@@ -304,12 +304,13 @@ var initCmd = &cobra.Command{
304304 talosconfigFileExists := fileExists (talosconfigFile )
305305 encryptedTalosconfigFileExists := fileExists (encryptedTalosconfigFile )
306306
307- // If encrypted file exists, decrypt it
307+ // If encrypted file exists, decrypt it (don't require key - will generate if needed)
308308 if encryptedTalosconfigFileExists && ! talosconfigFileExists {
309- if err := age .DecryptYAMLFile (Config .RootDir , "talosconfig.encrypted" , "talosconfig" ); err != nil {
310- return fmt .Errorf ("failed to decrypt talosconfig: %w" , err )
309+ _ , err := handleTalosconfigEncryption (false )
310+ if err != nil {
311+ // If decryption fails (e.g., no key), continue to generate
311312 }
312- talosconfigFileExists = true
313+ talosconfigFileExists = fileExists ( talosconfigFile )
313314 }
314315
315316 // Generate talosconfig only if it doesn't exist
@@ -331,22 +332,13 @@ var initCmd = &cobra.Command{
331332 talosconfigFileExists = true
332333 }
333334
334- // If talosconfig exists but encrypted file doesn't, encrypt it
335- if talosconfigFileExists && ! encryptedTalosconfigFileExists {
336- // Ensure key exists
337- if ! keyFileExists {
338- _ , keyCreated , err := age .GenerateKey (Config .RootDir )
339- if err != nil {
340- return fmt .Errorf ("failed to generate key: %w" , err )
341- }
342- keyFileExists = true // Update flag after creation
343- keyWasCreated = keyCreated
344- }
345-
346- // Encrypt talosconfig
347- if err := age .EncryptYAMLFile (Config .RootDir , "talosconfig" , "talosconfig.encrypted" ); err != nil {
348- return fmt .Errorf ("failed to encrypt talosconfig: %w" , err )
349- }
335+ // Encrypt talosconfig if needed
336+ talosKeyCreated , err := handleTalosconfigEncryption (false )
337+ if err != nil {
338+ return err
339+ }
340+ if talosKeyCreated {
341+ keyWasCreated = true
350342 }
351343
352344 // Handle kubeconfig encryption logic (check if kubeconfig exists from Chart.yaml)
@@ -627,6 +619,60 @@ func printSecretsWarning() {
627619 fmt .Fprintf (os .Stderr , "\n " )
628620}
629621
622+ // handleTalosconfigEncryption handles encryption/decryption logic for talosconfig file.
623+ // It decrypts if encrypted file exists, encrypts if plain file exists.
624+ // requireKeyForDecrypt: if true, returns error if key is missing when trying to decrypt.
625+ // Returns true if key was created during this call, false otherwise.
626+ func handleTalosconfigEncryption (requireKeyForDecrypt bool ) (bool , error ) {
627+ talosconfigFile := filepath .Join (Config .RootDir , "talosconfig" )
628+ encryptedTalosconfigFile := filepath .Join (Config .RootDir , "talosconfig.encrypted" )
629+ talosconfigFileExists := fileExists (talosconfigFile )
630+ encryptedTalosconfigFileExists := fileExists (encryptedTalosconfigFile )
631+ keyFile := filepath .Join (Config .RootDir , "talm.key" )
632+ keyFileExists := fileExists (keyFile )
633+ keyWasCreated := false
634+
635+ // If encrypted file exists, decrypt it
636+ if encryptedTalosconfigFileExists && ! talosconfigFileExists {
637+ if ! keyFileExists {
638+ if requireKeyForDecrypt {
639+ return false , fmt .Errorf ("talosconfig.encrypted exists but talm.key is missing. Cannot decrypt without key" )
640+ }
641+ // If key is not required, just return (don't decrypt)
642+ return false , nil
643+ }
644+ fmt .Fprintf (os .Stderr , "Decrypting talosconfig.encrypted -> talosconfig\n " )
645+ if err := age .DecryptYAMLFile (Config .RootDir , "talosconfig.encrypted" , "talosconfig" ); err != nil {
646+ return false , fmt .Errorf ("failed to decrypt talosconfig: %w" , err )
647+ }
648+ talosconfigFileExists = true
649+ }
650+
651+ // If talosconfig exists but encrypted file doesn't, encrypt it
652+ if talosconfigFileExists && ! encryptedTalosconfigFileExists {
653+ // Ensure key exists
654+ if ! keyFileExists {
655+ _ , keyCreated , err := age .GenerateKey (Config .RootDir )
656+ if err != nil {
657+ return false , fmt .Errorf ("failed to generate key: %w" , err )
658+ }
659+ keyWasCreated = keyCreated
660+ if keyCreated {
661+ fmt .Fprintf (os .Stderr , "Generated new encryption key: talm.key\n " )
662+ }
663+ keyFileExists = true
664+ }
665+
666+ // Encrypt talosconfig
667+ fmt .Fprintf (os .Stderr , "Encrypting talosconfig -> talosconfig.encrypted\n " )
668+ if err := age .EncryptYAMLFile (Config .RootDir , "talosconfig" , "talosconfig.encrypted" ); err != nil {
669+ return false , fmt .Errorf ("failed to encrypt talosconfig: %w" , err )
670+ }
671+ }
672+
673+ return keyWasCreated , nil
674+ }
675+
630676func writeToDestination (data []byte , destination string , permissions os.FileMode ) error {
631677 if err := validateFileExists (destination ); err != nil {
632678 return err
0 commit comments