talosctl config merge and kubeconfig --merge are not idempotent

Merging the same Talos context twice renames it to name-1 and makes it current; talosctl kubeconfig --merge issues a new client certificate on every call. How to add a cluster to your default configs from automation without surprises.

I wanted an Ansible role that adds a cluster to my everyday talosconfig and kubeconfig, and can run again and again without touching anything that’s already right. talosctl has the commands for it, but not the behaviour I’d assumed. I tried each one in a scratch directory before writing a single task.

talosctl config merge

• Merging a context that already exists doesn’t do nothing: it renames the new one to <name>-1 and makes it current. Look the name up first (talosctl config contexts) and skip when it’s there.
• Merging into an existing file leaves the current context alone. Merging into a missing file makes the merged context current.
• talosctl config endpoint --context NAME ... changes only that context, so it’s the right call for keeping endpoints correct afterwards.

talosctl kubeconfig —merge

• It reissues the client certificate every time, so the file differs after every call. Compare entries (server and context names), never file hashes.
• In a new file the context is named admin@<cluster>. --force-context-name only renames when merging into an existing file. I rename it with kubectl config rename-context and count either name as “present”.
• kubectl config set-cluster creates the entry if the name is wrong, so read the existing server first and skip when the cluster entry doesn’t exist.

Both files come out with mode 0600.

What it came to

Add when the context is missing, restore the previous current context if a merge changed it, fix endpoints and server address afterwards, rename the context. The role reports no change on a rerun. I found the admin@<cluster> naming problem only in the last case I tried, where the files didn’t exist yet, which is a good argument for trying the awkward starting states in a scratch directory before trusting any of it.