# Talos Wrapper (`omnipy talos`)

`omnipy` provides a thin proxy around `talosctl` with managed `talosconfig` lifecycle.

## Command shape

```bash
omnipy talos|t [wrapper-options] <talosctl-subcommand> [args...]
```

Wrapper options:

- `--cluster, -c`: cluster to resolve managed talos context.
- `--refresh`: force refresh of managed `talosconfig`.
- `--ttl <seconds>`: lazy refresh TTL (default `300`).
- `--break-glass`: request break-glass talosconfig from Omni.
- `--talosconfig-path <path>`: override managed talosconfig file path.
- `--print-command`: print the final proxied `talosctl` command.

## Behavior

`omnipy talos`:

1. Ensures a managed `talosconfig` exists for the active Omni instance.
2. Merges/updates a deterministic context name: `omni/<instance>/<cluster-or-generic>`.
3. Injects missing flags:
4. `--talosconfig <managed-path>`
5. `--context <managed-context>`
6. If a service-account key is configured and `--siderov1-keys-dir` is not explicitly set, passes `OMNI_SERVICE_ACCOUNT_KEY` to the proxied `talosctl` process.
7. Resolves `--nodes` values from machine hostnames to machine IDs (for example `metal-a8c64g-mfum690s-001` to `03ebd680-b6a5-11ed-9210-d2dfd04d4a00`) using `MachineStatuses`.
8. `--nodes` / `-n` without a value reuses the last saved node selection for the same instance+cluster.
9. Reuses last explicit `--nodes` / `--endpoints` for the same instance+cluster.
10. Executes `talosctl` and returns the same exit code.

## Config integration

Use `omnipy config talos` to manage defaults:

```bash
omnipy config talos info
omnipy config talos set-default-cluster cluster-a
omnipy config talos set-talosconfig-path ~/.talos/omni-managed.yaml
omnipy config talos refresh --cluster cluster-a
```
