func main() {  	// all existing streaming methods 	for _, methodName := range []string{-		"/machine.Machine/CopyOut",+		"/machine.Machine/Copy",

 func Execute() {  	rootCmd.PersistentFlags().StringVar(&talosconfig, "talosconfig", defaultTalosConfig, "The path to the Talos configuration file") 	rootCmd.PersistentFlags().StringVar(&cmdcontext, "context", "", "Context to be used in command")-	rootCmd.PersistentFlags().StringSliceVarP(&nodes, "nodes", "", []string{}, "target the specified nodes")+	rootCmd.PersistentFlags().StringSliceVarP(&nodes, "nodes", "n", []string{}, "target the specified nodes")

 var configEndpointCmd = &cobra.Command{ 	}, } +// configNodeCmd represents the config node command.+var configNodeCmd = &cobra.Command{+	Use:     "node <endpoint>...",

 A collection of commands for managing local docker-based clusters       --context string       Context to be used in command   -e, --endpoints strings    override default endpoints in Talos configuration       --nodes strings        target the specified nodes-      --talosconfig string   The path to the Talos configuration file (default "/home/smira/.talos/config")+      --talosconfig string   The path to the Talos configuration file (default "/home/user/.talos/config")

 func (task *ExtraFiles) TaskFunc(mode runtime.Mode) phase.TaskFunc { 	return task.runtime } +// nolint: gocyclo func (task *ExtraFiles) runtime(r runtime.Runtime) (err error) {-	var result *multierror.Error+	var (+		content string+		result  *multierror.Error+	)  	for _, f := range r.Config().Machine().Files() {-		// Slurp existing file if append is our op and add contents to it-		if f.Op == "append" {+		switch f.Op {+		case "create":+			if err = existsAndIsFile(f.Path); err == nil {+				return fmt.Errorf("file must not exist: %q", f.Path)+			}+		case "overwrite":+			if err = existsAndIsFile(f.Path); err != nil {+				return err+			}++			if err = os.Remove(f.Path); err != nil {

 type MachineConfig struct { 	MachineInstall *InstallConfig `yaml:"install,omitempty"` 	//   description: | 	//     Allows the addition of user specified files.+	//     The value of `op` can be `create`, `overwrite`, or `append`.+	//     In the case of `create`, `path` must not exist.+	//     In the case of `overwrite`, and `append`, `path` must be a valid file.+	//     If an `op` value of `append` is used, the existing file will be appended. 	//     Note that the file contents are not required to be base64 encoded. 	//   examples: 	//     - |-	//       kubelet:-	//         contents: |-	//           ...-	//         permissions: 0666-	//         path: /tmp/file.txt+	//       files:+	//         - contents: |

 func (task *ExtraFiles) TaskFunc(mode runtime.Mode) phase.TaskFunc { 	return task.runtime } +// nolint: gocyclo func (task *ExtraFiles) runtime(r runtime.Runtime) (err error) {-	var result *multierror.Error+	var (+		content string+		result  *multierror.Error+	)  	for _, f := range r.Config().Machine().Files() {-		// Slurp existing file if append is our op and add contents to it-		if f.Op == "append" {+		switch f.Op {+		case "create":+			if err = existsAndIsFile(f.Path); err == nil {+				return fmt.Errorf("file must not exist: %q", f.Path)+			}+		case "overwrite":+			if err = existsAndIsFile(f.Path); err != nil {+				return err+			}++			if err = os.Remove(f.Path); err != nil {

 type MachineConfig struct { 	MachineInstall *InstallConfig `yaml:"install,omitempty"` 	//   description: | 	//     Allows the addition of user specified files.+	//     If an `op` value of `append` is used, the existing file will be appended.

 install: #### files  Allows the addition of user specified files.+If an `op` value of `append` is used, the existing file will be appended. Note that the file contents are not required to be base64 encoded.  Type: `array`  Examples:  ```yaml-kubelet:-  contents: |-    ...-  permissions: 0666-  path: /tmp/file.txt+files:+  - contents: |+      ...+    permissions: 0666+    path: /tmp/file.txt+    op: [write,append]

 type Config struct { 	Contexts map[string]*Context `yaml:"contexts"` } +func (c *Config) upgrade() {+	for _, ctx := range c.Contexts {+		ctx.upgrade()+	}+}+ // Context represents the set of credentials required to talk to a target. type Context struct {-	Target string `yaml:"target"`-	CA     string `yaml:"ca"`-	Crt    string `yaml:"crt"`-	Key    string `yaml:"key"`+	DeprecatedTarget string   `yaml:"target,omitempty"` // Field deprecated in favor of Endpoints+	Endpoints        []string `yaml:"endpoints"`

