docs(talos): warn against changing op: on the machine files block#575
Conversation
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds warning callouts to two Talos installation docs explaining ChangesTalos Configuration Documentation
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds warning alerts to the Talos installation documentation (talos-bootstrap.md and talosctl.md) to caution users against changing the op: field on specific configuration entries, explaining that Talos rejects op: create outside of /var. The review comments suggest improving the phrasing "reboots on a loop" to "enters a reboot loop" for better readability in both files.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| ``` | ||
|
|
||
| {{% alert title="Do not change op: on these entries" color="warning" %}} | ||
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and reboots on a loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. |
There was a problem hiding this comment.
The phrase "reboots on a loop" is slightly unidiomatic. Consider changing it to "enters a reboot loop" or "reboots in a loop" for better readability.
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and reboots on a loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. | |
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and enters a reboot loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. |
There was a problem hiding this comment.
Reworded to "enters a reboot loop". Fixed in e2a0505.
| ``` | ||
|
|
||
| {{% alert title="Do not change op: on these entries" color="warning" %}} | ||
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and reboots on a loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. |
There was a problem hiding this comment.
The phrase "reboots on a loop" is slightly unidiomatic. Consider changing it to "enters a reboot loop" or "reboots in a loop" for better readability.
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and reboots on a loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. | |
| Talos rejects `op: create` for any file outside `/var` with `create operation not allowed outside of /var` — the only exception is the special-cased `/etc/cri/conf.d/20-customization.part`. Because `/etc/lvm/lvm.conf` already exists on the node, it must use `op: overwrite`. Changing the op (or pointing `create` at another `/etc` path) fails the `WriteUserFiles` boot step: the node pauses and enters a reboot loop, and `talosctl bootstrap` reports only `bootstrap is not available yet` with no obvious cause. |
There was a problem hiding this comment.
Reworded to "enters a reboot loop". Fixed in e2a0505.
Aleksei Sviridkin (lexfrei)
requested review from
Andrei Kvapil (kvaps) and
Timofei Larkin (lllamnyp)
as code owners
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
content/en/docs/next/install/kubernetes/talosctl.md (1)
129-131: ⚡ Quick winConsider clarifying the error message format.
The phrase "with
create operation not allowed outside of /var" embeds what appears to be a Talos error message in prose. For clarity, consider either:
- Formatting it as a direct quote: "Talos rejects
op: createfor any file outside/var, returning the errorcreate operation not allowed outside of /var", or- Paraphrasing without backticks: "Talos rejects
op: createfor any file outside/var(except the special-cased/etc/cri/conf.d/20-customization.part)"The current phrasing mixes quotation and paraphrase.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@content/en/docs/next/install/kubernetes/talosctl.md` around lines 129 - 131, The sentence mixing prose and an embedded Talos error should be clarified: either rephrase it to quote the exact error (e.g., "Talos rejects `op: create` for any file outside `/var`, returning the error `create operation not allowed outside of /var`") or fully paraphrase without backticks (e.g., "Talos rejects op: create for any file outside /var (except the special-cased /etc/cri/conf.d/20-customization.part)"); update the text that references op: create, /var, /etc/cri/conf.d/20-customization.part, /etc/lvm/lvm.conf, WriteUserFiles, and the talosctl bootstrap message so the error string is consistently quoted or removed from inline prose for clarity.content/en/docs/next/install/kubernetes/talos-bootstrap.md (1)
105-107: ⚡ Quick winConsider clarifying the error message format.
