every subcommand.
var ErrNoBaseline = errors.New("no drift baseline to compare")
ErrNoBaseline marks the "nothing to compare" drift outcome: the project has no vendored charts/talm/ or no .talm-preset.lock. Non-strict callers treat it as silence — a project generated before baseline pinning should not nag. Strict callers escalate instead: under opt-in enforcement a missing baseline is indistinguishable from a deleted one, and letting it pass would make deletion the cheapest bypass of the check.
var GlobalArgs global.Args
GlobalArgs is the common arguments for the root command.
Functions ¶
func CheckChartDrift ¶ added in v0.33.0
CheckChartDrift reports whether a project's vendored charts/talm/ library diverges, by content, from the copy built into this talm binary.
talm vendors its library chart into the project at `talm init` time; rendering (template/apply/upgrade) reads that local copy, never the binary's embedded charts. Upgrading the binary therefore leaves charts/talm/ frozen at the version that last ran init. CheckChartDrift surfaces that staleness so the operator can re-run `talm init --update --preset <preset>`.
The comparison is by content: the Chart.yaml version stamp is normalized away on both sides, so a pure version bump that left the library byte-identical is NOT reported as drift. binaryVersion is used only for the operator-facing message.
When the project has no vendored library to compare, it returns an error matching ErrNoBaseline (errors.Is) so the caller can choose silence (non-strict) or a blocker (strict). A read or walk failure is returned as a plain error; non-strict callers treat drift detection as best-effort and must not block a command on it.
func CheckPresetDrift ¶ added in v0.33.0
CheckPresetDrift reports whether the preset built into this talm binary has changed since the project was generated, by comparing the binary's current preset hash against the baseline pinned in rootDir/.talm-preset.lock at init time.
For a project with no lock file (one generated before preset pinning existed, or never init'd from a preset) it returns an error matching ErrNoBaseline (errors.Is): non-strict callers stay silent — there is no baseline to compare, and inventing drift would nag every such project — while strict callers escalate. binaryVersion is used only for the operator-facing message.
Crucially this never reads the project's templates/, so operator edits to the rendered preset are NOT drift: the baseline is the pristine preset hash at init, and the comparison is binary-now vs that baseline.
func DetectAndSetRoot ¶ added in v0.18.1
DetectAndSetRoot detects and sets the project root using fallback strategy: 1. From -f/--file flag (if files specified) 2. From -t/--template flag (if templates specified) 3. From current working directory
args is part of the cobra.PositionalArgs / PreRunE signature; the function does not consult positional arguments — root selection is driven entirely by --root, --file, --template, and the CWD walk-up.
func DetectAndSetRootFromFiles ¶ added in v0.18.1
DetectAndSetRootFromFiles detects and sets project root from file paths. This is a common pattern used in commands like apply, upgrade, and talosctl wrapper. It detects root from files if provided, otherwise falls back to current working directory.
func DetectProjectRoot ¶ added in v0.18.1
DetectProjectRoot automatically detects the project root directory by looking for Chart.yaml and secrets.yaml (or secrets.encrypted.yaml) files in the current directory and parent directories. Returns the absolute path to the project root, or empty string if not found.
func DetectProjectRootForFile ¶ added in v0.18.1
DetectProjectRootForFile detects the project root for a given file path. It finds the directory containing the file, then searches up for Chart.yaml and secrets.yaml.
func DetectRootForTemplate ¶ added in v0.18.1
DetectRootForTemplate detects the project root for a template file path. Similar to ValidateAndDetectRootsForFiles but for a single template file.
func EnsureTalosconfigPath ¶ added in v0.18.1
EnsureTalosconfigPath ensures talosconfig path is set to project root if not explicitly set via flag.
func ExpandFilePaths ¶ added in v0.19.0
ExpandFilePaths expands file paths: if a path is a directory, finds all YAML files in it. Returns a list of file paths, with directories expanded to their YAML files.
func ResolveSecretsPath ¶ added in v0.18.1
ResolveSecretsPath resolves secrets.yaml path relative to project root if not absolute.
func ValidateAndDetectRootsForFiles ¶ added in v0.18.1
ValidateAndDetectRootsForFiles resolves the project root for a chain of `-f` files. Only the FIRST file anchors the project root; subsequent files are loaded as patches without re-running detection, so a chain like `talm apply -f nodes/cp01.yaml -f /tmp/side-patch.yaml` is accepted — cp01.yaml carries the root, side-patch.yaml is patched on top without needing its own Chart.yaml ancestor.
The first-file-anchors rule is ordering-dependent by design. Reversing the chain (orphan first, rooted second) is rejected with a hint that names the FIRST file and tells the operator to reorder, not to move the file. Single-file orphans continue to error out exactly as before.
Wrapped talosctl subcommands (`talm dashboard -f …`, `talm reset -f …`, `talm get -f …`) also call this through their PreRunE chain. For them the "chain" notion isn't semantic — each file is its own per-node modeline source — but the relaxed first-file-anchors rule still applies: a cross-project chain that would have errored before now silently pins Config.RootDir to file[0]'s root. In practice operators don't mix files from different projects in a single talosctl invocation; if they do, EnsureTalosconfigPath downstream will use file[0]'s talosconfig.
func WithClient ¶
func WithClient(action func(context.Context, *client.Client) error, dialOptions ...grpc.DialOption) error
WithClient builds upon WithClientNoNodes to provide set of nodes on request context based on config & flags.
func WithClientAuto ¶ added in v0.21.0
WithClientAuto automatically selects the appropriate client wrapper based on GlobalArgs.SkipVerify. If SkipVerify is true, uses WithClientSkipVerify, otherwise uses WithClientNoNodes.
func WithClientMaintenance ¶
func WithClientMaintenance(enforceFingerprints []string, action func(context.Context, *client.Client) error) error
WithClientMaintenance wraps common code to initialize Talos client in maintenance (insecure mode).
func WithClientNoNodes ¶
func WithClientNoNodes(action func(context.Context, *client.Client) error, dialOptions ...grpc.DialOption) error
WithClientNoNodes wraps common code to initialize Talos client and provide cancellable context.
WithClientNoNodes doesn't set any node information on the request context.
func WithClientSkipVerify ¶ added in v0.21.0
WithClientSkipVerify wraps common code to initialize Talos client with TLS verification disabled but with client certificate authentication preserved. This is useful when connecting to nodes via IP addresses not listed in the server certificate's SANs.
func WritePresetLock ¶ added in v0.33.0
WritePresetLock pins the current pristine hash of preset into rootDir/.talm-preset.lock. Called after `talm init` (and `init --update`) has materialized the preset into the project, so a later binary upgrade that changes the preset can be surfaced by CheckPresetDrift. The hash is of the EMBEDDED preset, not the project's (possibly operator-edited) copy.
Types ¶
This section is empty.
Source Files
¶
- apply.go
- chart_drift.go
- completion.go
- consts.go
- crashdump_handler.go
- dmesg_handler.go
- init.go
- kubeconfig_handler.go
- preflight.go
- preflight_apply_safety.go
- preflight_apply_safety_modedetails.go
- preflight_apply_safety_redact.go
- preflight_upgrade_verify.go
- reset_handler.go
- root.go
- root_detection.go
- rotate_ca_handler.go
- talosconfig.go
- talosctl_wrapper.go
- template.go
- tui_handler.go
- upgrade_handler.go
- upgrade_image_source.go
- upgrade_image_writeback.go
- value_secret.go