 type Config struct { 	Contexts map[string]*Context `yaml:"contexts"` } +func (c *Config) upgrade() {+	for _, ctx := range c.Contexts {+		ctx.upgrade()+	}+}+ // Context represents the set of credentials required to talk to a target. type Context struct {-	Target string `yaml:"target"`-	CA     string `yaml:"ca"`-	Crt    string `yaml:"crt"`-	Key    string `yaml:"key"`+	DeprecatedTarget string   `yaml:"target,omitempty"` // Field deprecated in favor of Endpoints+	Endpoints        []string `yaml:"endpoints"`

 func (c *Client) PodSandboxStatus(ctx context.Context, podSandBoxID string) (*ru  	return resp.Status, resp.Info, nil }++// RemovePodSandboxesWithNetworkMode removes all pods with the specified network mode.+func (c *Client) RemovePodSandboxesWithNetworkMode(mode runtimeapi.NamespaceMode) (err error) {+	ctx := context.Background()++	pods, err := c.ListPodSandbox(ctx, nil)+	if err != nil {+		return err+	}++	var g errgroup.Group++	for _, pod := range pods {+		pod := pod // https://golang.org/doc/faq#closures_and_goroutines++		status, _, err := c.PodSandboxStatus(ctx, pod.GetId())+		if err != nil {+			return err+		}++		networkMode := status.GetLinux().GetNamespaces().GetOptions().GetNetwork()++		if networkMode != mode {+			continue+		}++		g.Go(func() error {+			if err := remove(ctx, c, pod); err != nil {+				return err

 func (c *Client) PodSandboxStatus(ctx context.Context, podSandBoxID string) (*ru  	return resp.Status, resp.Info, nil }++// RemovePodSandboxesWithNetworkMode removes all pods with the specified network mode.+func (c *Client) RemovePodSandboxesWithNetworkMode(mode runtimeapi.NamespaceMode) (err error) {+	ctx := context.Background()++	pods, err := c.ListPodSandbox(ctx, nil)+	if err != nil {+		return err+	}++	var g errgroup.Group++	for _, pod := range pods {+		pod := pod // https://golang.org/doc/faq#closures_and_goroutines++		status, _, err := c.PodSandboxStatus(ctx, pod.GetId())+		if err != nil {+			return err+		}++		networkMode := status.GetLinux().GetNamespaces().GetOptions().GetNetwork()++		if networkMode != mode {+			continue+		}++		g.Go(func() error {+			if err := remove(ctx, c, pod); err != nil {+				return err

 func (task *RemoveAllPods) standard() (err error) { 	// nolint: errcheck 	defer client.Close() +	// We remove pods with POD network mode first so that the CNI can perform+	// any cleanup tasks. If we don't do this, we run the risk of killing the+	// CNI, preventing the CRI from cleaning up the pod's netwokring.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_POD); err != nil {+		return err+	}++	// With the POD network mode pods out of the way, we kill the remaining+	// pods.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_NODE); err != nil {

 func (task *RemoveAllPods) standard() (err error) { 	// nolint: errcheck 	defer client.Close() +	// We remove pods with POD network mode first so that the CNI can perform+	// any cleanup tasks. If we don't do this, we run the risk of killing the+	// CNI, preventing the CRI from cleaning up the pod's netwokring.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_POD); err != nil {+		return err+	}++	// With the POD network mode pods out of the way, we kill the remaining+	// pods.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_NODE); err != nil {

 func (task *RemoveAllPods) standard() (err error) { 	// nolint: errcheck 	defer client.Close() +	// We remove pods with POD network mode first so that the CNI can perform+	// any cleanup tasks. If we don't do this, we run the risk of killing the+	// CNI, preventing the CRI from cleaning up the pod's netwokring.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_POD); err != nil {+		return err+	}++	// With the POD network mode pods out of the way, we kill the remaining+	// pods.++	if err = RemovePodsWithNetworkMode(client, runtimeapi.NamespaceMode_NODE); err != nil {

 func (t ticker) Stop() { // ExpectedError error represents an error that is expected by the retrying // function. This error is ignored. func ExpectedError(err error) error {+	if err == nil {

 func (e *ErrorSet) Error() string {  	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs)) 	for _, err := range e.errs {-		errString = fmt.Sprintf("%s\n%s", errString, err)+		errString = fmt.Sprintf("%s\n\t%s", errString, err)

