Talos configuration for vmware ignoring control plane config file

[GurdipS5]

Hi
I want to setup Talos on VSphere. I am following the guide, however, I noticed the control plane VM does not get a correct IP or DNS servers, or gateway, set. I am doing this the long way via commands as govcli is giving some wierd errors in the vmware script. I am on Windows 11 and use WSL.

I have attached my config file for the control plane which has the correct values in it.
controlplane2.txt

Attached is a screenshot of what the vm shows in the console (which is different to the config file).

The paths to the config file are correct too.

[smira]

Your machine is in maintenance mode, it didn't get the configuration at all. The actual error might somewhere in the log.

[GurdipS5]

Hi,
I sorted this. The issue was environmental (my machnine).

I have a question about the worker nodes. I want them on the same subnet. Do I need to fill in this value?

          vip:
            ip: <VIP> # Specifies the IP address to be used.

I guess this is just for the control plane?

To set the static IP, I have this configuration:

    interfaces:
        - interface: eth0 # The interface name.
          dhcp: false # Indicates if DHCP should be used to configure the interface.
          routes:
            - network: 0.0.0.0/0 # The route's network (destination).
              gateway: 10.0.0.242 # The route's gateway (if empty, creates link scope route).
          addresses:
            - 10.2.0.8/29

However, on my worker node, the gateway is N/A ?

Everything else is set.

[smira]

VIP is for Kubernetes control plane, it's no allowed on worker nodes.

Your gateway is outside of the subnet of the address you assigned. It's either a misprint, or add a static route to your gateway.

[GurdipS5]

Hi Smira,

Ok the gateway got picked up. I am going to setup two subnets that are unique, one for the control plane, one for the worker nodes. To keep things tidy. Same physical gateway but with two interfaces for each subnet, and ensure the firewall lets traffic in.

[GurdipS5]

I'm a little confused on one thing. The gateway will sit within the cidr range for the worker nodes/control plane, but wouldn't this risk getting the same IP as the gateway?

EG:

CIDR: 172.168.0.128/25
Usable IP range: 172.168.0.129 to 172.168.0.254
Total IPs: 2^7 - 2 = 126

[smira]

at this point, your question is not related to Talos Linux directly.

usually gateway is within the subnet, if you want it out of subnet, you need add a separate route to make it reachable:

routes:
  - network: gateway_IP/32
  - gateway: gateway_IP

(these are two routes, not one)

[GurdipS5]

Hi,
So I sorted all these issues out. However, last night I noticed that the first worker node reported a healthy kubelet but the second worker node did not, despite rebooting the node etc. I went to bed and this morning I noticed that the second worker node now indeed reports a healthy kubelet (so all nodes are healthy). But the uptime reported is 1hr so it rebooted. Is that normal?

I also see errors like this, are these normal?

[smira]

it is not expected

[GurdipS5]

What can I do? the discovery error I can't really do much about, the networ kis all good so it can't be that.

[smira]

sorry, troubleshooting your infrastructure is not in the scope of community support.

[GurdipS5]

Ok I've sorted everything out, using DHCP.

Everything is green and ready. kubelet, kubernetes, etc.

However, when I run the command talosctl get rd, I get the error:

error constructing client: failed to determine endpoints

And when I run kubectl --kubeconfig=kubeconfig get nodes, I get this error. Do I need any networking infrastructure to use the VIP?

[user@DESKTOP-QVAHNO0 xxx]$ kubectl --kubeconfig=kubeconfig get nodes
E0411 17:37:44.809225 21006 memcache.go:265] couldn't get current server API group list: Get "https://172.168.0.10:8443/api?timeout=32s": dial tcp 172.168.0.10:8443: connect: connection refused
E0411 17:37:46.854027 21006 memcache.go:265] couldn't get current server API group list: Get "https://172.168.0.10:8443/api?timeout=32s": dial tcp 172.168.0.10:8443: connect: connection refused
E0411 17:37:48.913731 21006 memcache.go:265] couldn't get current server API group list: Get "https://172.168.0.10:8443/api?timeout=32s": dial tcp 172.168.0.10:8443: connect: connection refused
E0411 17:37:50.949395 21006 memcache.go:265] couldn't get current server API group list: Get "https://172.168.0.10:8443/api?timeout=32s": dial tcp 172.168.0.10:8443: connect: connection refused
E0411 17:37:53.001021 21006 memcache.go:265] couldn't get current server API group list: Get "https://172.168.0.10:8443/api?timeout=32s": dial tcp 172.168.0.10:8443: connect: connection refused
The connection to the server 172.168.0.10:8443 was refused - did you specify the right host or port?
[user@DESKTOP-QVAHNO0 Gurdip]$

[GurdipS5]

Fixed this, used wrong port. Everything is all good now!