菜单
Remote access reference for Anton — how to reach the cluster from off-LAN via talosctl, kubectl, and Tailscale MagicDNS. Use when working with talosconfig, kubectl context, tailscale, remote access, or when you cannot reach k8s nodes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Kubernetes-layer health triage for Anton. Use when Codex checks whether the cluster is OK, Flux is healthy, platform controllers are ready, CNI or DNS is failing, cert-manager or ESO is stuck, gateways are broken, cloudflared is disconnected, or apps are unhealthy.
Intake gate for adding new system or infrastructure components to Anton. Use when deciding whether to adopt, install, evaluate, or learn a new app, operator, Helm chart, or platform component before scaffolding manifests. Applies concrete-need and honest-learning rubrics, checks containment and removal history, returns add/defer/reject with ADR-ready output, and stays read-only.
Deploy or onboard an owned Anton app through Flux image automation. Use for deploy, redeploy, force reconcile, deploy homepage, onboard app, new owned app, ADR 0024 image automation, ImageRepository loops, rollout watching, and public URL verification. Reports stuck reconciles and hands them to debug-flux-reconciliation.
Expose a workload for Anton access. Use when choosing between envoy-internal, Tailscale Ingress, Tailscale Service annotation, or explicitly approved envoy-external plus Cloudflare tunnel. Handles HTTPRoute authoring, DNSEndpoint for secondary domains, per-domain cert wiring, and route verification.
Operate Anton's time-boxed ClickStack logs and traces experiment. Use when handling HyperDX UI access, ClickHouse, Keeper, MongoDB, OTel collector health, Flux reconciliation, OTLP test signals, Lucene or SQL queries, ESO and 1Password credential rotation, Renovate chart or operator bumps, the 2026-08-02 ADR 0028 review, or ClickStack teardown. Keywords: clickstack, hyperdx, clickhouse, keeper, mongodb, otel, otlp, logs, traces, wide events, temporal traces, review-by, ADR 0028.
Operate the time-boxed ClickStack logs/traces experiment on anton (ClickHouse + Keeper + MongoDB + OTel collector + HyperDX, per ADR 0028). Use to access the HyperDX UI, send a test signal (pod logs via the bundled OTel collector, point Temporal's OTLP traces at it), run Lucene/SQL queries, check health of any ClickStack component, reconcile/debug the Flux flow, rotate the 1Password credentials via ESO, triage Renovate bumps for the two operators + chart, run the 2026-08-02 review-by checklist, or execute the exit/teardown runbook. Keywords — clickstack, hyperdx, clickhouse, keeper, mongodb, otel collector, otlp, logs, traces, wide events, lucene, temporal traces, teardown, exit plan, review-by, ADR 0028.
| name | anton-remote-access |
| description | Remote access reference for Anton — how to reach the cluster from off-LAN via talosctl, kubectl, and Tailscale MagicDNS. Use when working with talosconfig, kubectl context, tailscale, remote access, or when you cannot reach k8s nodes. |
| allowed-tools | Read, Bash |
How to reach the cluster and nodes from a workstation. This is the primary access path — the workstation is not assumed to be on the node LAN.
# Talos (node management) — via Tailscale MagicDNS hostnames
talosctl --talosconfig ./talos/clusterconfig/talosconfig \
-e k8s-1 -n k8s-1,k8s-2,k8s-3 <command>
# Kubernetes — via kubeconfig generated by task bootstrap / talhelper
kubectl get nodes
The cluster nodes (k8s-1, k8s-2, k8s-3) are reachable two ways:
192.168.x.x addresses in talos/talconfig.yaml. Only works when the workstation is on the home network.k8s-1, k8s-2, k8s-3. This is the default remote path. Prefer MagicDNS hostnames over Tailscale 100.x.x.x IPs in any output that might be saved or shared.The Tailscale extension is configured per-node in talos/patches/<hostname>/; the auth key is in talos/talenv.sops.yaml. State is in memory (TS_STATE_DIR=mem:), so nodes re-register with a -1 suffix after reboot — clean up the old node in the Tailscale admin console.
The generated talosconfig at talos/clusterconfig/talosconfig is gitignored (produced by task talos:generate-config). It bakes in the LAN IPs as default endpoints, so when working off-LAN you must override with -e:
# Single node
talosctl --talosconfig ./talos/clusterconfig/talosconfig -e k8s-1 -n k8s-1 <cmd>
# Fan out to all nodes (pick any reachable node as the -e endpoint)
talosctl --talosconfig ./talos/clusterconfig/talosconfig \
-e k8s-1 -n k8s-1,k8s-2,k8s-3 <cmd>
Common read-only queries:
talosctl ... get disks # block devices (NVMe, loops, rbd)
talosctl ... get members # cluster membership
talosctl ... get addresses # interface addresses
talosctl ... version # server vs client version skew
talosctl ... dmesg -f # kernel log (follow)
talosctl ... logs <service> # machined / kubelet / etcd / etc.
If talosctl errors with failed to determine endpoints or talos config file is empty, the default ~/.talos/config has no context set — always pass --talosconfig ./talos/clusterconfig/talosconfig explicitly from the repo root.
Kubernetes API access also flows over Tailscale when remote. The cluster_api_addr in cluster.yaml is a LAN VIP, so the kubeconfig server URL may need to point at a Tailscale-reachable endpoint (a node hostname or the VIP if it is also advertised on the tailnet). Check the active context before troubleshooting connectivity:
kubectl config current-context
kubectl config view --minify
Per the top-level CLAUDE.md rule: never write the real tailnet name into any file under git. Use the placeholder <tailnet-name>.ts.net in documentation, examples, and commit messages. MagicDNS short hostnames (k8s-1 etc.) are fine — they are not tailnet-identifying on their own. Tailscale 100.x.x.x IPs should also be avoided in committed files.
If you discover a real tailnet name in the working tree, do not commit until it has been replaced with the placeholder.
| Symptom | Likely cause | Fix |
|---|---|---|
failed to determine endpoints | no -e flag and default config has no context | pass --talosconfig ./talos/clusterconfig/talosconfig -e <host> |
talos config file is empty | ~/.talos/config has never been populated | same — point at the repo's talosconfig explicitly |
i/o timeout on a 192.168.x.x IP | off-LAN; LAN addresses unreachable | switch to Tailscale MagicDNS hostname (k8s-1 etc.) |
server version X is older than client version Y | client/server skew, harmless until a major release | plan a Talos upgrade via the upgrade-talos-or-k8s skill |
| Tailscale host not resolving | device signed out / key expired | re-auth the node's Tailscale extension via the patch under talos/patches/<hostname>/ |
kubectl hangs from off-LAN | kubeconfig server URL is the LAN VIP, no Tailscale route to it | confirm with kubectl config view --minify; switch to a tailnet-reachable endpoint |
upgrade-talos-or-k8sadd-or-replace-nodedebug-flux-reconciliation