 func generateAssets(config runtime.Configurator) (err error) { 		return err 	} +	// If "none" is the CNI, we expect the user to supply one or more urls that point to CNI yamls+	if config.Cluster().Network().CNI().Name() == "none" {+		ctx := context.Background()++		for _, url := range config.Cluster().Network().CNI().URLs() {+			urlExploded := strings.Split(url, "/")+			fileName := urlExploded[len(urlExploded)-1]

 func generateAssets(config runtime.Configurator) (err error) { 		return err 	} +	// If "none" is the CNI, we expect the user to supply one or more urls that point to CNI yamls+	if config.Cluster().Network().CNI().Name() == "none" {+		ctx := context.Background()++		for _, url := range config.Cluster().Network().CNI().URLs() {+			urlExploded := strings.Split(url, "/")+			fileName := urlExploded[len(urlExploded)-1]

 func (e *ErrorSet) Append(err error) error { 	defer e.mu.Unlock()  	if e.errs == nil {-		e.errs = make(map[string]error)+		e.errs = []error{} 	} -	if _, ok := e.errs[err.Error()]; !ok {-		e.errs[err.Error()] = err+	ok := false++	for _, existingErr := range e.errs {+		if err == existingErr {

 func New(config runtime.Configurator) (*Networkd, error) { 			if strings.HasPrefix(device.Name, "bond") { 				netconf[device.Name] = append(netconf[device.Name], nic.WithIgnore()) 			}++			// Ignore links that do not have a carrier+			carrier, err := ioutil.ReadFile("/sys/class/net/" + device.Name + "/carrier")+			if err != nil {+				result = multierror.Append(result, err)+				continue+			}++			// note -- since we're only applying this to discovered interfaces+			// that we don't have an explicit user defined, it wont negatively+			// impact bond interfaces+			if string(carrier) == "0" {+				netconf[device.Name] = append(netconf[device.Name], nic.WithIgnore())

 func Size(s int) Option { 	} } +// Follow file updates using inotify().+func Follow() Option {

 func (c *File) Read(ctx context.Context) <-chan []byte { 					select { 					case <-ctx.Done(): 						return-					case event := <-watcher.Events:+					case event := <-watcherEvents:

 func (c *File) Read(ctx context.Context) <-chan []byte { 	go func(ch chan []byte) { 		defer close(ch) -		watcher, err := fsnotify.NewWatcher()-		if err != nil {-			log.Printf("failed to watch: %v\n", err)-			return-		}-		// nolint: errcheck-		defer watcher.Close()+		var (+			watcherEvents chan fsnotify.Event+			watcherErrors chan error+		) -		if err = watcher.Add(filepath.Dir(filename)); err != nil {-			log.Printf("failed to watch add: %v\n", err)-			return-		}-		offset, err := c.source.Seek(0, io.SeekStart)-		if err != nil {-			log.Printf("failed to seek: %v\n", err)-			return+		if c.options.Follow {+			watcher, err := fsnotify.NewWatcher()+			if err != nil {+				log.Printf("failed to watch: %v\n", err)+				return+			}+			// nolint: errcheck+			defer watcher.Close()++			watcherEvents = watcher.Events+			watcherErrors = watcher.Errors++			if err = watcher.Add(filepath.Dir(filename)); err != nil {+				log.Printf("failed to watch add: %v\n", err)+				return+			} 		}  		buf := make([]byte, c.options.Size)  		for { 			for {-				n, err := c.source.ReadAt(buf, offset)+				n, err := c.source.Read(buf)

 func (l *Log) Close() error { 	return l.source.Close() } -// Read implements chunker.Chunker.-func (l *Log) Read(ctx context.Context) <-chan []byte {

 type Ticker interface { 	Stop() } +// ErrorSet represents a set of unique errors.+type ErrorSet struct {+	errs map[string]error++	mu sync.Mutex+}++func (e *ErrorSet) Error() string {+	if len(e.errs) == 0 {+		return ""+	}++	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs))+	for _, err := range e.errs {+		errString = fmt.Sprintf("%s\n%s", errString, err)+	}++	return errString+}++// Append adds the error to the set if the error is not already present.+func (e *ErrorSet) Append(err error) error {+	e.mu.Lock()+	defer e.mu.Unlock()++	if e.errs == nil {+		e.errs = make(map[string]error)+	}++	if _, ok := e.errs[err.Error()]; !ok {+		e.errs[err.Error()] = err+	}++	return e+}

