Feature Request: Advanced Interface/IP Selection for Trustd/APID (similar to etcd advertisedSubnets/listenSubnets)

[alexfouche]

Problem Statement

Currently in Talos Linux v1.11, Trustd and APID lack the ability to configure which network interface or IP address they should bind to and advertise. By default, Trustd only advertises the first available address, which can be problematic in multi-homed control plane environments.

Use Case

For multi-homed control plane nodes that need to:

• Provide private subnet access to Trustd/APID services
• Control which network interface is used for internal communication
• Ensure proper routing in complex network topologies with multiple network interfaces

This limitation makes it difficult to properly configure control plane nodes in environments with multiple network interfaces where you want to specify which subnet should be used for Trustd/APID communication.

Proposed Solution

Add configuration options similar to etcd's advertisedSubnets and listenSubnets functionality for Trustd and APID. This would allow operators to explicitly configure:

• Bind addresses: Which interface/IP addresses Trustd/APID should listen on
• Advertise addresses: Which addresses should be advertised to other nodes for connecting to these services

Example configuration schema (similar to etcd config):

cluster:
  trustd:
    advertisedSubnets:
      - 10.171.0.0/16
    listenSubnets:
      - 10.171.0.0/16
  apid:
    advertisedSubnets:
      - 10.171.0.0/16
    listenSubnets:
      - 10.171.0.0/16

Additional Context

etcd already has this functionality in Talos, but Trustd does not (as of v1.11). This creates an inconsistency where etcd can be properly configured for multi-homed environments, but Trustd/APID cannot.

Impact

This feature would enable more flexible and reliable deployments in:

• Private cloud environments with dedicated management networks
• Hybrid cloud setups with multiple network interfaces
• High-security environments requiring network segmentation
• Any multi-homed control plane configuration

Thank you for considering this feature request!

[alexfouche]

maybe there is no issue after all. I realized that the failing worker node had a typo in the vlan number for the private interface, and Flannel could not connect to vxlan to the other nodes.
That is maybe the reason why Trustd decided to connect though the public network interface

[smira]

Talos binds and advertises all addresses for both apid and trustd. So I don't see anything which can be done better here.

Make sure your subnet/service CIDR doesn't overlap with your host networking.