Wrapper --nodes guard fires on commands with their own node-selection (crashdump, rotate-ca)

[lexfrei]

Problem

talm crashdump requires --nodes even though the underlying talosctl crashdump uses --control-plane-nodes / --worker-nodes / --init-node for node selection. Operators following the help text get an opaque error.

Reproduction

talm crashdump --control-plane-nodes 158.101.113.227 --endpoints 158.101.113.227

Output:

nodes are not set for the command: please use `--nodes` flag or configuration file to set the nodes to run the command against
hint: use --nodes flag or configuration file to set the nodes to run the command against

The talm root layer guards on len(GlobalArgs.Nodes) < 1 (at pkg/commands/root.go:262), but crashdump's native API doesn't consume that field — it accepts --control-plane-nodes/--worker-nodes/--init-node lists separately. The guard fires before the command's own node-selection logic runs.

Workaround

Pass a redundant --nodes:

talm crashdump --control-plane-nodes 158.101.113.227 --nodes 158.101.113.227 --endpoints 158.101.113.227

Works, but talm's required flag is meaningless for this command (the actual node selection comes from the --control-plane-nodes list).

Note

Talos itself has deprecated crashdump:

`talosctl crashdump` is deprecated, please use `talosctl support` instead

So this may not be worth fixing at the crashdump level — but the same guard applies to any talosctl command whose node-selection model diverges from --nodes (rotate-ca uses --control-plane-nodes, conformance is similar). Worth carving an exception list in the wrapper:

pkg/commands/talosctl_wrapper.go could maintain commandsWithoutNodesRequirement = ["crashdump", "rotate-ca", "support", ...] and skip the guard for them, deferring to the command's native selection.

Expected

Either:

1. Exception list in the wrapper that skips the --nodes guard for commands using alternative node-selection flags.
2. Deprecate crashdump in talm to follow upstream (use support instead) and document the others.

Surfaced during the dev17 read-only sweep.