# 0073. A read-only Talos details view on the machine page

Status: Accepted · Date: 2026-10-26 · Design section: UI backend, Talos access, Secrets
Decided: `NodeService.GetNodeTalosDetails` returns five independently failing sections (system, network, storage, services, extensions) read from the node over the existing read-only Talos client; every field is copied by name, nothing from config, certificates, keys or tokens is carried, and kernel arguments that could hold a credential are masked; an unapproved machine is read over the insecure maintenance API and flagged `maintenance_mode`

## Context

The machine page showed hardware, disks, links and usage. Operators also need to see what Talos itself reports: version, stage and unmet conditions, addressing, DNS and time, install disk and volumes, service health, extensions. The UI backend already dials each machine's Talos API read-only (`dialNode`: a `role.Reader` certificate from the bundle Secret for approved machines, the maintenance API otherwise). No new path to Talos is added.

## Decision

**RPC.** `GetNodeTalosDetails(machine)` in `NodeService`, messages in `proto/ichor/v1alpha1/talosdetails.proto`. It is authorised like `GetNode`: the TalosMachine and TalosCluster are read as the caller (impersonated with OIDC on), so a caller who cannot see the machine gets nothing from Talos.

**Independent sections.** The five sections are read concurrently, each with its own 10 second timeout. A failure puts a short message in that section's `error` field and drops any partial data of that section; the RPC itself still succeeds. The UI shows the error inline in that section.

**What is shown.**
- System: Talos version, architecture, platform and mode (from the machine API `Version`), machine stage with ready and unmet conditions (`MachineStatus`), hostname and domain, Kubernetes node name Talos registers, kernel arguments.
- Network: node addresses, links (name, MAC, operational state, MTU, speed, kind, driver), default gateways and route count, DNS resolvers and search domains, time servers, time sync state.
- Storage: disks (device, model, serial, size, type nvme/ssd/hdd/cdrom, install disk, read-only) and volume status (type, phase, location, mount location, size, filesystem, whether it is encrypted, error message).
- Services: id, state, health and last health message (machine API `ServiceList`).
- Extensions: name, version, author.

**What is deliberately not shown.** Machine configuration documents and the effective config (the page has its own masked view for that); certificates, keys, tokens and the secrets bundle; WireGuard private keys and peers; volume encryption keys, key slots and TPM options; the extension image reference; the bytes of `talos.config`-style kernel arguments. Mapping is an allowlist: each message is built field by field in `talosdetails_map.go` and `talosclient_details.go`, no Talos spec is marshalled whole, so a field Talos adds later cannot leak by accident. Kernel arguments are split and any whose key contains `token`, `secret`, `key`, `pass`, `auth`, `cred`, `config`, `siderolink` or `environment` keep their key and show `***` as value; the masking runs once, in the handler, the one boundary every `NodeTalosClient` implementation passes through. Also not shown, because there is no cheap read-only source: uptime, boot time and kernel version. Section error text is truncated to 300 bytes.

**Maintenance mode.** A machine that is not approved has no CA trust, so it is read over the insecure maintenance API, as `GetNode` already does, and the response sets `maintenance_mode`. Which calls the maintenance API accepts is up to Talos; a section it refuses shows its error inline, and the UI explains that the machine is read over the limited maintenance API and the rest appears once it is approved. Nothing is retried with other credentials.

**RBAC.** None changes: the RPC reads the same TalosMachine, TalosCluster and bundle Secret `GetNode` reads.

## Consequences

- One more read per page view against each node (five short calls); there is no polling.
- The `NodeTalosClient` interface grows five methods; fakes return canned sections, and the secret-shape tests cover the response and the mapping functions.
- `ichor` CLI's in-process fallback answers `Unavailable` for this RPC, like `GetNode`.