The phrase "with
create operation not allowed outside of /var" embeds what appears to be a Talos error message in prose. For clarity, consider either:
- Formatting it as a direct quote: "Talos rejects
op: createfor any file outside/var, returning the errorcreate operation not allowed outside of /var", or- Paraphrasing without backticks: "Talos rejects
op: createfor any file outside/var(except the special-cased/etc/cri/conf.d/20-customization.part)"The current phrasing mixes quotation and paraphrase.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@content/en/docs/next/install/kubernetes/talos-bootstrap.md` around lines 105 - 107, The sentence embedding the Talos error mixes prose and an inline code-like error; update the sentence in the alert so the Talos error is clearly distinguished — either quote the exact error string or paraphrase it without backticks. Specifically, revise the phrase that currently reads 'with `create operation not allowed outside of /var`' so it becomes either a direct quoted error (e.g., "returning the error 'create operation not allowed outside of /var'") or a paraphrase (e.g., "(Talos rejects op: create for any file outside /var, except /etc/cri/conf.d/20-customization.part)"); keep references to op: create, /var, /etc/cri/conf.d/20-customization.part, /etc/lvm/lvm.conf, WriteUserFiles, and talosctl bootstrap intact for context.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@content/en/docs/next/install/kubernetes/talos-bootstrap.md`:
- Around line 105-107: The sentence embedding the Talos error mixes prose and an
inline code-like error; update the sentence in the alert so the Talos error is
clearly distinguished — either quote the exact error string or paraphrase it
without backticks. Specifically, revise the phrase that currently reads 'with
`create operation not allowed outside of /var`' so it becomes either a direct
quoted error (e.g., "returning the error 'create operation not allowed outside
of /var'") or a paraphrase (e.g., "(Talos rejects op: create for any file
outside /var, except /etc/cri/conf.d/20-customization.part)"); keep references
to op: create, /var, /etc/cri/conf.d/20-customization.part, /etc/lvm/lvm.conf,
WriteUserFiles, and talosctl bootstrap intact for context.
In `@content/en/docs/next/install/kubernetes/talosctl.md`:
- Around line 129-131: The sentence mixing prose and an embedded Talos error
should be clarified: either rephrase it to quote the exact error (e.g., "Talos
rejects `op: create` for any file outside `/var`, returning the error `create
operation not allowed outside of /var`") or fully paraphrase without backticks
(e.g., "Talos rejects op: create for any file outside /var (except the
special-cased /etc/cri/conf.d/20-customization.part)"); update the text that
references op: create, /var, /etc/cri/conf.d/20-customization.part,
/etc/lvm/lvm.conf, WriteUserFiles, and the talosctl bootstrap message so the
error string is consistently quoted or removed from inline prose for clarity.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cb6ab64e-9bb7-48d2-9766-878aac319cbf
📒 Files selected for processing (2)
content/en/docs/next/install/kubernetes/talos-bootstrap.mdcontent/en/docs/next/install/kubernetes/talosctl.md
Aleksei Sviridkin (lexfrei)
force-pushed
the
docs/talos-files-op-warning
branch
from
b40c7ed to
e2a0505
Compare
Talos rejects op: create for files outside /var, so the lvm.conf customization must stay op: overwrite. A wrong op fails the WriteUserFiles boot step and reboot-loops the node with an opaque "bootstrap is not available yet". Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Phrase the rejected-create error as a returned error string and replace 'reboots on a loop' with 'enters a reboot loop' for readability. Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin (lexfrei)
force-pushed
the
docs/talos-files-op-warning
branch
from
e2a0505 to
b4c39ff
Compare
IvanHunters
left a comment
IvanHunters
left a comment
There was a problem hiding this comment.
Approve.
The warning is factually correct and appropriately scoped — it doesn't overstate the behavior. Verified against Talos:
- the
create operation not allowed outside of /varerror string matches siderolabs/talos#12529 - the
/etc/cri/conf.d/20-customization.partspecial-case matches the Talos containerd guide - the opaque
bootstrap is not available yetfailure mode is attested in siderolabs/talos#11132
Hugo alert shortcode is correct and the prior bot suggestions are addressed.
Non-blocking: the callout is duplicated byte-for-byte in both files — just something to keep in sync if the behavior ever changes.
2 participants
What
Adds a warning next to the Talos
machine.filesblock in the bare-metal bootstrap docs (talm and talosctl variants).Why
Talos rejects
op: createfor any file outside/var, except the special-cased CRI customization part, so the/etc/lvm/lvm.confentry must useop: overwrite. If the op is changed, theWriteUserFilesboot step fails, the node reboot-loops, andtalosctl bootstrapreports only the opaquebootstrap is not available yet— making the root cause hard to find. Hit during a real bare-metal install.Summary by CodeRabbit
opoperations, explaining thatop: createis restricted to/var(with an allowed exception) and that specific files like/etc/lvm/lvm.confrequireop: overwrite.opvalues can lead to node boot failure/boot loops and may blocktalosctl bootstrap.