feat: implement secure node join flow #924

Unix4ever · 2025-02-11T18:46:32Z

Fixes: #840

This PR changes the Talos machine join flow drastically:

newly joined machine is first put into a limbo state where Omni creates a temporary Wireguard connection to it.
the controller picks up and tries to write a unique machine token to the newly joined machine, in the mean time it also resolves UUID conflicts automatically and writes UUID override to the META partition.
the machine re-joins Omni, now with the unique token.
the unique token is saved in the siderolink.Link resource and any subsequent join checks that siderolink.Link has matching unique token.

Siderolink manager was refactored, as it was a huge monolithic poorly testable chunk, it was split to:

LinkStatus controller, which creates/removes wireguard peers.
PendingMachineStatus controller, which ensures all joined machines have unique node tokens.
Provision handler, which implements gRPC server and has all logic related to the machine acceptance now.
PeersPool, which is used by LinkStatus controllers. It deduplicates peers creation, reuses them when possible.

Additionally updated siderolink loghandler to not accept logger connection for the machines which do not have corresponding log buffers.

Nodes which do not support secure flow are still able to join by default.
Secure join flow can be forced by setting --disable-legacy-join-tokens flag.

utkuozdemir · 2025-02-12T09:01:13Z

client/api/omni/specs/siderolink.proto

+message LinkStatusSpec {
+  string node_subnet = 1;
+  string node_public_key = 2;
+  string virtual_addrport = 3;


Why virtual?

that's for the wireguard over gRPC. We keep it there to keep track of it being updated.

client/pkg/omni/resources/omni/labels.go

client/pkg/omni/resources/siderolink/pending_machine.go

client/pkg/omni/resources/siderolink/pending_machine_status.go

cmd/omni/cmd/cmd.go

internal/backend/runtime/omni/controllers/omni/link_status.go

internal/backend/runtime/omni/controllers/omni/pending_machine_status.go

utkuozdemir · 2025-02-12T09:19:35Z

internal/backend/runtime/omni/controllers/omni/pending_machine_status.go

+func getClient(
+	ctx context.Context,
+	r controller.Reader,
+	pendingMachine *siderolink.PendingMachine,
+) (*client.Client, error) {


We have more or less the same code in many places I think - should we consider moving them to a central place?

I've extracted that and reused that in the place where I copy-pasted it from. Other places are slightly different.

internal/pkg/logreceiver/logreceiver.go

internal/pkg/siderolink/provision.go

internal/backend/runtime/omni/controllers/omni/link_status.go

internal/backend/runtime/omni/controllers/omni/pending_machine_status.go

Fixes: siderolabs#840 This PR changes the Talos machine join flow drastically: - newly joined machine first put into a limbo state where Omni creates a temporary Wireguard connection to it. - the controller picks up and tries to write a unique machine token to the newly joined machine, in the mean time it also resolves UUID conflicts automatically and writes UUID override to the META partition. - the machine re-joins Omni, now with the unique token. - the unique token is saved in the `siderolink.Link` resource and any subsequent join checks that `siderolink.Link` has matching unique token. Siderolink manager was refactored, as it was a huge monolithic poorly testable chunk, it was split to: - LinkStatus controller, which creates/removes wireguard peers. - PendingMachineStatus controller, which ensures all joined machines have unique node tokens. - Provision handler, which implements gRPC server and has all logic related to the machine acceptance now. - PeersPool, which is used by LinkStatus controllers and deduplicate peers creation, reuse them when possible. Additionally updated siderolink loghandler to not accept logger connection for the machines which do not have corresponding log buffers. Nodes which do not support secure flow are still able to join by default. Secure join flow can be forced by setting `--disable-legacy-join-tokens` flag. Signed-off-by: Artem Chernyshev <[email protected]>

Unix4ever · 2025-02-14T17:29:22Z

/m

talos-bot added the status/ok-to-test label Feb 11, 2025

Unix4ever added the integration/e2e Triggers all e2e tests for Omni label Feb 11, 2025

Unix4ever force-pushed the implement-secure-join-tokens branch 2 times, most recently from 0f385a4 to 75734bf Compare February 12, 2025 08:57