mapping values are not allowed in this context

[Sapp00]

Hi,

I am facing the error "mapping values are not allowed in this context" when parsing my talconfig.

The respective block is the following:

---
clusterName: ${clusterEndpointName}
talosVersion: v1.7.6
kubernetesVersion: v1.30.3
# endpoint: https://${clusterEndpointName}.${domainName}:6443
endpoint: https://10.10.10.11:6443
clusterPodNets:
  - 10.244.0.0/16
clusterSvcNets:
  - 10.242.0.0/16
cniConfig:
  name: none
allowSchedulingOnControlPlanes: false

nodes:
  - hostname: k8s-control01.${domainName}
    ipAddress: 10.10.10.11
    installDisk: /dev/sda
    controlPlane: true
    nameservers:
      - ${nameServer}
      - 1.1.1.1
    networkInterfaces:
      - interface: eth0
        dhcp: true
        vip:
          ip: 10.10.10.10
  - hostname: k8s-control02.${domainName}
    ipAddress: 10.10.10.12
    installDisk: /dev/sda
    controlPlane: true
    nameservers:
      - ${nameServer} # <--- line 36
      - 1.1.1.1
    networkInterfaces:
      - interface: eth0
        dhcp: true

controlplane:
  patches:
    [....]
    - |-
      - op: replace
        path: /cluster/etcd/ca
        value:
          crt: ${etcdCACert}
          key: ${etcdCAKey}
    [....]

I have no clue where this error is coming from, before reworking my configs, it was "working". Working means, that it did not throw an error, but somehow the configs were just the basic configs without my customization.

[Sapp00]

I could track it down and the error message appears because of malformed patches, which is not really intuitive.

This is the error causing patch:

    - |-
      - op: replace
        path: /cluster/etcd/ca
        value:
          crt: ${etcdCACert}
          key: ${etcdCAKey}

any idea what is wrong with it?

[budimanjojo]

Thanks for the report!

I just tried the talconfig.yaml you provided above (with the ${} replaced) and talhelper genconfig ran fine. I think the error message is you have wrong kind of value in your talenv.yaml file? Make sure they are in key: value format, for example yours should look somethine like this:

clusterEndpointName: clustername
domainName: domainname
nameServer: 1.2.3.4
etcdCACert: LS0tLS1CRUdblbalbalballaba
etcdCAKey: LS0tLS1CRUdblbalbalballaba

Another one is there's no controlplane key, it should be controlPlane.

[Sapp00]

The controlplane is a typo, but just occured when I truncated some info.

My talenv.sops.yaml is actually in the right format:

domainName: cluster.local
nameServer: 10.10.10.1
clusterEndpointName: home
clusterEndpointIP: 10.10.10.10
aggregatorCert: 123456
aggregatorKey: 123456
clusterCACert: 123456
clusterCAKey: 59hadfa9
etcdCACert: afsidiisafjafjidaf
etcdCAKey: afiadsfiansfaindfaasfiodsafo
machineCACert: asfjoiadsfijdsfoia
machineCAKey: 2orijaiusdfinsafadsf
serviceAccountKey: ab123
secretboxEncryptionSecret: aaijdfaf
clusterSecret: sdnidasgindgd
clusterToken: adjifaiugdu
machineToken: uhefiasdiufs

My whole controlPlane section:

controlPlane:
  patches:
    - |-
      - op: add
        path: /cluster/proxy/extraArgs
        value:
          feature-gates: GracefulNodeShutdown=true,MixedProtocolLBService=true
          disabled: true
    - |-
      - op: add
        path: /cluster/controllermanager/extraArgs
        value:
          feature-gates: GracefulNodeShutdown=true,MixedProtocolLBService=true
          bind-address: 0.0.0.0
    - |-
      - op: add
        path: /cluster/scheduler/extraArgs
        value:
          feature-gates: GracefulNodeShutdown=true,MixedProtocolLBService=true
          bind-address: 0.0.0.0
    - |-
      - op: add
        path: /cluster/apiserver/extraArgs
        value:
          feature-gates: GracefulNodeShutdown=true,MixedProtocolLBService=true
          admissionControl: []
    - |-
      - op: add
        path: /machine/secretboxEncryptionSecret
        value: ${secretboxEncryptionSecret}
    - |-
      - op: add
        path: /cluster/aggregatorCA
        value:
          crt: ${aggregatorCert}
          key: ${aggregatorKey}
    - |-
      - op: add
        path: /cluster/ca
          crt: ${clusterCACert}
          key: ${clusterCAKey}
    - |-
      - op: add
        path: /cluster/discovery/registries/service
        value:
          disabled: true
    - |-
      - op: replace
        path: /cluster/etcd/ca
        value:
          crt: ${etcdCACert}
          key: ${etcdCAKey}
    - |-
      - op: replace
        path: /cluster/secret
        value: ${clusterSecret}
    - |-
      - op: add
        path: /cluster/serviceAccount
        value:
          key: ${serviceAccountKey}
    - |-
      - op: replace
        path: /cluster/token
        value: ${clusterToken}
    - |-
      - op: add
        path: /machine/ca
        value:
          crt: ${machineCACert}
          key: ${machineCAKey}
    - |-
      - op: add
        path: /machine/kubelet/extraArgs
        value:
          feature-gates: GracefulNodeShutdown=true,MixedProtocolLBService=true
          rotate-server-certificates: "true"
    - |-
      - op: add
        path: /machine/kubelet/nodeIP
        value:
          validSubnets:
            - 10.10.10.0/24
    - |-
      - op: add
        path: /machine/time
        value:
          disabled: false
          servers:
            - ${nameServer}
    - |-
      - op: replace
        path: /machine/token
        value: ${machineToken}
  schematic:
    customization:
      extraKernelArgs:
        - security=apparmor
      systemExtensions:
        officialExtensions:
          - siderolabs/iscsi-tools
          - siderolabs/intel-ucode

[budimanjojo]

I found a lot of problem with your patches:

• path: /cluster/controllermanager/extraArgs should be path: /cluster/controllerManager/extraArgs
• path: /cluster/apiserver/extraArgs should be path: /cluster/apiServer/extraArgs and please remove admissionControl: [] from the value
• You didn't put value: after the line path: /cluster/ca

I also suggest you to use talsecret.sops.yaml to store those secrets instead of putting so many patches. Not sure why you prefer using patches. Read this documentation for more information: https://budimanjojo.github.io/talhelper/latest/getting-started/#you-already-have-a-talos-cluster-running

[budimanjojo]

Closing this now as it seems like not a bug.