The drift preview that talm apply prints to stderr before sending a config walks every leaf field in the on-node vs rendered MachineConfig diff and prints path: oldValue -> newValue. When a secret-bearing field changes between renders (cluster.aescbcEncryptionSecret, cluster.token, cluster.secret, machine.token, cluster.ca.key, etc.), the literal values land in operator stderr — same behaviour as talosctl get machineconfig, but the drift preview runs implicitly on every apply where talosctl get machineconfig is an explicit operator action.
Mitigation worth considering: a redaction allowlist that matches known-secret JSONPaths and substitutes the value with <redacted> while still surfacing the path so the operator sees what changed. Talos's own config schema already marks Sensitive resources at the COSI level (MachineConfigs.config.talos.dev is meta.Sensitive); the same shape could be lifted into a per-path map for the drift formatter.
Scope: extend pkg/applycheck/diff.go::leafDiff (or a new wrapper at the printDriftPreview boundary) to consult a secretPaths allowlist. Default-on. New --show-secrets-in-drift flag for operators who want the raw values for debugging.
Out of scope here: defining the full secret path list — likely needs a sweep through Talos's v1alpha1 config types to enumerate every Sensitive-marked field.
The drift preview that
talm applyprints to stderr before sending a config walks every leaf field in the on-node vs rendered MachineConfig diff and printspath: oldValue -> newValue. When a secret-bearing field changes between renders (cluster.aescbcEncryptionSecret,cluster.token,cluster.secret,machine.token,cluster.ca.key, etc.), the literal values land in operator stderr — same behaviour astalosctl get machineconfig, but the drift preview runs implicitly on every apply wheretalosctl get machineconfigis an explicit operator action.Mitigation worth considering: a redaction allowlist that matches known-secret JSONPaths and substitutes the value with
<redacted>while still surfacing the path so the operator sees what changed. Talos's own config schema already marks Sensitive resources at the COSI level (MachineConfigs.config.talos.devismeta.Sensitive); the same shape could be lifted into a per-path map for the drift formatter.Scope: extend
pkg/applycheck/diff.go::leafDiff(or a new wrapper at theprintDriftPreviewboundary) to consult asecretPathsallowlist. Default-on. New--show-secrets-in-driftflag for operators who want the raw values for debugging.Out of scope here: defining the full secret path list — likely needs a sweep through Talos's v1alpha1 config types to enumerate every Sensitive-marked field.