 type Ticker interface { 	Stop() } +// ErrorSet represents a set of unique errors.+type ErrorSet struct {+	errs map[string]error++	mu sync.Mutex+}++func (e *ErrorSet) Error() string {+	if len(e.errs) == 0 {+		return ""+	}++	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs))

 type Ticker interface { 	Stop() } +// ErrorSet represents a set of unique errors.+type ErrorSet struct {+	errs map[string]error++	mu sync.Mutex+}++func (e *ErrorSet) Error() string {+	if len(e.errs) == 0 {+		return ""+	}++	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs))+	for _, err := range e.errs {+		errString = fmt.Sprintf("%s\n%s", errString, err)

 type Ticker interface { 	Stop() } +// ErrorSet represents a set of unique errors.+type ErrorSet struct {+	errs map[string]error++	mu sync.Mutex+}++func (e *ErrorSet) Error() string {+	if len(e.errs) == 0 {+		return ""+	}++	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs))

 type Ticker interface { 	Stop() } +// ErrorSet represents a set of unique errors.+type ErrorSet struct {+	errs map[string]error++	mu sync.Mutex+}++func (e *ErrorSet) Error() string {+	if len(e.errs) == 0 {+		return ""+	}++	errString := fmt.Sprintf("%d error(s) occurred:", len(e.errs))+	for _, err := range e.errs {+		errString = fmt.Sprintf("%s\n%s", errString, err)

 func (task *ExtraFiles) runtime(r runtime.Runtime) (err error) { 	var result *multierror.Error  	for _, f := range r.Config().Machine().Files() {-		p := filepath.Join("/var", f.Path)+		// Slurp existing file if append is our op and add contents to it+		var existingFileContents []byte+		if f.Op == "append" {+			existingFileContents, err = slurpFile(f.Path)+			if err != nil {+				result = multierror.Append(result, err)+				continue+			}++			f.Contents = string(existingFileContents) + "\n" + f.Contents+		}++		// Determine if supplied path is in /var or not.+		// If not, we'll write it to /var anyways and bind mount below+		p := f.Path+		inVar := true+		explodedPath := strings.Split(+			strings.TrimLeft(f.Path, "/"),+			string(os.PathSeparator),+		)++		if explodedPath[0] != "var" {+			p = filepath.Join("/var", f.Path)+			inVar = false+		}+ 		if err = os.MkdirAll(filepath.Dir(p), os.ModeDir); err != nil { 			result = multierror.Append(result, err)+			continue 		}  		if err = ioutil.WriteFile(p, []byte(f.Contents), f.Permissions); err != nil { 			result = multierror.Append(result, err)+			continue+		}++		// File path was not /var/... so we assume a bind mount is wanted+		if !inVar {+			if err = unix.Mount(p, f.Path, "", unix.MS_BIND|unix.MS_RDONLY, ""); err != nil {+				result = multierror.Append(result, fmt.Errorf("failed to create bind mount for %s: %w", p, err))+			} 		} 	}  	return result.ErrorOrNil() }++// slurpFile simplyu reads in a file and returns a byte slice+func slurpFile(path string) ([]byte, error) {+	file, err := ioutil.ReadFile(path)

+// This Source Code Form is subject to the terms of the Mozilla Public+// License, v. 2.0. If a copy of the MPL was not distributed with this+// file, You can obtain one at http://mozilla.org/MPL/2.0/.++package runner++import (+	"context"+	"errors"+	"io"+	"log"+	"os"+	"os/exec"+	"strings"+	"time"++	"github.com/docker/docker/api/types"+	"github.com/docker/docker/api/types/container"+	"github.com/docker/docker/api/types/filters"+	"github.com/docker/docker/client"++	"github.com/talos-systems/talos/pkg/retry"+)++// ContainerConfigs hold the configs we use to launch our container+type ContainerConfigs struct {+	ContainerConfig *container.Config+	HostConfig      *container.HostConfig+}++// CommandLocal runs a local binary. Used for osctl cluster create and setup+func CommandLocal(command string) error {+	commandSplit := strings.Split(command, " ")+	log.Println("issuing local command : '" + command + "'")++	_, err := exec.Command(commandSplit[0], commandSplit[1:]...).Output()+	if err != nil {+		return err+	}++	return nil+}++// CommandInContainer simply runs a bash command in the hyperkube containers+// nolint: gocyclo+func CommandInContainer(ctx context.Context, client *client.Client, runnerConfig *ContainerConfigs, command string) error {

