A way to tell if a custer that is just boostraped is ready for CNI installation

[myMarck]

There should be a way from a script to know if a cluster ready for installation of an CNI if kube-proxy is disabled

In the seconds after "talosctl bootstrap" the cluster is not ready for installation of a 3 party CNI because etcd and other services are not up and running.

But currently its not possible from a script to know if the cluster is ready because "talosctl health" is stuck returning

talosctl -n 192.168.1.30 health --wait-timeout 10s
discovered nodes: ["192.168.1.30" "192.168.1.33" "192.168.1.34" "192.168.1.35"]
waiting for etcd to be healthy: ...
waiting for etcd to be healthy: OK
waiting for etcd members to be consistent across nodes: ...
waiting for etcd members to be consistent across nodes: OK
waiting for etcd members to be control plane nodes: ...
waiting for etcd members to be control plane nodes: OK
waiting for apid to be ready: ...
waiting for apid to be ready: OK
waiting for all nodes memory sizes: ...
waiting for all nodes memory sizes: OK
waiting for all nodes disk sizes: ...
waiting for all nodes disk sizes: OK
waiting for no diagnostics: ...
waiting for no diagnostics: active diagnostics: 192.168.1.30: kubelet server certificate rotation is enabled, but CSR is not approved; 192.168.1.33: kubelet server certificate rotation is enabled, but CSR is not approved; 192.168.1.34: kubelet server certificate rotation is enabled, but CSR is not approved; 192.168.1.35: kubelet server certificate rotation is enabled, but CSR is not approved

[smira]

You can use kubectl apply before it succeeds, or anything idempotent like that.

In your case, server-side kubelet certificate issue is enabled, but no CSR approver is installed, which is unrelated.

[divStar]

I'm sorry to respond to an old ticket, but is it possible to install this patch without a CNI?

cluster:
  extraManifests:
    - https://raw.githubusercontent.com/alex1989hu/kubelet-serving-cert-approver/main/deploy/standalone-install.yaml
    - https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

I don't think so - and thus I cannot enable this patch in advance either:

machine:
  kubelet:
    extraArgs:
      rotate-server-certificates: true

I think https://www.talos.dev/v1.11/kubernetes-guides/configuration/deploy-metrics-server/ should state, that you need the CNI to be installed before either of the patches are applied, because else the node will not start up.

Here are the log statements I get if I attempt it regardless:

 user: warning: [2025-09-21T18:43:18.831880144Z]: [talos] diagnostic still active {"component": "controller-runtime", "controller": "runtime.DiagnosticsLoggerController", "id": "kubelet-csr", "message": "kubelet server certificate       
 rotation is enabled, but CSR is not approved", "details": ["kubelet API error: remote error: tls: internal error", "pending CSRs: csr-786qr"], "url": "https://talos.dev/diagnostic/kubelet-csr"}                                           
 user: warning: [2025-09-21T18:43:26.937317144Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: Get        
 \"https://127.0.0.1:10250/pods/?timeout=30s\": remote error: tls: internal error"}        

[rothgar]

You can manually approve a CSR via kubectl, but you'd need a CNI for any workloads to run (excluding daemonsets and pinned workloads). That's standard kubernetes behavior on any kubernetes distribution. A CNI is required for a node to be ready and healthy for workloads.

[divStar]

So to summarize what you said: I should install the CNI first and if that's Cilium (and not Flannel, which is the default), it means I shouldn't be using that extraManifests property, but apply them later by hand?

Also thank you very much for your response 😊.

[rothgar]

You can deploy cilium with an inline or extra manifest, you'll just need to generate the raw yaml instead of using the cilium CLI or helm. To deploy by hand you can see the docs here https://www.talos.dev/v1.11/kubernetes-guides/network/deploying-cilium/#method-4-helm-manifests-inline-install

[myMarck]

Hello Smira
You are right - If i remove the code to enable metrics sever it works.