talosctl — CLI Operations

For machine config YAML (documents, patching) see talosconfig. For Terraform provider see talos-terraform.

⚠️ Configuration Changes Require Dry-Run + Verification

Every apply-config and patch machineconfig MUST be dry-run first, and the user MUST review/approve the output before anything is applied:

# Dry-run first — always
talosctl patch machineconfig --nodes <ip> --patch @patch.yaml --dry-run
talosctl apply-config --nodes <ip> --file config.yaml --dry-run

Only after the user explicitly confirms the dry-run output, run without --dry-run.

⚠️ apply-config Needs the FULL Config File

talosctl apply-config --file <config> replaces the node's entire machine configuration with the contents of <config>. It is NOT a patch tool — providing a partial YAML wipes all unspecified settings.