+// This Source Code Form is subject to the terms of the Mozilla Public+// License, v. 2.0. If a copy of the MPL was not distributed with this+// file, You can obtain one at http://mozilla.org/MPL/2.0/.++// Package provider provides TLS config for client & server+package provider++import (+	stdlibtls "crypto/tls"+	"fmt"+	stdlibnet "net"+	"os"++	"github.com/talos-systems/talos/internal/pkg/runtime"+	"github.com/talos-systems/talos/pkg/constants"+	"github.com/talos-systems/talos/pkg/grpc/tls"+	"github.com/talos-systems/talos/pkg/net"+)++// TLSConfig provides client & server TLS configs for apid.+type TLSConfig struct {+	certificateProvider tls.CertificateProvider+}++// NewTLSConfig builds provider from configuration and endpoints.+func NewTLSConfig(config runtime.Configurator, endpoints []string) (*TLSConfig, error) {+	ips, err := net.IPAddrs()+	if err != nil {+		return nil, fmt.Errorf("failed to discover IP addresses: %w", err)+	}+	// TODO(andrewrynhard): Allow for DNS names.+	for _, san := range config.Machine().Security().CertSANs() {+		if ip := stdlibnet.ParseIP(san); ip != nil {+			ips = append(ips, ip)+		}+	}++	hostname, err := os.Hostname()+	if err != nil {+		return nil, fmt.Errorf("failed to discover hostname: %w", err)+	}++	tlsConfig := &TLSConfig{}++	tlsConfig.certificateProvider, err = tls.NewRemoteRenewingFileCertificateProvider(+		config.Machine().Security().Token(),+		endpoints,+		constants.TrustdPort,+		hostname,+		ips,+	)+	if err != nil {+		return nil, err+	}

 func writeResolvConf(resolvers []string) error {  	return ioutil.WriteFile("/etc/resolv.conf", []byte(resolvconf.String()), 0644) }++const hostsTemplate = `+127.0.0.1       localhost+{{ .IP }}       {{ .Hostname }} {{ if ne .Hostname .Alias }}{{ .Alias }}{{ end }}+::1             localhost ip6-localhost ip6-loopback+ff02::1         ip6-allnodes+ff02::2         ip6-allrouters+`++func writeHosts(hostname string, address net.IP) (err error) {+	data := struct {+		IP       string+		Hostname string+		Alias    string+	}{+		IP:       address.String(),+		Hostname: hostname,+		Alias:    strings.Split(hostname, ".")[0],+	}++	tmpl, err := template.New("").Parse(hostsTemplate)+	if err != nil {+		return

 func OSRelease() (err error) {  	err = tmpl.Execute(writer, data) 	if err != nil {-		return-	}--	if err = ioutil.WriteFile("/run/system/etc/os-release", writer.Bytes(), 0644); err != nil {-		return fmt.Errorf("write /run/system/etc/os-release: %w", err)-	}--	if err = unix.Mount("/run/system/etc/os-release", "/etc/os-release", "", unix.MS_BIND, ""); err != nil {-		return fmt.Errorf("failed to create bind mount for /etc/os-release: %w", err)+		return err 	} -	return nil+	return ioutil.WriteFile("/run/system/etc/os-release", writer.Bytes(), 0644) } -func ip() string {-	addrs, err := net.InterfaceAddrs()-	if err != nil {-		return ""+// createBindMount creates a common way to create a writable source file with a+// bind mounted destination. This is most commonly used for well known files+// under /etc that need to be adjusted during startup.+func createBindMount(src, dst string) (err error) {+	var f *os.File++	if f, err = os.OpenFile(src, os.O_WRONLY|os.O_CREATE, 0644); err != nil {+		return err 	} -	for _, address := range addrs {-		if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {-			if ipnet.IP.To4() != nil {-				return ipnet.IP.String()-			}-		}+	// nolint: errcheck+	defer f.Close()

 func OSRelease() (err error) {  	tmpl, err := template.New("").Parse(osReleaseTemplate) 	if err != nil {-		return+		return err

 COPY images/networkd.tar /rootfs/usr/images/ # symlinks to avoid accidentally cleaning them up. COPY ./hack/cleanup.sh /toolchain/bin/cleanup.sh RUN cleanup.sh /rootfs-COPY hack/containerd.toml /etc/containerd.toml-COPY hack/containerd.toml /etc/containerd-system.toml+COPY hack/containerd.toml /rootfs/etc/containerd/cri.toml